Background Context

Explosive Media (Akhbar Enfejari in Persian) is an Islamic Regime media outlet that launched on Telegram in June 2025, during the 12-day war. For nine months the channel posted in Persian to a domestic audience and averaged 77 to 133 views per post. On February 17, 2026, eleven days before the U.S.–Israel strikes on the IRGC, Explosive Media started creating and distributing AI Lego videos in english deliberately targeting Western audiences. By April, it had tens of millions of views, coverage from multiple mainstream media outlets to include the BBC, PBS, and celebrity reposts on social media.

Why this matters

The videos and short clips skyrocketed on TikTok, Instagram, and X over the last few months, a Lego Trump in a courtroom, a Lego crowd holding “NO KING” and “NO WAR WITH IRAN” signs while implementing a Macklemore voice over, a Lego Netanyahu next to a missile. Multiple celebrities have amplified them, including DL Hughley, who reposted one to his audience, and Julian Casablancas of The Strokes, who went so far as to praise the Islamic Regime’s messaging from the Coachella stage.

The videos are Islamic Regime propaganda, and most viewers did not know that.

Existing detection at Meta, TikTok, and X is built for Russian-style troll farms running fake American personas and fake American text. Explosive Media is something else; it is openly Iranian, but the packaging is American rap soundtracks, Epstein references, forever-wars framing Trump as a cartoon villain being controlled by Israel. The format obscures the source by making it sound like a familiar domestic talking point.

Why Lego

The on-camera host, told the BBC he picked Lego because it is “a universal language.” The format does four things conventional propaganda doesn’t:

1. It bypasses the foreign-state filter. A children’s toy does not read as state media.

2. It defeats automated moderation. No platform classifier is trained on AI Lego as coordinated foreign influence.

3. It lowers the social cost of sharing. Reposting RT makes a user look bad; reposting a Lego cartoon does not.

4. It plays perfectly on every short-form platform without modification.

This method is called narrative gamification: the content does not have to convince anyone to believe in their way of life…that is not the purpose, it just has to be funny and understood enough to share. The audience handles distribution.

Why would a Foreign State Make This?

The objective is polarization, not conversion to their beliefs as an Islamic Republic or Shia Islam. The operation targets American divisions that already exist and produces content that deepens them.

The fault lines are picked deliberately. Epstein and elite corruption play on the populist left and the populist right; forever-wars framing plays on the antiwar left and the America Isolationist right. The IRGC did not invent any of these divisions; it mapped them and supplied content tuned to each one. Every video pushes the same regime narratives.

The reach is laundered through American voices. Posts from outside the country get flagged by some social media platforms, which quietly limits how many people see them domestically. When a trusted local account (a celebrity or Western influencer) reposts the same thing, the flag doesn’t follow. It spreads like any normal post. The audience reads the content as something an American shared, and the amplifier’s credibility transfers to the message. Hughley and Casablancas did that work for the operation.

This investigation, led by The Third Lantern, identifies the team behind Explosive Media, maps the institutional pipeline that produced them, and traces the operation’s funding.

Step 1: Monitor what is Publicly Shown

The first move was the most basic; read what the operators had voluntarily exposed.

The X/Twitter bio carried a Linktree. That Linktree listed the official platforms: TikTok at explosivemedia.tiktok, the main Telegram channel at ExplosiveMedia, Facebook, plus SoundCloud, Rumble, and Threads. Standard self-promotion.

The ExplosiveMedia main Telegram channel listed a Telegram admin handle, EXPLOSIVEAdmin, not advertised on the main channel anywhere else. Its description linked back to ExplosiveMedia. The account has been continuously active on every check, last verified May 5, 2026.

A personal admin account separate from the managed public-facing channel was, for attribution purposes, it was more helpful than the public channel. It became the next target.

A username enumeration tool (Sherlock) was then run across the full set of known and suspected handles: ExplosiveMediaa, Akhbarenfejari, mrexplosive, mahdihemmat, EXPLOSIVEAdmin, mianjism2, IMLC_admin, imlc_ir. (Note: shortly after the initial investigation, on April 19, 2026, Explosive Media also created a Facebook account at ExplosiveMediaa.)

Step 2: Run the admin handle through breach data

@EXPLOSIVEAdmin was queried through HudsonRock’s Cavalier API. Cavalier checks handles against info-stealer malware compromise databases, a legitimate OSINT source that surfaces, where active, the IP, OS, and compromised service list tied to a username at the time of infection.

