Mabna Institute moved $16.8M through crypto addresses since 2018, TRM Labs finds

Iran’s Mabna Institute, the hacking organization accused of stealing intellectual property for the Islamic Revolutionary Guard Corps, has been doing more than breaking into university servers. According to blockchain intelligence firm TRM Labs, roughly 30 crypto addresses tied to Mabna defendants received about $16.8 million in total inflows between January 2018 and August 2026, spanning Bitcoin, Ethereum, and TRON. One person, 92% of the money The most striking data point in the TRM Labs findings is how concentrated the flows were. Defendant Keyvan Fayaz controlled 10 of the scrutinized addresses, and those addresses alone accounted for roughly $15.5 million, or 92% of all inflows across the entire cluster. A second defendant, Behzad Mesri, was associated with layered transactions that ultimately routed toward a centralized exchange deposit. The residual balance sitting across all 30 addresses at the time of analysis was approximately $202,662, meaning nearly all of the $16.8 million had already been moved or spent. Who is the Mabna Institute and why does this matter now Mabna was founded around 2013 in Tehran and spent years operating as what U.S. prosecutors describe as a cyber-...