On 13 July, Hoptrail was invited to Parliament to present our intelligence on the crypto operations of Iran's Islamic Revolutionary Guard Corps (IRGC) in the United Kingdom. On the same day, the UK Government designated the IRGC under the newly enacted National Security (State Threats) Act 2026 — criminalising support for the group without formally proscribing it as a terrorist organisation.
Our report, Crypto, Sanctions and Secrecy: The IRGC's Financial Footprint in Britain, sets out what we found: two UK-registered cryptocurrency exchanges that processed close to $1 billion in transactions linked to the IRGC, a family-run OTC network operating from London, and a wave of Iran-linked attacks across the UK earlier this year that follows a pattern the DOJ has now spelled out in indictment.
Presenting the findings at Parliament, 13 July 2026.
Why the UK?
As Western sanctions have tightened around Iran's economy over the past few years, cryptocurrency has emerged as a major channel for evading them. Analysts, corporate investigators and law enforcement agencies across the US, UK and EU have begun to trace a common pattern: the IRGC is no longer simply moving money through Western financial systems from the outside — it has built its own companies and accounts inside them, and it is through those that it moves funds.
Recent estimates put Iran's total crypto activity in 2025 at approximately $7 billion to $10 billion, including both inbound and outbound flows, with hundreds of millions of dollars traced back to wallets linked to IRGC-controlled entities.
The IRGC has exploited the UK's corporate infrastructure for two reasons. First, registering a company at Companies House is quick and cheap, and a London address confers Western legitimacy on Iranian networks otherwise locked out of international markets. Second, until very recently, the registration regime required no identity verification for directors or beneficial owners. This allowed IRGC-linked actors to stand up shells through nominees, fabricated identities and virtual offices. These UK-incorporated entities then acted as the interface between the regulated financial system and the unregulated stablecoin economy, running most of their transactions in USDT on the TRON blockchain, using a combination offering low fees and deep liquidity.
The Zedcex / Zedxion case
Between 2023 and 2025, two UK-registered cryptocurrency exchanges — Zedcex and Zedxion — processed around $1 billion in stablecoin transactions linked to the IRGC. Their UK registration gave the platforms international credibility while allowing them to facilitate financial flows connected to Iran despite existing sanctions.
Rather than build their own exchange infrastructure, both platforms relied on ChainUp, a Singapore-based provider of white-label cryptocurrency exchange technology. That let them launch and expand quickly while using separate wallets for different transaction types, which made it harder to trace funds linked to sanctioned entities.
Zedxion also created its own stablecoin, USDZ, promoted through Persian-language Telegram channels. By issuing its own digital dollar, the exchange gained greater control over transactions in the Iranian market and reduced its dependence on third-party stablecoins.
Most transactions were carried out using Tether (USDT) on the TRON blockchain. The network's low fees and high liquidity made it possible to move large amounts of money quickly and at minimal cost, an efficient rail for cross-border transfers.
The exchanges were also connected to major Iranian cryptocurrency platforms, including Nobitex, Wallex.ir and Aban Tether. This integration allowed funds linked to sanctioned actors to mix with legitimate retail transactions, making suspicious activity harder to identify and trace.
To connect digital assets with the conventional financial system, Zedxion relied on Zedpay, a Turkey-based payment processor. Through banking relationships in Turkey, Zedpay provided a fiat on- and off-ramp that allowed cryptocurrency to be converted into traditional currencies, making the funds useful for real-world transactions despite international financial restrictions.
Finally, Elliptic has reported evidence suggesting that the Central Bank of Iran purchased at least $507 million in USDT. If accurate, this indicates that the same cryptocurrency ecosystem may have supported not only IRGC-related activity but broader Iranian government objectives, such as the support of the Iranian Rial.
Companies House: how the shell held together
An OCCRP investigation published in February 2026 established that the listed director and person with significant control of Zedxion Exchange Ltd., described in Companies House filings as a Dominican national named "Elizabeth Newman", was a fictitious identity. OCCRP could find no passport records, migration history or other evidence that such a person existed. The investigation also identified a link between the network and Iranian businessman Babak Zanjani through social media posts by his partner, Solmaz Bani.