The query returned a match. The handle had been compromised by a Lumma info-stealer in January 2024. The infected machine ran Windows 10 x64. Twenty-six user services had been logged. Two email addresses were partially visible, both starting with the letter “a.” The exit IP 37.40.xx.xxx pointed to Omantel/OmanMobile, a routing pattern consistent with Iranian VPN exit traffic.

What the date shows is that January 2024 places this individual inside the operation’s infrastructure more than 2 years before Explosive Media became publicly visible. The 26 compromised services suggest a digital footprint considerably larger than the public surface.

Important note: IRGC operators frequently operate out of Muscat. It’s one of the locations they use for smuggling and sanction evasion/circumvention, this is why the routing isn’t random.

Step 3: Find a face

Scrolling the main Telegram channel back to its first post in June 2025 showed a consistent male presenter from the pilot video. A screenshot of his face was run through standard reverse image search tools, which returned nothing. Then FaceCheck.ID returned a result: an identical face attached to an Instagram platform indicator. No payment was made; the free result was used only as a directional signal that an Instagram presence existed, that’s all that was needed.

Explosive Media’s Instagram had its following list locked down, so that angle was dead. Next move was scrolling the account’s posts from the start. The first Lego reel had its collaborator tags exposed, and one of those collaborators was using the same picture as the Facecheck.ID for a profile picture.

That account was @ m.taha.ansari.mohseni.

Full name: M. Taha Ansari Mohseni.

His other platforms followed: X/Twitter at AnsariMohseni, personal Telegram at the same handle, with significant post history on X. His on-camera appearances ran from the channel’s first video on Telegram in June 2025 through March 23, 2026 his last confirmed Telegram appearance during the initial investigation.

One notable development since then, as of May 2026, Ansari is now posting videos on his personal Instagram featuring the Explosive Media logo directly. During the April investigation, Ansari’s personal Instagram showed no Explosive Media with his face attached. As of May 2026 it does, but the posts themselves date back to November 2025. He archived them when international coverage of the operation peaked and unarchived his posts likely after he believed it passed.

Step 4: The “Mr. Explosive” question

The spokesperson in the BBC interview does not visually match Ansari, The silhouetted individual has a different facial structure and wears glasses. That mismatch needed to be addressed before continuing; otherwise the rest of the work would rest on the assumption that the face on camera was the man behind the operation.

Two pieces of evidence resolved it:

1. November 29, 2025. A video on the official Explosive Media Telegram channel back when the channel was still pulling 77–133 views per post, shows Ansari, sick in bed, addressing his domestic audience using the full “Mr. Explosive” title for himself. He was not performing for an international audience. He was speaking to a small domestic following.

1. February 28, 2026. A non-studio field report. The caption روایت آقای انفجاری از امروز صبح (”Mr. Enfejari’s account from this morning”) is used while Ansari is on camera. Enfejari in Persian translates to “Explosive”

Both predate the Lego campaign’s international coverage.

The working assessment is that “Mr. Explosive” functions as a shared brand persona used by at least two team members, possibly intentionally, either to add mystique or to deflect attention from Ansari, who is consistently the on-camera face, referring to himself as “Mr. Explosive”. His withdrawal from on-camera activity after March 23, 2026, is assessed as an OPSEC response to the international press cycle.

Step 5: Trace Ansari into the institutional pipeline

With the primary face attributed, his own public Instagram became the next target.

A post from September 2024 carries a geotag at Hozeh Honari Tehran, the Islamic Regime’s Art and Cultural Organization. The occasion was a screening of Heart of Raqqa, which is an Islamic Regime-aligned propaganda film about the Syrian war. Attendence at the Hozeh Honari is one of many pieces of evidence that places the channel’s previous public-facing host inside a confirmed Islamic Regime cultural institution, attending Islamic Regime content, within a year of the channel’s launch.

Further connections from the same Instagram account: ties to the Iranian Media Literacy Club (@imlc_ir), an Islamic Regime media training pipeline. A February 2020 post shows the closing ceremony of the Media Literacy Olympiad, captioned with references to media literacy, IRIB (صدا و سیما), and Basij (بسیج). Adjacent material from the same environment carries Young Journalists Club (yjc.ir) branding, a known IRIB youth media arm.

For context: U.S. Treasury (OFAC JY1109, 2022) explicitly cites IRIB cooperation with the IRGC and MOIS.

