US Sanctions Iran Shadow Banking Network

Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, U.S. sanctioned an Iranian shadow banking network, Texas man denied a bankruptcy discharge, Nemo blamed $2.6M exploit on developer errors and weak governance, THORChain founder hacked, Shibarium Bridge hit by $2.4M hack, Denver court ruled pastor’s $3.3M project a fraud and NYDFS told banks to use blockchain analytics.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

The U.S. Department of Treasury sanctioned two Iranian financial facilitators and more than a dozen companies and individuals in Hong Kong and the United Arab Emirates for running a shadow banking network that funneled funds to Iran’s Islamic Revolutionary Guard Corps Quds Force and the Ministry of Defense and Armed Forces Logistics.

The network laundered proceeds from Iranian oil sales through front companies and cryptocurrency, moving hundreds of millions of dollars to support regional proxy groups and weapons programs. Iranian nationals Alireza Derakhshan and Arash Estaki Alivand coordinated more than $100 million in crypto transactions between 2023 and 2025, working with organizations linked to Hezbollah and Syria’s Al-Qatirji Company.

U.S. sanctions block all U.S.-controlled assets tied to the individuals and entities and prohibit individuals in the U.S. from conducting related transactions. Treasury officials said the action aims to disrupt illicit financial streams funding Iran’s ballistic missile and drone programs.

A bankruptcy court denied Texas man Nathan Fuller’s request to discharge more than $12.5 million in debts after federal officials accused him of fraud.

The U.S. Trustee Program said that Fuller concealed assets, falsified records and lied under oath to evade creditors, including victims of his cryptocurrency Ponzi scheme, Privvy Investments. Fuller, who filed for Chapter 7 protection in October 2024, had already admitted to operating Privvy as a Ponzi scheme, fabricating documents and giving false testimony.

Investigators said he diverted investor funds to purchase luxury goods, finance gambling trips and buy a nearly $1 million home for his ex-wife. After Fuller failed to respond to the USTP’s complaint, the court entered a default judgment, leaving him liable for his debts.

Sui-based DeFi platform Nemo Protocol said that a $2.6 million exploit earlier this month stemmed from vulnerabilities introduced by a developer and deployed without adequate audits.

Nemo said in a post-mortem report the Sept. 7 attack exploited two flaws: a mistakenly public flash loan function and a query function that enabled unauthorized state changes. These issues, added after an initial MoveBit audit in January, were not reviewed before deployment. Nemo admitted its governance structure, which relied on a single-signature address for upgrades, allowed the insecure code to go live. Attackers combined the vulnerabilities to drain assets from the SY/PT liquidity pool, later bridging funds to ethereum.

Nemo has paused operations, patched the code, ordered an emergency audit and is working with Sui security teams on fund recovery and user compensation.

THORChain founder John-Paul Thorbjornsen said he was the victim of a $1.35 million wallet hack linked to North Korean hackers.

Initially flagged by PeckShield as a possible THORChain exploit, the incident was later clarified as a breach of Thorbjornsen’s personal MetaMask wallet, unrelated to the THORChain or THORSwap protocols. He said attackers gained access through a fake Zoom link sent from the hacked Telegram account of a friend, enabling them to compromise multiple old private-key wallets.

Onchain analyst ZachXBT reported that the attackers stole around $1.03 million in Kyber Network tokens and $320,000 in THORSwap tokens, later moving the funds into ethereum.

THORSwap sent onchain bounty offers to the exploiter, promising no legal action if the assets are returned within 72 hours.

Shiba Inu’s Layer 2 network Shibarium suffered a $2.4 million exploit after an attacker used a flash loan to seize majority control of validator keys. The attacker borrowed 4.6 million BONE tokens, gaining access to 10 of 12 validator signing keys, which were enough to control two-thirds of the network.

They drained 224.57 ETH and 92.6 billion SHIB from the Shibarium bridge contract before transferring assets to their own wallet. In response, developers paused staking and unstaking functions, froze the borrowed BONE tokens and stopped the attacker from maintaining control.

The hacker also obtained $700,000 worth of K9 Finance’s KNINE tokens, but the K9 DAO blacklisted their address, making the assets unsellable.

Shiba Inu developer Kaal Dhairya called the attack “sophisticated” and said it likely took months of planning. The team has engaged external investigators, contacted law enforcement and offered a bounty if the funds are returned.

A Colorado state court ruled that INDXcoin, a cryptocurrency promoted by Pastor Eli Regalado and his wife Kaitlyn, was a fraudulent scheme. Denver District Court Heidi L. Kutcher found the couple and their company INDXcoin liable for securities fraud, entering a $3.34 million judgment against them.

Between June 2022 and April 2023, the Regalados raised nearly $3.4 million from more than 300 investors, mostly from Denver’s Christian community, through their Kingdom Wealth Exchange platform. The exchange collapsed within a day, leaving investors with nothing, despite an auditor rating the project’s security “0 out of 10.”

Regulators said the couple diverted funds to luxury purchases, including a Range Rover, jewelry, trips and home renovations.

Colorado Securities Commissioner Tung Chan said they exploited faith and technology to run a “21st century false prophet” scam. The civil ruling follows an earlier decision confirming INDXcoin as a security and a separate July criminal indictment against the pair.

The New York State Department of Financial Services is directing banks to adopt blockchain analytics tools to combat financial crime as interest in digital assets grows. Regulators said institutions expanding into virtual currency must update compliance practices to address evolving risks such as money laundering, sanctions evasion and terrorist financing.

NYDFS Superintendent Adrienne Harris said that traditional banks entering the digital asset space must integrate new technologies into risk management frameworks. The guidance recommends applying blockchain analytics when screening customer wallets, assessing potential risks of digital asset products and monitoring ongoing transactions.

The regulator said that emerging technologies create new threats, but the analytics tools offer enhanced visibility for identifying suspicious activity. NYDFS previously encouraged regulated firms to adopt blockchain technology in 2022, but said the need has become more urgent as virtual currency adoption accelerates and banks play a central role in safeguarding financial integrity.