Leaked Database Sheds Light on Iranian Crypto Sanctions Evasion

**Executive summary:** Resecurity's analysis of a leaked Ariomex database (2022–2025) reveals 11,826 user records—predominantly from Iran—with transaction activity dominated by Tether and Tron; the dataset shows many small transfers but also large and VIP-linked movements (including requests to exchange $19M and repeated $1M–$5M transfers) that may indicate sanctions evasion and large-scale capital transfers, though 27 potential sanctions matches could not be fully verified due to incomplete national ID data.