What this establishes is a structured pipeline running from youth media training, through IRIB-Basij programs, into media production under state-aligned structures and Ansari’s traceable presence inside it.

Step 6: Find the next person off the collaborator tags

The first Lego video on ExplosiveMedia’s Instagram and had three publicly tagged collaborators: Explosive Media itself, Ansari, and a third account, mianjism2.

mianjism2 carries over 8,000 Instagram followers, a YouTube channel created March 3, 2025, with 56 videos, and a Telegram channel at mianjism with 1,042 subscribers.

The skills listed across its profiles match the operation’s production needs: VFX, motion graphics, AI video production, news, and research.

One of the findings was a former operational identity. A curl request against the Telegram page metadata returned Mediatorstrategy “former Mediatorstrategy.” That previous identity led to a TikTok account created March 30, 2024, nearly abandoned, using an AI-generated face as its profile photo. Identity concealment was built into the account from the start.

What confirmed this was operational coordination, not just amplification, but the timeline:

• February 17, 2026: Mianjism forwards the first Explosive Media Lego video with full production credit.

• March 7, 2026: Mianjism changes its Telegram profile photo from a blue logo to a red circle on the same day Explosive Media launches the coordinated Lego campaign, and six days after Iranian state media confirmed Ayatollah Khamenei’s death in the U.S.–Israel strikes of February 28.

• March 8, 2026: Mianjism forwards official Lego content captioned “Produced by Explosive News team ‘akhbarenfejari.’”

The color context: Within days of Khamenei’s death, the red flag of revenge, a Shia symbol of blood vengeance rooted from Imam Hussein at Karbala, was raised over Jamkaran Mosque in Qom. A profile-photo change from blue to red on the exact day of a coordinated launch, six days after that confirmation, is not treated as a coincidence.

Real identity remains unknown. No confirmed name, no verified face, no breached data. But it is the least significant, the next person of interest is the most important.

Step 7: Verify the third subject through primary sources only (Maziar Rostampour)-Explosive Media’s AI Director

While Google Dorking through Islamic Regime & Persian language sources, I came across Maziar Rostampour’s name; the first source led me to the 16th Ammar Popular Film Festival in the Virtual Space and Artificial Intelligence. Another source mentioned Rostampour faintly alongside Explosive Media with a Telegram link attached. The link didn’t show him right away, or even within a few scrolls, so I almost passed on the lead, but a gut feeling kept me scrolling, and his face turned up at timestamp 12:01. https://t.me/mehrnews/366578

His operational title, with a photo of the Lego Propaganda closed the gap.

A Mehr News Agency Telegram post (t.me/mehrnews/366578) shows a segment from “Its Visual Media” with ON News (ONnewsmedia) branding, and the caption identifies him by name and role: “Maziar Rostampour, the director of artificial intelligence of Explosive News, in an interview with the video media ‘ON.’” Mehr News is a major state-aligned Iranian outlet, that names his operational title attached to state-media validation to the role itself.

From there; the build-up verification work fell into place. Rostampour had submitted a piece called (Women of Lardeh) to the 16th Ammar Popular Film Festival in the Virtual Space and Artificial Intelligence category, documented in Fararu.com article 942367, and he took the Honorary Diploma at the opening ceremony on January 22, 2026 at Cinema Bahman in Tehran, covered by ANA News Agency in article 1027474.

The ceremony photos were pulled and analyzed; EXIF data confirmed Iran Standard Time, Adobe Photoshop processing, and a Telegram file naming convention, and the originals traced back to Defapress.ir, Iran’s official Ministry of Defense news agency. His face was independently matched against a YouTube podcast appearance, the Badeehiat Podcast with Seyed Media, dated to roughly July 2024.

The Ammar Festival is the Regime’s primary soft-war talent hub, so an award there in the AI and virtual space category places Rostampour inside the IRGC cultural production network on its own.

The interview content in the second finding: Translated, the caption reads: “In the feedback of the global audience, people see a freedom-loving country standing up to Epstein’s army of cannibals. Even Iran’s former critics, seeing this powerful resistance to the United States, turn to supporting it. This period is the pride of Iran and Islam; victory in the media war requires narration and breaking the silence.”

He’s implying that the campaign is shifting how Americans think, and crediting himself for it. They’re not hiding what this is. They’re saying it on camera for their domestic audience.

The Epstein references are scripted with intent from the top. Explosive Media leans on the Epstein files heavily in its English-language content, and Rostampour himself uses the same framing in Persian when speaking to Iranians.