Companies House records show that a United Arab Emirates passport-holder named "Babak Morteza", whose identifying details match those of Babak Zanjani, was Zedxion's listed person with significant control from October 2021 to August 2022. At the time, Zanjani was formally subject to a death sentence in Iran following a 2016 conviction for embezzlement of state oil funds. His sentence was commuted in 2024 and he was formally released, though prison records seen by OCCRP suggest he may have been allowed to leave prison as of 2019 — two years before Zedxion was formally incorporated. He is now associated with DotOne Holding Group, a conglomerate spanning cryptocurrency, foreign exchange, logistics, aviation and telecommunications. Despite filing as a dormant company in the United Kingdom, Zedcex alone has processed more than $94 billion in total transactions since its August 2022 registration, according to the US Treasury.
The OCCRP investigation, combined with OFAC's January 2026 sanctions designations of both Zedxion and Zedcex, triggered enforcement action by Companies House. In March 2026, the registrar published a notice stating its intention to forcibly strike off Zedxion Exchange Ltd. under section 1002A of the Companies Act 2006, on the grounds that the information in its incorporation filing was "misleading, false, or deceptive." This was one of the first uses of the expanded powers granted to Companies House under the Economic Crime and Corporate Transparency Act 2023. Mandatory identity verification for directors and beneficial owners, introduced in late 2025, was applied in 2026 with a grace period for existing directors that expired on 19 May 2026.
On-chain: military correlation
Analysis of Zedcex-linked wallets across the period October 2024 to June 2025 reveals a distinctive temporal pattern: substantial USDT inflows into Zedcex wallets coincide with periods of intensified Iranian military activity. Large flows were recorded in October 2024, during the wave of Iranian missile strikes on Israel, and again in June 2025 during the Twelve-Day War. Zedcex was subsequently sanctioned on 30 January 2026, with US and Israeli strikes on Iran following in February 2026.
Figure: Zedcex fund flows, October 2024 – June 2025.
The chart above traces the movement of USDT into Zedcex wallets from a series of unknown high-volume wallets, with the majority of flows concentrated in the months preceding and during periods of open military confrontation. Onward flows from Zedcex terminate at a small number of receiving exchanges, of which Binance is the most significant.
A vertically integrated ecosystem
Zedxion and Zedcex do not operate as isolated exchanges. Rather, they form part of a vertically integrated ecosystem that combines centralised and decentralised exchange functions, a proprietary blockchain infrastructure (the Zedxion Smart Chain), a suite of native and stablecoin tokens (ZEDX, USDZ and ZED20), and settlement across the major public blockchains (TRON, Ethereum and Binance Smart Chain). This architecture materially increases the resilience of the ecosystem and makes it substantially harder to disrupt through a single enforcement action against any one entity or exchange.
Figure: Zedxion / Zedcex vertically integrated exchange and blockchain ecosystem.
The External Settlement Layer is particularly relevant for enforcement. TRON, in particular, functions as the principal transfer network for USDT within this ecosystem, operating as a liquidity and settlement rail even though it is not a component of the Zedxion infrastructure itself. Any regulatory response that focuses solely on the exchange layer, without addressing the settlement and token layers, is likely to be circumvented through migration between the different components of the system.
The Zaringhalam network
The Zedcex / Zedxion case sits alongside - and overlaps with - a second strand of UK exposure. A May 2026 investigation by Iran International, based on sanctions records and leaked documents, identified a family-run financial network accused of laundering money for the IRGC, operating from London and moving funds through shell companies in China and the UAE. The network centres on the Zaringhalam family, several members of which hold British citizenship and reside in London.
Nasser Zaringhalam, sanctioned by the US Treasury in June 2025, owns Berelian Exchange. According to documents reviewed by Iran International, Nasser and his exchange office registered at least 37 shell companies in the UAE and China and maintained more than 140 bank accounts in those jurisdictions to evade sanctions. One leaked document records Nasser being asked by Zagros Petrochemical Company — a subsidiary of Parsian Oil and Gas Group, which belongs to Ghadir Investment Company, the holding company of the Armed Forces Social Security Organization - to transfer €3 million to Fanzhian International, a shell company in China, processed through Zhishank Bank. The CEO of Parsian Oil and Gas Group is IRGC Brigadier General Ahmad Vahidi Dastjerdi, a former deputy defence minister.
