In a seven-week stretch last summer, a digital asset exchange that most of the world had never heard of moved tens of millions — by Treasury's own accounting, perhaps hundreds of millions — of dollars' worth of Bitcoin through wallets that, on their surface, belonged to no one in particular.
Then Washington gave them a name.
The morning the Office of Foreign Assets Control published its designation of BitBank, I was reading the announcement the way I read most enforcement actions: not for the headline, but for the grammar. And the grammar was different this time. Treasury was not sanctioning a wallet. It was not flagging a cluster of addresses and moving on. It was designating an operating business, the software company that built its platform, and the network of people who supplied it with capital, counterparties, and cover. I have spent twenty-seven years watching this industry argue over whether it wants a seat at the table of global finance. That morning, the table arrived first.
Context
BitBank is not a household name, and that anonymity is precisely the point. It is described as one node in a network allegedly run by Babak Zanjani, an Iranian financier already sanctioned years ago for his role in evading oil-related restrictions. According to Treasury's account, the exchange facilitated the movement of tens of millions to hundreds of millions of dollars in Bitcoin between June and July, funds ultimately bound for Iran's Islamic Revolutionary Guard Corps. The developer behind the platform — Pishtaz Simorgh Electronic Trade Company — was sanctioned alongside it, as were several individuals in Zanjani's commercial orbit.
On its face, this is the latest in a long line of crypto-related designations. Read more carefully, it is a structural shift. For years, OFAC's crypto enforcement lived at the level of the address: identify a wallet, publish it, forbid Americans from touching it. That model always carried a quiet embarrassment, because an address can be abandoned in seconds and a determined operator can spin up a thousand more before lunch. Enforcement against addresses was enforcement against symptoms.
This designation targets the body, not the symptom. A functioning exchange is a business with employees, banking relationships, liquidity providers, and a codebase someone had to write. Those are not disposable. They are the load-bearing walls of an operation, and Treasury just walked through the front door. It framed the action as part of a broader campaign against Iran-linked financial infrastructure — the same infrastructure that, in friendlier jurisdictions, regulators prefer to describe in the softer language of innovation and market development.
Core
Here is the insight most coverage missed, and the one I keep returning to when I teach compliance workshops: the public ledger did not merely permit this enforcement — it produced the evidence. Cash moves invisibly. Bank wires leave a trail that ends at a border. Bitcoin, for all its reputation as a privacy tool, is a permanent, globally replicated, timestamped record. Every hop BitBank's operators made left a fossil.
I learned the power of this the hard way during my 2017 whitepaper audits. Back then, I could trace a project's treasury flows well enough to catch tokenomics engineered to enrich insiders, and I wrote about four of them in a report that forced two roadmaps to change. What I was really doing was proving a point Treasury has now weaponized at nation-state scale: transparency scales in both directions. The same property that lets a retail user verify a payment lets an analyst reconstruct a sanctions-evasion network.
Reconstructing BitBank required exactly that kind of layered forensics. Because the designation reaches not only the exchange but its developer and multiple associated individuals, we can reasonably infer a multi-tier account structure — funds split across bridges, custodial pools, and intermediary wallets to obscure the terminal destination. OFAC did not identify those flows; it traced them, which means it had to map the network rather than simply spot a name. To do that at the scale of hundreds of millions of dollars, Treasury almost certainly leaned on the commercial blockchain-analytics stack — Chainalysis, Elliptic, and their peers — whose entire product is turning a public ledger into an audit trail.
That is the part of this story the industry underweights. We spend our energy debating consensus mechanisms while the compliance layer quietly becomes the most consequential infrastructure in the market. The sector has spent years building wallet-screening systems and analytics tools, and those tools are now the operating system of enforcement. Transparency is the new currency, and Washington just proved it accepts the tender.
There is a deeper, uncomfortable lesson for the Bitcoin faithful, and I will not soften it. BitBank used Bitcoin as a freight rail — a heavy, slow, public conduit for moving value across borders outside the banking system. That is a strange use for a network designed to let individuals hold and transfer value without permission. It is like using a Rolls-Royce to haul cargo: it insults the machine and it doesn't carry much. The very openness that makes Bitcoin trustworthy is what makes it a poor hiding place, and operators who mistook pseudonymity for anonymity built an entire business on a category error.
Consider, too, what this means for how value is priced. The event moved no major asset, because BitBank was never a price-setting venue. But it did move something subtler: it widened the valuation gap between exchanges that can pass a sanctions screen and those that cannot. Compliance is no longer a line item on a marketing page; it is the precondition for staying connected to global liquidity at all.
Contrarian
Now the part that should unsettle everyone who cheered.
When an exchange is designated, the cheer is easy. But look at what the designation actually does to the compliant side of the industry. Every global exchange, every custodian, every over-the-counter desk now inherits a fresh obligation: screen for BitBank, screen for Pishtaz Simorgh, screen for the individuals, screen their counterparties, and screen the counterparties of their counterparties. A sanction is not a wall; it is a contagion, and it spreads through exactly the compliance plumbing that legitimate firms built to look trustworthy. The systems that keep you safe now require you to do Treasury's work for free, indefinitely.
And consider the developer. Pishtaz Simorgh was sanctioned for building the software. Sit with that, because the open-source community has not. The precedent is that writing code for the wrong client — even code that is neutral on its face — can be a sanctionable act. I have spent my career insisting that ethics must precede innovation. I did not expect the state to enforce that argument on my behalf, and I am not certain I want it to. Between auditing a protocol's ethics and auditing its authors' address books, there is a line, and this designation blurs it.
There is also the blindness of victory. Removing BitBank does not remove the demand that created it. Sanctioned capital finds new rails — privacy coins, decentralized venues, informal brokers — and we may have made the flows less visible rather than less real. Auditing ethics before auditing assets is the right instinct, but it only works if we can still see the assets. One legal caution, offered with the rigor my former students expect: a sanctions designation is an administrative action, not a criminal conviction. Reasonable suspicion is the standard, not proof beyond reasonable doubt. An industry that forgets that distinction will one day be judged by a standard its critics never had to meet.
Takeaway
For a decade, crypto's central argument was that code could replace trust. What the BitBank designation reveals is subtler and more honest: code can make trust auditable. The ledger remembered what the operators wanted forgotten, and a regulator read the record aloud. That is not the death of decentralization — it is the moment the industry's transparency became its most powerful and least controllable export. The question ahead is not whether the ledger will be watched. It is who will be trusted to read it, and whether we build the ethics to deserve that reading before someone else writes the rules for us. Building bridges where code ends and trust begins was always the harder work; humanity, in the end, remains the ultimate protocol.
