Audit log

Every state-changing event for Amir Hossein Rad: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-06-16 12:10:24Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 426,849,608

   sig

   2hf881Ks1BUR…wq3Rq28Ccopyexplorer ↗

   hash

   8vVeM68gsBks…sjUyp6Lwcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (16636 B) ▸

   {"actor":"system:backfill","investigation_id":"e8d3f545-e0ed-42f0-8fa0-79ef47f530fc","kind":"publish","page_slug":"amir-hossein-rad","published_at":"2026-06-16T12:10:24.394Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Amir Hossein Rad","sections":[{"content":"On June 2, 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) added Amir Hossein Rad to the Specially Designated Nationals (SDN) list. He was designated under two executive orders: E.O. 13224 (as amended), which covers counterterrorism and material support for terrorism, and E.O. 13902, which covers persons operating in Iran's financial sector. OFAC cited Rad's role as a 'leader or official' of Nobitex as the basis for the E.O. 13224 designation. The action was part of the Trump administration's 'Economic Fury' campaign, described by Treasury as the largest U.S. crypto-specific enforcement action against Iranian exchange infrastructure to date. Rad was designated alongside Nobitex's current CEO Seyed Ali Khoee and co-founders Seyed Mohammad Ali Aghamir and Seyed Mohammad Aghamir, who are identified as members of the Kharrazi family, described as part of Supreme Leader Khamenei's inner circle.","heading":"OFAC Designation","severity":"critical","sources":[{"credibility":1,"name":"Economic Fury Targets Iran's Largest Digital Asset Exchange for Terror Finance and Sanctions Evasion — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0519"},{"credibility":2,"name":"OFAC Sanctions Iran's Four Largest Crypto Exchanges: What Every Compliance Team Needs to Know — Scorechain","type":"news_article","url":"https://www.scorechain.com/blog/ofac-iran-crypto-sanctions-june-2026"},{"credibility":2,"name":"OFAC Targets Nobitex and Other Iranian Crypto Exchanges: Compliance Brief — Global Ledger","type":"research","url":"https://blog.globalledger.io/research-investigations/ofac-nobitex-iranian-crypto-exchanges"}]},{"content":"Amir Hossein Rad is a co-founder of Nobitex and served as its CEO before transitioning to the role of chairman. Nobitex, also registered under the corporate alias 'Rahkar Fanavari Nooyan,' is described by the U.S. Treasury as Iran's largest digital asset exchange, with approximately 11 million users. The platform processed more than 50% of all Iranian digital asset inflows in 2025, representing an estimated $4.7 billion in volume for that year. The four Iranian exchanges designated in the June 2026 action — Nobitex, Wallex, Bitpin, and Ramzinex — collectively accounted for approximately $7.7 billion or 78% of Iran's 2025 crypto volume according to TRM Labs analysis. OFAC specifically cited Rad's role in helping Nobitex reconstitute its operations following a $90 million hack in June 2025, treating that recovery effort as evidence of ongoing material support for a designated entity.","heading":"Role at Nobitex","severity":"critical","sources":[{"credibility":1,"name":"Economic Fury Targets Iran's Largest Digital Asset Exchange — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0519"},{"credibility":2,"name":"Three Enforcement Layers in Five Months: OFAC Designates Iran's Domestic Crypto Exchanges — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"credibility":2,"name":"US Treasury Sanctions Iran's Largest Crypto Exchange Nobitex — Unchained Crypto","type":"news_article","url":"https://unchainedcrypto.com/us-treasury-sanctions-irans-largest-crypto-exchange-nobitex-along-with-three-other-iranian-platforms-under-economic-fury-campaign/"}]},{"content":"The U.S. Treasury alleged that Nobitex, under leadership that included Rad, facilitated multiple categories of illicit financial activity. These include: processing payments