Rostampour openly calls his work a “media war” (jang-e resaane’i in Persian). That phrase belongs to information warfare, not creative content production.

His evolution from a winner at the Ammar Film Festival in January to the head of a global viral media machine by March shows a very rapid, state-backed scaling of AI tools.

Step 8: The fourth subject — naming pattern and prior relationship

The same July 2024 podcast that confirmed Rostampour’s face also produced the next subject: his co-host, Seyed Media.

His main Instagram, Seyedmediaa, uses a double-”aa” suffix; the same pattern as ExplosiveMediaa and his own secondary account seyedmediaa2. That pattern across three connected accounts is assessed as possibly deliberate team branding rather than a coincidence. His listed skills: Creative Director, Graphic Design, AI, Content, Branding, Film, match the operation’s production profile. He has independently published Lego content on his personal Instagram and has been tagged in multiple Explosive Media Lego reels.

Full name confirmed as Seyed Mehdi Hashemi. His documented relationship with Rostampour predates the Lego campaign launch by 19 months via his YouTube podcast shown above.

Confidence as a creative collaborator: HIGH.

Step 9: Map the infrastructure

The domain explosivemedia.com was registered April 2, 2022 three years before the operation launched on Telegram and 4 years before their Lego content went viral. It is currently parked for sale on Afternic via GoDaddy, with privacy protection.

The domain was last updated March 5, 2026 aligning with the Lego content pivot.

The operation runs entirely through social platforms, but the contact email akhbarenfejari@gmail.com, pulled from the public channel, became the next target. Epieos confirmed an active Google account at ID 100159470084414622103. What matters is the Google plus Archive entry. Consumer G+ shut down in April 2019, so it is atleast seven years old. That predates the Explosive Media op by years and rules out a campaign-era throwaway. Holehe returned a separate Firefox/Mozilla account on the same email, a second platform tie. Looks like an address someone actually uses, not one made specifically for this op.

Step 10: The sub-account network

The operation does not run on a single channel.

Three additional Instagram accounts carrying the Explosive Media logo as their profile pictures were identified, none of them appearing in the main account’s bio. They were surfaced through tagged reels:

• musicenfejari (Explosive Music): 13 posts, 329 followers. Bio links directly to akhbareenfejari and animationenfejari. Created before the main Explosive Media account.

• akhbareenfejari: carries the logo with a spelling variation from the main handle.

• animationenfejari: a dedicated animation sub-account.

The cross-link that pulled Mianjism into this layer of the network: political cartoon drawings appearing on musicenfejari match drawings located in Mianjism’s Telegram content from February 2026.

That match places Mianjism inside the sub-account ecosystem and confirms the operation was assembled across multiple purpose-built accounts: music, animation, film, news, incrementally, before the main channel gained international attention.

Step 11: Follow the money

The Explosive Media Telegram channel had a public post asking for donations. Two wallet addresses were listed, one for Bitcoin and one for Solana. Both run on public blockchains, which means anyone with an internet connection can see exactly how much money came in, when each donation arrived, and where the money went afterward. No special access required.

Bitcoin address: bc1q4m2vr5zta6cghh9009n7f3g8w206rgt8ycl6zx

Solana address: AdHe8x4nmNYFwv1yaT53byxw7zfpgNrTou3QJsnTCyKH

The Bitcoin wallet

You can look at the Bitcoin wallet yourself by going to https://mempool.space/address/bc1q4m2vr5zta6cghh9009n7f3g8w206rgt8ycl6zx

During the initial investigation of April 15 to April 18, 2026, fourteen separate donations came in, totaling 0.01351097 BTC. At Bitcoin’s price at that time, came out to about $1,041.46. Each individual transaction on the blockchain has its own unique ID, separate from the wallet address. So the links below point to specific transactions, not the wallet itself.

Then on April 17 at 23:01 Pacific Time (April 18 at 06:01 UTC), the operators emptied the entire wallet in a single transaction. In crypto, that kind of “move everything at once” action is called a sweep. You can pull up the actual sweep transaction here: https://mempool.space/tx/004acb972523ff5b20f40f735d48c531e851c1a25c7aed26f0c85b2cfe3dfa4d

The sweep didn’t end the donations. More money kept arriving. So the operators ran the same play again on April 24 at 23:42 Pacific Time (April 25 at 06:42 UTC): https://mempool.space/tx/a123069df47ae430caa5dfc66c851368af057b4a156223b0341b1b81a9423f3a

Then a smaller outbound transaction on April 30 went to a different address. As of May 1, 2026, the wallet had received a lifetime total of 0.02495639 BTC and had about $80 still sitting in it.