The UK has also sanctioned Nasser's son Pouria Zaringhalam, 29, who holds both British and Saint Kitts citizenship. He has lived in properties in Finchley and Canary Wharf in recent years and British authorities have confirmed he resides in London. A second family member sanctioned by Britain is Fazlollah Zaringhalam, 74, Nasser's brother, who also holds British citizenship and resides in London and owns Zaringhalam & Partners Exchange. Another sanctioned family member, Mansour Zaringhalam, 63, owns Mansour Zaringhalam & Partners Company (also known as GCM Exchange), which the United States sanctioned in 2025 for financing the IRGC. A fourth, Farhad Zaringhalam, 44, a specialist in wireless communications and financial technology, holds British citizenship and earned both his bachelor's degree and PhD in electronics from King's College London - before going on to serve on the board of Pergas Petro Trade Group in Iran and to manage a company in Singapore now sanctioned by the United States.
The Zaringhalam case demonstrates that the UK-IRGC financial infrastructure extends well beyond crypto. It encompasses traditional OTCs, cash-based settlement, multi-jurisdictional shell architectures, and individuals who are simultaneously British citizens and core operators in Iran's sanctions evasion machinery.
The March–May 2026 attacks — and the operational model
Between March and May 2026, the United Kingdom experienced a sustained wave of attacks targeting Jewish community sites, individuals and Iranian-dissident media in London. The attacks involved arson, attempted arson, drone activity and a stabbing declared a terrorist incident by the Metropolitan Police. Responsibility for several was claimed online by a group calling itself Harakat Ashab al-Yamin al-Islamiya (HAYI).
On 15 May 2026, the US Department of Justice unsealed a criminal complaint — followed by an eight-count indictment on 28 May — identifying HAYI as a component of Kata'ib Hezballah, an Iran-backed Iraqi paramilitary group, and naming an Iraqi-Iranian dual national, Mohammad Baqer Saad Dawood al-Saadi, as the senior operative who coordinated the European attacks on behalf of Kata'ib Hezballah and the IRGC.
The DOJ filing and the Metropolitan Police both describe the same operational model: HAYI did not operate as a conventional terrorist cell, but as a media-and-coordination front through which Kata'ib Hezballah and the IRGC outsourced the operational execution of attacks to local criminal recruits, paid in cash, with no prior ideological allegiance. Al-Saadi is described in the DOJ press release as having "FaceTimed with people as they carried out some of the attacks" and as having filmed those attacks for the production of HAYI propaganda videos. Of the British nationals charged in the UK, none had prior public association with Iran, with terrorist organisations, or with antisemitism.
Despite the clear and present danger these networks pose to UK national security, the British Government has stopped short of formally designating the IRGC as a terrorist organisation. While domestic pressure from lawmakers and security analysts to enforce a total ban is at an all-time high, Whitehall's hesitation remains rooted in geopolitical caution. The primary roadblock is the fear of total diplomatic retaliation, which would likely result in the expulsion of British diplomats from Tehran and the severing of critical backchannels used for hostage negotiations and regional de-escalation. Yet, as the domestic risks of IRGC-led operations and sanctions evasion grow unmanageable, this diplomatic caution increasingly looks like a strategic vulnerability.
Recent Outcomes
Our findings point to a structural problem that no single agency, statute or jurisdiction can resolve in isolation. The success of the IRGC's financial footprint in Britain rests on three interconnected factors: a corporate registration system that, until very recently, operated without identity verification; a cryptocurrency sector whose regulatory architecture has not kept pace with its use by sanctioned state actors; and an enforcement environment in which financial intelligence, counter-terrorism policing and sanctions implementation operate in parallel rather than collaboratively.
In the wake of our report, the UK Government has moved to designate the IRGC under the newly enacted National Security (State Threats) Act 2026 - criminalising support for the group without formally proscribing it as a terrorist organisation.
Hoptrail is a UK-based blockchain intelligence firm specialising in crypto source-of-wealth and risk intelligence. Our proprietary platform draws on a dataset of more than 400 million tagged wallet addresses, combining on-chain transaction tracing with off-chain attribution to map fund flows tied to entities and events across the ecosystem, including assets linked to financial crime and sanctions evasion. To speak to us about any of the analysis in this report, get in touch.