linked to the Islamic Revolutionary Guard Corps (IRGC), including wallets associated with IRGC-affiliated ransomware actors; assisting the Central Bank of Iran in acquiring at least $507 million in stablecoins (primarily USDT) to support Iran's flagging currency, the rial; enabling regime insiders to access international crypto exchanges across multiple jurisdictions; and processing an alleged $2.3 billion since 2023 for sanctioned Iranian entities. Elliptic's independent analysis identified Nobitex blockchain activity connected to addresses associated with Hamas, DPRK-affiliated hacking groups, Syrian actors, and the sanctioned Russian exchange Garantex. All allegations in the OFAC action are based on Treasury findings and have not been adjudicated in a court of law.","heading":"Sanctions Evasion and Terrorist Financing Allegations","severity":"critical","sources":[{"credibility":1,"name":"Economic Fury Targets Iran's Largest Digital Asset Exchange — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0519"},{"credibility":2,"name":"OFAC Sanctions Nobitex and Three Other Iranian Cryptoasset Exchanges — Elliptic","type":"research","url":"https://www.elliptic.co/blog/ofac-sanctions-nobitex-and-three-other-iranian-cryptoasset-exchanges"},{"credibility":2,"name":"OFAC Sanctions Nobitex and Iranian Cryptocurrency Exchanges — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-iranian-crypto-exchanges-june-2026/"},{"credibility":2,"name":"US sanctions Nobitex crypto exchange used by Iranian ransomware actors — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/the-us-sanctions-nobitex-crypto-exchange-used-by-ransomware/"}]},{"content":"In June 2025, Nobitex suffered a $90 million cyberattack attributed to the pro-Israel hacking group Predatory Sparrow (also known as Gonjeshke Darande). The attackers compromised private keys and transferred funds from Nobitex to multiple vanity addresses containing anti-IRGC slogans — effectively burning the funds as a politically symbolic act rather than retaining them. OFAC's June 2026 designation specifically cited Rad's role in reconstituting Nobitex's operations following this breach. Separately, TRM Labs noted that Nobitex's blockchain address-validation software — a core piece of exchange infrastructure — was authored and updated by co-founder Seyed Mohammad Aghamir 17 times between 2022 and 2024. The exchange's continued operation after the breach and its ongoing transaction volumes were factors in the Treasury's enforcement rationale.","heading":"Nobitex Hack and Post-Breach Operations","severity":"high","sources":[{"credibility":1,"name":"Economic Fury Targets Iran's Largest Digital Asset Exchange — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0519"},{"credibility":1,"name":"Pro-Israel hackers take credit after $90 million stolen from Iran's largest crypto exchange — CNN","type":"news_article","url":"https://www.cnn.com/2025/06/18/middleeast/pro-israel-hackers-iran-crypto"},{"credibility":2,"name":"Iranian crypto exchange Nobitex hacked for over $90 million by pro-Israel group — Elliptic","type":"news_article","url":"https://www.elliptic.co/blog/iranian-crypto-exchange-nobitex-hacked-pro-israel-group"},{"credibility":2,"name":"Inside the Nobitex Breach: What the Leaked Source Code Reveals — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/inside-the-nobitex-breach-what-the-leaked-source-code-reveals-about-irans-crypto-infrastructure"}]},{"content":"The OFAC designation of Rad and Nobitex carries broad secondary sanctions exposure. Under E.O. 13902, foreign financial institutions and non-U.S. persons that conduct significant transactions with designated entities face correspondent account restrictions and potential secondary designation. Scorechain and Crystal Intelligence both noted that under OFAC's 50% ownership rule, any entity in which a designated person holds 50% or more ownership is itself considered blocked, even if not explicitly named on the SDN list. The collective $40 