Share via:
- Updated on: November 7, 2026
From the pavement, Million Exchange looked like any of the currency counters in Toronto’s northern suburbs where Iranian diaspora shops cluster. It had a branch in Toronto and another in Richmond Hill, rate boards quoting the rial, and a FINTRAC registration going back to September 2019. On November 6th America’s Treasury said it was something else. As part of Operation Economic Outcast, OFAC designated eight Canadian money services businesses that it says enable the Iranian regime, sanctioned entities associated with it, and other illicit actors that move assets into and out of Iran. Million Exchange, legally Diverse Trade Inc, was first on the list.
Treasury’s charge sheet has two parts that look unrelated. Wallets tied to Million Exchange sent hundreds of thousands of dollars to addresses linked to the Revolutionary Guards or to terrorism. The firm also laundered drug money by using street cash to buy cryptocurrency that was sent back to the dealers. One of those dealers was Ryan Wedding, a former Olympic snowboarder turned trafficker who used exchange businesses around Vancouver and Toronto to launder billions of dollars. His couriers delivered bulk cash to firms that converted it into digital assets for transfer abroad. These are not two separate scandals. They are one business model, and it works because each customer solves the other’s problem.
Two problems, one solution
Start with the gangster. Selling cocaine in Canada produces a lot of banknotes in Canadian cities. The goods come from elsewhere: cocaine from South America, precursor chemicals from suppliers in East Asia. Those suppliers want paying in something portable, and increasingly that means dollar-pegged stablecoins, which cross borders in seconds for pennies. Depositing suitcases of twenties in a Canadian bank invites questions. Carrying them across borders invites customs officers.
Now consider the Iranian. Sanctions have cut Iran off from correspondent banking. A family in Tehran, a businessman moving capital out, or an official with relatives in Canada cannot simply wire money to Toronto. What Iran does have is a deep crypto market, where rials become stablecoins on domestic exchanges such as Nobitex and Wallex. What these customers need at the other end is hard currency in Canada. Crystal has followed that pipeline to its conclusion: it has identified Nobitex-linked individuals buying high-value Canadian property for cash, the end state in which Iranian assets become Western real estate.
The exchange desk is the matchmaker. The Iranian sends stablecoins to the desk’s wallet and collects Canadian dollars over the counter. The cash he collects is the trafficker’s cash, dropped off by a courier. The desk then forwards the Iranian’s cryptocurrency to wherever the trafficker’s suppliers want to be paid. The banknotes never leave Toronto, and the crypto never touches a Canadian bank. Each leg looks like a domestic transaction. A desk serving only gangs would drown in cash; one serving only Iranians would run out of it. Put the two together and the books balance.
What the ledger shows
If that model is right, the blockchain should show a lopsided pattern. Cryptocurrency should arrive from Iranian and sanctioned sources and leave towards the places where criminal suppliers get paid. Crystal’s data suggest that is roughly what happened.
Crystal’s analysis first put a number on Million Exchange a year ago. The Toronto Star, drawing on Crystal’s data, reported that over more than a year at least $120m in crypto had moved through a single wallet used by one Toronto-area crypto shop. Publicity did not slow it down. In the four months after the Star’s story ran in November 2025, the wallet took in a further $48m across 761 incoming transfers. Then came January 2026, its busiest month on record, with $19.4m received. Over the full 14 months from January 2025 to February 2026, it received $120.7m in stablecoins and sent out $121.8m. The near-perfect balance is the signature of a pass-through business.
Then there is the size of the tickets. Throughout 2025 the average incoming transfer to a two-branch suburban currency counter ran between $33,000 and $55,000. After the Star’s story it grew rather than shrank, averaging $68,000 in November and $70,500 in January. Outgoing transfers were bigger still, peaking at an average of $88,000 in November. A high-street bureau de change serving tourists and students handles hundreds of dollars a time. This one was moving the price of a house every few days.
The direction of travel is where it gets interesting. Crystal’s exposure analysis follows funds across several hops over the firm’s on-chain history.
Shelbit: about $74m reached Million Exchange from this exchange, which OFAC sanctioned in August and says has moved millions of dollars on behalf of the IRGC.
IRGC-linked seizures: about $50m came from wallets named in an Israeli counter-terrorist-financing seizure order reported to target IRGC funds.
Other designated parties: around $100m came from wallets attributed to other OFAC-designated parties.
An Iranian intelligence hacker: a further $14m or so is traced to addresses of Keyvan Fayyaz Ghareh Blagh. In August OFAC designated a cyber-espionage group inside Iran’s Ministry of Intelligence and Security and blocked wallets belonging to Blagh, among others. Treasury said the group was behind extensive compromises of American critical infrastructure and financially motivated cyber theft.
Across those four sources, roughly $239m flowed towards Million Exchange and less than $14m flowed back, a ratio of about 17 to 1.
On the outbound side the pattern flips. Almost $107m of the desk’s funds ended up at a major regional exchange in Latin America, against just $2.6m coming back. Much of the rest flowed towards major international exchanges with large East Asian user bases; one received $119m and sent back less than half that. More than half of the desk’s outgoing cryptocurrency, about $68m, went to just five wallets used in succession, each for a few weeks or months. That is the behaviour of a single large counterparty rotating its addresses, and Crystal’s risk models flag every one of them for heavy sanctions exposure.