Where the money went after the sweeps

Both major sweeps landed at the same destination wallet: 19Z7JGBmV5MRevKZTYyNrv5aKREdnsULFo.

You can pull this wallet up the same way: https://mempool.space/address/19Z7JGBmV5MRevKZTYyNrv5aKREdnsULFo

What you’ll notice is that this wallet has been emptied. Current balance: zero. Lifetime received: 0.02390000 BTC, which is roughly the two sweep amounts minus transaction fees. So the operators didn’t park their money there. The funds passed through this wallet quickly and moved on somewhere else.

Two reasons this pattern fits an Iranian state-aligned operator. First, leaving money in a public donation wallet means leaving it traceable and freezable. Sweeping it out quickly shortens that window. Second, the choice of Huobi isn’t random. Binance, Coinbase, and Kraken actively screen for Iranian users and will close accounts that fail their checks. Huobi has been the more permissive option for sanctioned-state actors over the years, which is why an operator who needs an exchange that will actually let them cash out tends to land there. The repeated sweep cadence also tells you someone is watching the wallet and processing it on a schedule, not just letting donations pile up.

Figuring out who controls that wallet

To figure out who controls a Bitcoin wallet, there’s a free tool called WalletExplorer. It looks at patterns of how addresses spend money together and groups addresses that appear to be controlled by the same entity. If a business uses many wallet addresses internally and they regularly move money between each other, WalletExplorer identifies that whole group as one cluster belonging to one company.

Run the destination wallet through it: https://www.walletexplorer.com/wallet/Huobi.com-2?from_address=19Z7JGBmV5MRevKZTYyNrv5aKREdnsULFo

The page tells you that this wallet is part of a cluster identified as Huobi.com-2. Huobi is one of the largest cryptocurrency exchanges in the world, now rebranded as HTX.

If you look at the sweep transactions on mempool, you’ll see another address that keeps showing up alongside the destination: 1AQLXAB6aXSVbRMjbhSBudLf1kcsbWSEjg

After running that one through WalletExplorer too: https://www.walletexplorer.com/wallet/Huobi.com-2?from_address=1AQLXAB6aXSVbRMjbhSBudLf1kcsbWSEjg

Same answer. Huobi.com-2.

So the Bitcoin trail ends at Huobi. The operators deposited their swept donation funds into a Huobi account.

Why that matters

Cryptocurrency exchanges are required by law in most countries to verify their users real identities before letting them trade or withdraw funds. This is called KYC, short for Know Your Customer. When someone opens an account at Huobi, they have to upload a government ID, sometimes proof of address. The exchange has all of that on file.

So Huobi’s internal records will show exactly which user account got credited with each deposit at 06:01 UTC on April 18 and 06:42 UTC on April 25. The amounts and timestamps are precise enough that compliance can identify the specific user without ambiguity. A law enforcement agency with proper legal authority can request that Huobi produce that identity.

The Solana wallet

The Solana wallet had a different pattern. At the time of the original investigation, it held 4.156 SOL and 29.87 USDC, worth $397.41 total, with no outbound activity. Since then, the operators have moved 2.428 SOL out, including a 1.52 SOL transfer to CoinEx, another major cryptocurrency exchange. CoinEx maintains KYC records on its users the same way Binance and Huobi do, which means whoever the operators are cashing out on the Solana side is also identifiable through documented records. The wallet currently sits at 1.728 SOL and 29.87 USDC, worth roughly $191.

Who sent the donations in

The same public blockchain trail works in the opposite direction. You can look at each individual donation that came in and trace it back to whatever wallet sent it.

Two of the Bitcoin donations came directly out of Binance hot wallets. Hot wallets are the active wallet exchanges used to handle customer transactions throughout the day. The first was $18.89 on April 15 at 02:08 UTC, from a Binance internal cluster called “Binance 4.” The second was $91.21 on April 15 at 09:47 UTC, also from Binance 4.

The Solana wallet had two similar traces, both back to a different Binance cluster called “Binance 2”: roughly $88 and $117, both around April 15.

The significance is the same as the destination side. These four donors didn’t transfer crypto from personal wallets they control. They sent it directly out of active Binance exchange accounts. Binance has their verified identities on file. That gives law enforcement four real names attached to four specific transactions.