billion in cryptoasset transactions processed by the four designated exchanges, as calculated by Elliptic, underscores the scale of potential compliance exposure for any counterparties that interacted with Nobitex wallets.","heading":"Secondary Sanctions and Compliance Risk","severity":"high","sources":[{"credibility":2,"name":"OFAC Sanctions Nobitex and Three Other Iranian Cryptoasset Exchanges — Elliptic","type":"research","url":"https://www.elliptic.co/blog/ofac-sanctions-nobitex-and-three-other-iranian-cryptoasset-exchanges"},{"credibility":2,"name":"Crypto Sanctions Screening: OFAC Targets Iran Exchanges — Crystal Intelligence","type":"research","url":"https://crystalintelligence.com/sanctions/crypto-sanctions-screening-ofac-targets-iran-exchanges/"},{"credibility":2,"name":"OFAC Sanctions Iran's Four Largest Crypto Exchanges — Scorechain","type":"news_article","url":"https://www.scorechain.com/blog/ofac-iran-crypto-sanctions-june-2026"}]},{"content":"The June 2, 2026 designation of Rad and Nobitex was the third enforcement action targeting Iran's crypto ecosystem within a five-month period, according to TRM Labs. Earlier actions in the same campaign included January 2026 designations of IRGC-linked exchanges and April 2026 sanctions on Central Bank of Iran wallets. The broader 'Economic Fury' campaign represents a significant escalation in U.S. efforts to use crypto-specific enforcement tools to constrain Iranian financial infrastructure. This was the first time Iran-incorporated digital asset exchanges were named directly to the SDN list. The action also targets the Kharrazi family network — co-founders Ali and Mohammad Aghamir are identified as members of this family, which is described as part of Supreme Leader Khamenei's inner circle — indicating that Treasury viewed Nobitex as embedded within Iran's political and security apparatus rather than a commercially independent enterprise.","heading":"Broader Enforcement Context","severity":"high","sources":[{"credibility":2,"name":"Three Enforcement Layers in Five Months: OFAC Designates Iran's Domestic Crypto Exchanges — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"credibility":2,"name":"US sanctions Nobitex and other Iranian crypto exchanges under Economic Fury campaign — The Block","type":"news_article","url":"https://www.theblock.co/post/403436/us-sanctions-nobitex-iranian-crypto-exchanges-economic-fury-campaign"},{"credibility":2,"name":"From banks to blockchains: US opens new front in Iran sanctions — Iran International","type":"news_article","url":"https://www.iranintl.com/en/202606055401"}]}],"sources_used":[{"credibility":1,"name":"Economic Fury Targets Iran's Largest Digital Asset Exchange for Terror Finance and Sanctions Evasion — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0519"},{"credibility":2,"name":"OFAC Sanctions Iran's Four Largest Crypto Exchanges: What Every Compliance Team Needs to Know — Scorechain","type":"news_article","url":"https://www.scorechain.com/blog/ofac-iran-crypto-sanctions-june-2026"},{"credibility":2,"name":"OFAC Targets Nobitex and Other Iranian Crypto Exchanges: Compliance Brief — Global Ledger","type":"research","url":"https://blog.globalledger.io/research-investigations/ofac-nobitex-iranian-crypto-exchanges"},{"credibility":2,"name":"OFAC Sanctions Nobitex and Iranian Cryptocurrency Exchanges — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-iranian-crypto-exchanges-june-2026/"},{"credibility":2,"name":"OFAC Sanctions Nobitex and Three Other Iranian Cryptoasset Exchanges — Elliptic","type":"research","url":"https://www.elliptic.co/blog/ofac-sanctions-nobitex-and-three-other-iranian-cryptoasset-exchanges"},{"credibility":2,"name":"Three Enforcement Layers in Five Months: OFAC Designates Iran's Domestic Crypto Exchanges — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"credibility":2,"name":"US Treasury Sanctions Iran's Largest Crypto Exchange Nobitex Along With Three Other Iranian Platforms — Unchained