Toronto crypto dealings allegedly linked to Iran groups

Over the last year and a half, more than $200 million worth of digital currencies has moved through a virtual wallet used by Million Exchange.

In two of those transactions last year, the wallet received more than $588,000 worth of crypto from an account allegedly tied to Iran’s Islamic Revolutionary Guard Corps (IRGC), which Canada has designated as a terrorist organization.

Along Yonge Street, from North York up into Richmond Hill, more than 30 other unauthorized crypto shops have been openly clamouring for crypto customers and blatantly flouting Canadian laws, the Star has found.

Money services have proliferated in Persian community hubs on Yonge since the Canadian government’s prohibitions and banking policies targeting the Iranian regime made direct money transfers to that country nearly impossible. With few other options, members of Toronto’s Iranian diaspora have turned to currency exchanges, money transfer shops and, more recently, crypto exchanges to send money to loved ones back home.

But community advocates have long raised concerns that bad actors may exploit some of the businesses to evade the Canadian government’s sanctions.

As part of an ongoing investigation, the International Consortium of Investigative Journalists (ICIJ) and the Star obtained crypto wallet addresses used by Million Exchange and another Yonge Street exchange from Crystal Intelligence, a firm that offers tools to track suspicious crypto transactions.

Tracing the movement of cryptocurrency is tough without obtaining a crypto wallet address — the equivalent of a bank account number — used by an exchange to conduct its business. The addresses allowed the Star to review transaction records captured on the blockchain, which is a public ledger of crypto transactions.

A spokesperson for Million Exchange told the Star that, for safety and security reasons, the company does not own any wallets, and that the wallet in question is controlled by another company that helps Million Exchange settle payments. Million Exchange said it follows Canadian regulations, but did not answer detailed questions about the transactions reviewed by the Star.

The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) said it is aware of the issues raised by the Star/ICIJ investigation and “has taken, and will continue to take, aggressive action to combat illicit cryptocurrency activity.”

Over the past three years, FINTRAC has issued a total of nearly $205 million in penalties to 17 money services businesses for failing to register, providing incomplete or inaccurate information, and failing to report suspicious transactions, among other violations, a spokesperson said. FINTRAC did not address questions about specific businesses alleged to be violating the law.

Registration formally brings a business under FINTRAC’s rules and oversight, though it does not indicate that the regulator endorses the business.

In its effort to regulate unruly virtual currencies, FINTRAC requires registrants to report certain transactions and follow compliance and staff training guidelines. But spokesperson Mélanie Goulette Nadon said FINTRAC does not solely rely on this reporting. It also receives intel from other business sectors, blockchain analytics services and other sources. FINTRAC said it can access a registrant’s crypto wallet addresses and if, warranted, issue monetary penalties.

The eruption of unregistered crypto shops found by the Star amplifies troubling questions already being asked about the Canadian government’s oversight of this growing sector.

Toronto lawyer Kaveh Shahrooz, who advocates for human rights in Iran, says he has repeatedly raised concerns with Canadian lawmakers that people connected to the Iranian regime may be using Toronto businesses to bring illicit funds into Canada, in violation of sanctions.

“What you’re describing is very easy to shut down or very easy to investigate, but as far as I know no one’s doing it.”

Richard Sanders, an expert in crypto-to-cash businesses, said he gave FINTRAC data on unauthorized crypto businesses he believed were operating in Canada and wonders why the agency has not already taken action against them. For a country in the Five Eyes international intelligence alliance, “This is absolutely preposterous,” he said.

In late February, the United States and Israel launched an offensive against Iran, a conflict that has since rippled across the Middle East. It’s the latest culmination of decades of animosity between Iran and adversaries.

Iran has been ruled as a clerical theocracy since the 1979 Islamic Revolution that deposed the country’s Western-allied monarch. It has for years funded terrorist groups in the Middle East, including Hezbollah and the Houthis. The country’s alleged buildup of its nuclear program has also unsettled western powers.

International sanctions imposed in 2006 following a landmark U.N. resolution set the stage for the emergence of currency exchanges and money transfer businesses serving the Persian community in the Greater Toronto Area.

Canada imposed its own sanctions starting in 2010, aimed at cutting off the money Iran needed to access uranium and ballistic missile technology. The prohibitions meant major Canadian banks effectively ceased processing direct wires or payments to or from Iran.

Just a few years later, Canadian authorities learned of troubling allegations that sanctions evasion was well underway.

In October 2014, the U.S. Drug Enforcement Administration (DEA) informed the RCMP that foreign currency exchanges in north Toronto strip malls were part of an alleged transnational money laundering and narco-terror network, according to reporting by Global News.

The RCMP then probed at least two exchanges and their owners for allegedly laundering money and helping the Iranian regime skirt sanctions via their storefronts on Yonge Street.

Farzam Mehdizadeh, owner of one of the exchanges, left Canada for Iran in 2017 and did not return to face trial for his alleged involvement in a $100-million money laundering scheme linked to international organized crime and terrorism financing. He remains wanted and his whereabouts is unknown, the RCMP said.