One donation that doesn’t fit the pattern

A separate Solana donation came from a wallet identified by the domain 1st.sol. Bonfida is a Solana naming service that lets people register human-readable names like “1st.sol” and point those names at their actual wallet address. Looking up 1st.sol through Bonfida resolves to wallet 65NTkwkbwsf91f56H3ZsGzPTkwrXEeULSgebTDguhmkU.

That wallet holds about $701 worth of various tokens and shows trading activity on Pump.fun and OkxDex, two crypto trading platforms. Nothing in its behavior suggests an Iranian connection. This donor reads as a crypto trader who liked the content and contributed, not someone directly tied to the operation.

Adding it all up

Across the donation period, the operation’s public Bitcoin and Solana wallets brought in roughly $1,641 total.

Following that money produces three different exchange accounts, each one tied to a verified real person. On the way in, four of the donations came directly out of Binance accounts, two in Bitcoin and two in Solana. On the way out, the Bitcoin sweeps both went to a Huobi account, and a separate 1.52 SOL transfer went to a CoinEx account.

Like I previously stated, everyone of those three exchanges is required to verify their users’ identities. So sitting in their compliance records right now are real names attached to four donors, the operator’s Huobi account, and the operator’s CoinEx account. Any law enforcement agency with proper legal authority can request those identities and pursue legal action.

Why the dollar amount is important

A team producing daily AI-generated video content across eight social platforms does not operate on $1,641 in donations. That isn’t enough to cover the AI rendering tools alone, let alone staff time, equipment, software licenses, or any other operating cost.

The donations are too small to be funding the operation. Which means the actual money is coming from somewhere else. The most coherent explanation is state sponsorship. The crypto wallets are functioning as a way to engage supporters and project the appearance of grassroots backing, not as an actual revenue source.

What the Chain of Command looks like

(Working map of what’s been identified so far. Top is documented; lower links are assessed connections. Names listed under Programs & Persons will be detailed in Part 2.)

The operation’s connection to the IRGC-IRIB-Basij is assessed at HIGH CONFIDENCE, supported by independent evidence chains that converge on the same institutional network:

• Ansari’s documented attendance at Hozeh Honari (the Islamic Regime Art and Cultural Organization).

• The Revayat-e Fath watermark identified by Jerusalem Post in Explosive Media content.

• Rostampour’s Ammar Festival award in the AI and virtual-space category.

• Consistent amplification by Islamic Regime-affiliated outlets, including Fars News and IRIB.

Additional research strengthens that institutional framing further.

The Media Literacy Olympiad and its parent body, the Iran Media Literacy Club (imlc.ir), operate under the direct sponsorship of the Shahid Avini Educational Research Complex, located on Vali-Asr Street, Tehran. Shahid Avini is the formal cultural arm of the Basij of IRIB.

The Basij is the IRGC’s domestic paramilitary volunteer force.

The IRIB is Iran’s state broadcaster, the equivalent of state-run television under direct authority of the Supreme Leader.

Additional Olympiad sponsors include the Saraj Cyberspace Organization, a documented organizer of Basij’s cyber activities. Ansari’s traceable presence inside this structure places him inside a recruitment and ideological pipeline running from IRIB’s Basij branch directly upward into the IRGC.

IRIB itself is U.S. Treasury-designated (OFAC JY1109, 2022) for cooperation with both MOIS and the IRGC Intelligence Organization, and is constitutionally subordinate to the Supreme Leader under Article 175. A 2019 Treasury action (SM780) documented a joint IRIB–IRGC budget withdrawal of approximately $4.8 billion from Iran’s National Development Fund, establishing a financial relationship, not only an ideological one.

The Lego format itself is a deliberate operational choice. AI-generated animation bypasses content-moderation thresholds that flag conventional political propaganda, moves faster across platforms, and reaches audiences who would not engage with state media directly.

The donor and destination side produced 3 exchange referral targets, each with KYC records identifying real people. Binance for the four donor transactions. Huobi for the operator account that received both Bitcoin sweeps. CoinEx for the operator account on the Solana side. The $1,641 total in public donations across the operation’s massive digital campaign rules out self-sustaining finance. State sponsorship is the most coherent explanation for daily, high-volume AI content production across multiple platforms at this scale.

~OSINT/WEBINT/CI Investigation conducted by The Third Lantern

Part 2 will detail the Programs & Persons layer of the network map.