Crypto","type":"news_article","url":"https://unchainedcrypto.com/us-treasury-sanctions-irans-largest-crypto-exchange-nobitex-along-with-three-other-iranian-platforms-under-economic-fury-campaign/"},{"credibility":1,"name":"Pro-Israel hackers take credit after $90 million stolen from Iran's largest crypto exchange — CNN","type":"news_article","url":"https://www.cnn.com/2025/06/18/middleeast/pro-israel-hackers-iran-crypto"},{"credibility":2,"name":"Inside the Nobitex Breach: What the Leaked Source Code Reveals About Iran's Crypto Infrastructure — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/inside-the-nobitex-breach-what-the-leaked-source-code-reveals-about-irans-crypto-infrastructure"},{"credibility":2,"name":"Crypto Sanctions Screening: OFAC Targets Iran Exchanges — Crystal Intelligence","type":"research","url":"https://crystalintelligence.com/sanctions/crypto-sanctions-screening-ofac-targets-iran-exchanges/"},{"credibility":2,"name":"US sanctions Nobitex and other Iranian crypto exchanges under Economic Fury campaign — The Block","type":"news_article","url":"https://www.theblock.co/post/403436/us-sanctions-nobitex-iranian-crypto-exchanges-economic-fury-campaign"},{"credibility":2,"name":"Iranian crypto exchange Nobitex hacked for over $90 million by pro-Israel group — Elliptic","type":"news_article","url":"https://www.elliptic.co/blog/iranian-crypto-exchange-nobitex-hacked-pro-israel-group"},{"credibility":2,"name":"From banks to blockchains: US opens new front in Iran sanctions — Iran International","type":"news_article","url":"https://www.iranintl.com/en/202606055401"}],"summary":"Amir Hossein Rad is the chairman, co-founder, and former CEO of Nobitex, Iran's largest cryptocurrency exchange. On June 2, 2026, OFAC personally designated Rad under Executive Orders 13224 and 13902 for his leadership role at an exchange the U.S. Treasury accused of enabling sanctions evasion, supporting the Islamic Revolutionary Guard Corps (IRGC), and facilitating terrorist financing. He was among four individuals designated alongside the exchange itself as part of the Trump administration's 'Economic Fury' campaign targeting Iran's financial infrastructure.","timeline":[{"date":"2022-01-01","event":"Nobitex co-founder Seyed Mohammad Aghamir begins a series of 17 updates to the exchange's core address-validation software, continuing through 2024, according to TRM Labs analysis of leaked source code.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/inside-the-nobitex-breach-what-the-leaked-source-code-reveals-about-irans-crypto-infrastructure"},{"date":"2025-06-18","event":"Nobitex suffers a $90 million hack attributed to the pro-Israel hacking group Predatory Sparrow (Gonjeshke Darande). Stolen funds are transferred to vanity addresses containing anti-IRGC slogans, effectively burning the assets. OFAC later cites Amir Hossein Rad's role in reconstituting the exchange's operations after this breach.","source":"CNN / Elliptic","source_url":"https://www.cnn.com/2025/06/18/middleeast/pro-israel-hackers-iran-crypto"},{"date":"2026-01-01","event":"OFAC issues the first enforcement layer of the Economic Fury campaign, designating IRGC-linked cryptocurrency exchanges.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"date":"2026-04-01","event":"OFAC issues the second enforcement layer, sanctioning Central Bank of Iran cryptocurrency wallets.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"date":"2026-06-02","event":"OFAC designates Amir Hossein Rad to the SDN list under E.O. 13224 and E.O. 13902, alongside Nobitex (Iran's largest crypto exchange), Wallex, Bitpin, Ramzinex, and three other Nobitex executives. This is the third and largest enforcement layer of the Economic Fury campaign targeting Iran's crypto ecosystem.","source":"U.S. Department of the Treasury","source_url":"https://home.treasury.gov/news/press-releases/sb0519"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7f76ee14-cece-40c6-80de-479326a6a7eecopy
2. #2reviewby reviewerreviewer