The rush and the silence
The surge coincided with turmoil in Iran. During January’s internet blackout, Nobitex handled 77% of all Iranian exchange outflows, and $21m in stablecoins then moved through Farsi-speaking cash desks in Canada. It was also the month Wedding was caught: he was apprehended in January 2026, having worked with several of the designated businesses to move millions of dollars in digital assets. In February Million Exchange’s main wallet handled just $1.4m. After mid-February it effectively went dark.
The paperwork lagged behind. Diverse Trade’s FINTRAC registration covered currency exchange rather than virtual-currency dealing. It was due to expire on November 5th 2026, the day before Washington acted.
The risk does not stop at the shop door
The danger of a business like Million Exchange is not confined to its two counters. It sits at the junction of two systems that are meant to be policed, and it has a foot in each.
The first is the banking system. A registered money services business dealing in foreign exchange will usually hold bank accounts. These let it deposit takings and wire funds, and it may also have relationships with wholesale banknote suppliers. To its bank, a currency counter making large cash deposits looks like a currency counter doing business. That is what makes the model dangerous: trafficking proceeds can enter the financial system dressed as foreign-exchange turnover. Onward transfers can then be passed off as payments for currency or goods. A bank that sees only the shop’s account sees none of the Iranian customers or the couriers behind it.
The second is the crypto industry’s own infrastructure. Between January 2025 and February 2026, Million Exchange’s main wallet received funds directly from four major international exchanges, one of which has itself faced enforcement action. Its money also moved within a hop or two of several of the world’s largest platforms. This is typical. Crystal’s research finds that 97% of the value of exposure from cash-for-crypto services runs towards international exchanges, and many of these desks operate as nested services that let their clients bypass KYC. An exchange onboarding such a desk as a customer sees a licensed Canadian business, not the sanctioned wallets and drug money on either side of it.
Both doors now carry a sharper penalty. In August OFAC for the first time designated digital assets as a sector of the Iranian economy subject to secondary sanctions under Executive Order 13902. That is the authority used against the Canadian firms. Treasury warns that financial institutions and others risk sanctions exposure by engaging in certain transactions or activities with designated persons. Banks that kept the accounts open and exchanges that kept processing the flows will now be asking what else they missed.
A crowded market
Million Exchange did not operate in a vacuum. Treasury says Canada hosts hundreds of money services businesses that move funds into and out of Iran, through cash-based value-transfer systems and by converting cash into digital assets. The ICIJ’s Coin Laundry investigation and the Toronto Star mapped much of this terrain first. The Star identified a single thoroughfare in the greater Toronto area with 50 businesses advertising crypto services, most of which appeared to be operating unlawfully. It also found that two such operations had used wallets allegedly linked to Iran-backed terror groups. Canada’s anti-money-laundering authorities then revoked the registrations of nearly three dozen crypto businesses.
Data from BestChange, a rate aggregator for online exchangers, show a second, less visible layer. It lists 64 providers advertising cash services in Toronto, 56 in Vancouver, 54 in Montreal and more than 50 in Calgary. These are not local shops. 54 of Vancouver’s 56 providers also list Toronto, and 53 of Montreal’s 54 do too. Most are Russian-language online brands that claim nationwide coverage and settle cash through local agents. This is the model the ICIJ tested when a Star reporter sent 2,000 crypto tokens to a global crypto-to-cash platform in exchange for cash in Toronto. None of the eight firms designated on Friday appears among them. The Farsi storefronts work offline, behind a counter, which is why aggregator data and on-chain labels alike tend to miss them. Crystal’s research team has identified hundreds of such cash-for-crypto services worldwide, from Vancouver’s commercial districts to Hong Kong’s financial centres.
Why this is hard to stop
The designated firms tell the same story as Million Exchange. Amin Exchange allegedly laundered millions of dollars of drug proceeds in Toronto, Vancouver and Montreal, including for Wedding, while receiving hundreds of thousands of dollars from Shelbit. Farah Exchange traded with Shelbit and Wallex and sent millions in digital assets to addresses associated with Wedding. The same shops serve both clienteles because the two clienteles need each other.
That makes the model resilient. Shut the banks and the cash moves over the counter. Freeze a wallet and the next one is already funded. Several of the designated firms have changed names and addresses to evade detection, and all remained operational despite media warnings. Friday’s action was coordinated with FinCEN, FINTRAC and the Drug Enforcement Administration, a recognition that the drugs desk and the sanctions desk are chasing the same people.
The lesson for regulators, banks and exchanges alike is that the risk lies in the matching, not in either flow on its own. A currency counter that takes in Iranian-linked crypto is a sanctions problem. One that takes in duffel bags of cash is a laundering problem. One that does both is a clearing house, netting the debts of cartels and a pariah state against each other in a strip mall north of Toronto. Its bank and its exchange accounts are the doors through which the netted money leaves. Until someone reads both sides of the ledger together, the books will keep balancing.
Cash desks like this one sit inside your customers’ flows. Speak with Crystal’s investigators about reading both sides of the ledger before the next designation does it for you.