The Mounties’ probe into another Yonge Street exchange, Rosco Trading International, did not result in any charges from Canadian authorities. But Rosco’s president, vice president and an employee were charged in the U.S. in 2020 with allegedly running a scheme to evade American sanctions. The prosecution alleged Rosco was part of an international network that facilitated transactions on behalf of the Iran regime for well over a decade. Rosco has been closed since 2021.

A lawyer representing Rosco denied the accusations, saying the charges have been a “dormant matter” since 2021. “They are unprosecuted and unproven,” Gavin Tighe told the Star. He said that neither his clients nor the company were accused of any wrongdoing by Canadian authorities.

When asked about unauthorized crypto stores in Toronto, the RCMP said it is working with domestic and international partners to monitor threats in the crypto-to-cash sector but declined to comment on “potential or ongoing investigations.”

Experts say the exchanges previously investigated by police revealed a problem that Canadian authorities have struggled to contain.

Now, they say, the challenge has only grown more complex with the emergence of crypto, which allows sanctioned regimes and criminal networks to bypass the traditional financial system to move illicit funds across the borders with anonymity and near-instant speed.

The Iranian regime has increasingly turned to digital tokens to evade international sanctions and sent crypto to fund proxy wars across the Middle East, according to blockchain research firms.

Even $10,000 slipping through can cause serious harm, said Jessica Davis, an expert in illicit financing. “Terrorist attacks don’t cost a lot of money.”

Under Canada’s anti-money laundering rules, crypto exchanges and other money services businesses must declare the services they provide, as different businesses may operate under different rules. Companies are required to report large and suspicious transactions to FINTRAC, which can review them and forward information to police.

Under a special federal directive issued in 2020, they must also report every financial transaction to and from Iran and treat them as high risk, regardless of the amount.

Million Exchange is registered with FINTRAC but not to deal in cryptocurrencies. Even so, its Instagram page is splashed with crypto logos and posts advertising the service.

The exchange service said it notified FINTRAC when it began offering virtual currency-related activities.

“The fact that the public FINTRAC registry may not reflect the most recent or complete scope of our activities is outside of our control,” Million Exchange told the Star. “We have fulfilled our regulatory obligations by properly notifying FINTRAC.”

Money services businesses can only start dealing in virtual currency after their registration is approved by FINTRAC, the regulator said.

Using blockchain analysis software from Amsterdam-based firm Crystal Intelligence, the Star tracked crypto that moved, via two transactions in February 2025, into the Million Exchange-associated wallet from an account with alleged links to terrorist financing.

Israel’s National Bureau for Counter Terror Financing seized that account in September, saying the wallet was connected to the Islamic Revolutionary Guard Corps.

Before the seizure, the wallet had received the equivalent of nearly $8 million in October and November 2024 from another wallet address that the U.S. alleged was owned by Sa’id Ahmad Muhammad Al-Jamal, financier of the Houthis, an Iran-backed armed group operating in Yemen. In December 2024, the U.S. government sanctioned the wallet allegedly tied to Al-Jamal.

Al-Jamal is alleged to lead a smuggling network that sells Iranian petroleum and other commodities, channelling tens of millions of dollars through multiple countries to reach the Houthis, the U.S. Department of the Treasury said in 2021. The department also alleged Al-Jamal worked in co-operation with senior officials in Iran’s IRGC.

Also known as Ansar Allah, the Houthis are listed as a terrorist entity by Canada.

Million Exchange said it doesn’t own or control the wallet used by its business, which it said was a “common address used throughout the UAE,” or the United Arab Emirates.

“The wallet address referenced in your inquiry was, at the time, associated with a Dubai-based financial company that was settling funds with us via wire transfer to Canada, for which we were required to send an equivalent value in cryptocurrency,” Million Exchange said, though the business did not provide additional details about the Dubai firm.

Million Exchange also said it does not own any crypto wallets for security reasons.

FINTRAC would not say whether it was aware of the wallet address used by Million Exchange and the transactions found by the Star.

Experts say the Star’s findings raise questions about the Canadian authorities’ ability to adequately enforce anti-money laundering and terrorism financing laws.

“I don’t think they realize the scale of what they’re looking at,” said Nick Smart of Crystal Intelligence, whose blockchain analysis software helps law enforcement and regulators investigating illicit activity. “They haven’t understood how many of these services exist within Canada.”

Just steps away from Million Exchange, a sign on another shop window openly advertises virtual currency services. That business, Crypto King, is not registered with FINTRAC and did not respond to questions from the Star.

In Toronto’s Little Iran neighbourhood — another cluster of crypto services identified by the Star — Darvish Exchange appears to have traded more than $3 million worth of crypto from 2024 to 2025, using a wallet identified by Crystal as being controlled by the business. The exchange was not registered with FINTRAC at the time.

During the same period, the wallet received more than $10,000 worth of crypto that flowed indirectly from wallets later alleged by Israeli officials to be connected to the Iranian regime.

Two weeks after the Star reached out to Darvish and FINTRAC with questions, the regulator added the exchange to its registry, authorizing it to deal in crypto.

Darvish Exchange did not respond to the Star’s questions.

With files from Spencer Woodman (ICIJ)