OFAC Sanctioned the Software, Not Just the Exchange

I read sanctions lists the way other people read weather reports — for the pattern, not the names. They are, almost without exception, lists of people and shells and banks. Occasionally a wallet address, buried like a footnote. So when I scrolled to the bottom of this month's Office of Foreign Assets Control designation and found a software company — not a person, not a bank, a firm that writes trading software — I stopped scrolling. The most consequential crypto enforcement action of the year did not freeze a single token. It did something quieter and far more permanent. It named the people who build the pipes. Between June and July, according to Treasury, an exchange called BitBank moved tens of millions to hundreds of millions of dollars in Bitcoin on behalf of an Iranian network tied to the Islamic Revolutionary Guard Corps. That is the loud number, and it will dominate the headlines. But the smaller, stranger line item is the one every founder in this industry should sit with: Pishtaz Simorgh Electronic Trade Company, the developer that built BitBank's platform, now sits on the same list as the exchange it wrote code for. That is new. That is the whole story. Let me fix the facts before the interpretation, because precision beats outrage every time. OFAC designated BitBank, a digital asset business, as part of a broader campaign against Iranian-linked financial infrastructure. The action ties it to Babak Zanjani, a financier who has lived under sanctions for years, and to a cluster of associated individuals designated in the same wave. The network's function is specific and unromantic: it helps sanctioned actors move value outside the traditional banking system. In this case, the Bitcoin ultimately flowed toward the IRGC, the military body that has been the target of overlapping financial restrictions for a decade. The scale is not trivial. Treasury attributes the June–July transfers to a range of tens to hundreds of millions of dollars in Bitcoin. I have moved size in my own life, and I can tell you what that number implies without ever seeing the order book: liquidity depth, a bench of counterparties, and operational discipline. That is not retail noise. That is settlement-grade flow, the kind a platform does not stumble into by accident. One distinction most coverage will flatten, and I refuse to: a sanctions designation is not a criminal conviction. OFAC acts on administrative authority — reasonable suspicion is enough, and the threshold is deliberately lower than a courtroom's. I raise this not to defend anyone in the Zanjani network but because confusing an administrative freeze with a legal verdict is exactly the analytical sloppiness that gets compliance desks dragged into litigation. Silence is the loudest audit, and the black box here is as much legal as it is technical. Now the mechanics. This is where the story actually lives, and it is not the headline. Every sanctions-evasion network reduces to a chain of conversions, and each conversion is a choke point. Fiat enters, gets converted to an asset that travels permissionlessly, and exits to a recipient who can spend it. Banks are the first choke point, and banks were closed years ago for this network. When the banking door shuts, crypto is not a preference — it is the last door. The game-theoretic choice then becomes which asset. Not the most private one. The most liquid one. A sanctioned actor needs to move size quickly, and size moves where the order books are deep. That means Bitcoin, which is the opposite of private and the epitome of liquid. Privacy is worth nothing if you cannot fill the trade. The second invariant is that the public ledger is the enforcement surface. Every one of those transfers left a permanent, timestamped, cryptographically verifiable record. OFAC did not need a subpoena to a foreign bank branch; it needed a graph. This is the quiet irony the industry rarely says aloud: the traceability we market as transparency is, from a sanctions perspective, targeting data. Cash is anonymous. Bitcoin, used naively, is a confession. I learned the institutional version of this lesson the hard way. In late 2017, during the ICO frenzy, I audited the Solidity for a privacy token called Project Aether. My MS in blockchain engineering and my confidence both told me the treasury contract was clean. It was not. I missed a reentrancy vulnerability, the exploit drained $1.2 million in ETH weeks later, and the project died. The numbers didn't lie, but my trust did. What that failure taught me is the same thing this BitBank case teaches at institutional scale: a system can be perfectly functional and still be a weapon. Function is not integrity. Code is not truth. Here is why the developer designation matters more than the exchange itself. Treasury did not stop at a wallet, or at a handful of addresses. It reached into the company that wrote the software. That collapses the convenient fiction that infrastructure is neutral. If you build the rails for a sanctioned network, if you maintain its platform and keep its pipes clean, then legally you are not adjacent to the network — you are the network. The line between "tooling" and "participation" just got very thin, and it is now drawn by an analyst with a graph rather than a prosecutor with a courtroom. The capability behind that graph is itself an industry. The piece notes what anyone who has worked in compliance already knows: crypto has spent years building blockchain analytics and wallet-screening systems. Those tools are the reason OFAC could quantify the flow and attribute it to a military body. The enforcement capability and the compliance industry are the same substrate, two sides of one coin. Every sanctions wave lifts the vendors who sell visibility, and this one lifted them again. We trade in shadows to find the light — and the people selling the flashlight are the ones who framed the rules. There is a subtler shift underneath all of this, and it is the framing, not the fine. Treasury's posture is now explicit: a crypto exchange is treated as a bank, and a developer is treated as a vendor with bank-like obligations. Once you accept that equivalence, compliance stops being a brand differentiator and becomes a floor. The compliance gap between a Coinbase and a shadow venue was once a marketing slide. It is now a survival line. And a floor is a strange thing — it does not reward the compliant so much as it executes the non-compliant. This is where I part company with the consensus reading, which is that this is a clean win for enforcement. I read it as a warning with two edges, and the first edge cuts inward. The same tooling that caught BitBank's developer is a template that can be pointed at any software team in any jurisdiction. The precedent is not "sanctions caught bad actors." The precedent is "writing infrastructure can be the crime." That is a far broader perimeter than most builders have priced in, and it extends, logically and inevitably, from centralized exchanges toward decentralized applications and protocol contributors. OFAC has not drawn that line yet. But it has now shown it is willing to, and the cost of being wrong about where the line sits is no longer a fine. It is a designation. The second edge is that the networks are not naive. A centralized exchange is a single point of failure, and BitBank just demonstrated it in real time. The rational response of the next iteration is migration — toward privacy assets, toward mixers, toward settlement architectures that have no developer to designate and no executive to freeze. The strike that decapitated BitBank may accelerate precisely the design that is hardest to police. The enforcer wins the battle and loses the terrain. Art burns hot; patience burns colder. Flows change, but the current remains. That is the pattern I keep coming back to, and it is why I do not treat this as a crypto-specific event. It is a reclassification event. An entire category of software just got redefined as financial infrastructure, with all the reporting, screening, and liability that word carries. Watch three things from here. Watch whether sanction screening expands into retrospective, historical exposure — because compliance is about to become recursive, and every leg of every historic settlement becomes re-examined. Watch whether the developer designation hardens into a template applied to protocol contributors, which is the line that genuinely matters for this industry's future. And watch whether the next BitBank-like network abandons Bitcoin's liquidity for privacy rails, because that single choice tells you whether enforcement is winning or merely forcing the game deeper into the dark. I see the pattern before the price does, and this pattern has nothing to do with price. I built a liquidity pool once and lost my liquidity, and the lesson there was the same one echoing here: the value was never in the asset. It was in the pipes, and in who is allowed to hold them. This week, a software company was told it could not. That is the headline no one will print — and the one worth remembering.