   2026-08-26 05:06:20Z
   Score: 2 → 2 (no score change)
   The page's central claims -- Rad's June 2, 2026 OFAC designation under E.O. 13224 and E.O. 13902, his role at Nobitex, the $90 million Predatory Sparrow hack, and the scale/allegations of the broader Economic Fury action -- are well-supported by Treasury's press release and independent research (TRM Labs, Elliptic, Reuters-derived reporting), and the designation remains in force as of August 2026. The page correctly avoids conflating Rad with the unrelated Kharrazi family and uses the correct legal authorities. However, one specific claim (a precise '17 updates 2022-2024' code-authorship detail attributed to TRM Labs) is not supported anywhere in the cited source and appears to be fabricated or misattributed detail, and several other claims show minor sourcing looseness (a superlative wrongly attributed to Treasury, a $2.3 billion figure not found in any of the four sources cited for it, and invented day-level precision in two timeline dates).
   anchoranchored

   chain

   ●mainnet-betaslot 443,519,316

   sig

   2jkJEbBa4wCa…fwvQJhjpcopyexplorer ↗

   hash

   CZoSEjL3JczG…QKgbxDuecopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1307 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-26T05:06:20.271Z","decision":"review","investigation_id":"e8d3f545-e0ed-42f0-8fa0-79ef47f530fc","new_score":2,"page_slug":"amir-hossein-rad","prev_score":2,"reason":"The page's central claims -- Rad's June 2, 2026 OFAC designation under E.O. 13224 and E.O. 13902, his role at Nobitex, the $90 million Predatory Sparrow hack, and the scale/allegations of the broader Economic Fury action -- are well-supported by Treasury's press release and independent research (TRM Labs, Elliptic, Reuters-derived reporting), and the designation remains in force as of August 2026. The page correctly avoids conflating Rad with the unrelated Kharrazi family and uses the correct legal authorities. However, one specific claim (a precise '17 updates 2022-2024' code-authorship detail attributed to TRM Labs) is not supported anywhere in the cited source and appears to be fabricated or misattributed detail, and several other claims show minor sourcing looseness (a superlative wrongly attributed to Treasury, a $2.3 billion figure not found in any of the four sources cited for it, and invented day-level precision in two timeline dates).","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7715518e-2191-4896-ba21-3e7e9af497afcopy
3. #3review reviseby judgejudge

   2026-08-26 05:06:20Z
   Score: 2 → 0 (-12)
   Of 23 factual claims checked against the page's cited sources, 17 were confirmed, 5 were partially supported, and 1 was disputed, for a raw disputed rate of 4.3% (claim_findings index 17). On the standard metric alone that rate would round to a clean approval. But the one disputed finding is a fabrication, not an overstatement: the page states that TRM Labs documented a named Nobitex co-founder authoring and updating the exchange's address-validation software 17 times between 2022 and 2024, and attributes this to a specific TRM Labs report. A full-text check of that report found no mention of code authorship, commit counts, or any individual developer at all -- the claim has no basis in the cited source, and it appears twice on the page (once in prose, once in the timeline). That is a different and more serious defect than a dropped hedge or a rounded-off qualifier; it is an invented, specific detail attached to a real research firm's name. The five partially-supported findings are lower-severity sourcing-precision problems: a 'largest ... to date' superlative wrongly attributed directly to Treasury when it actually comes from a compliance blog's own analysis (claim_findings index 4); a 'material support for a designated entity' framing that overstates precision, since the entity in question was not yet designated at the time of the conduct described (index 9); a $2.3 billion figure that is accurate but does not appear in any of the four sources the page cites for it (index 11); and two timeline entries with invented day-level precision where the underlying sources give only a month (indices 19-20). None of this touches the page's core, well-supported findings: the designation date, the legal authorities (E.O. 13224 and 13902), the scale and nature of the allegations against Nobitex, and Rad's role at the exchange are all confirmed by Treasury's own release and corroborated independently, the page correctly keeps Rad separate from the unrelated Kharrazi family, and the designation remains active as of today. Because this page names a living individual under active sanction, a specific fabricated attribution to a named research firm is treated as a correction-worthy defect rather than being absorbed into a clean pass by the disputed-claim percentage alone; the page should have the code-authorship claim removed or properly sourced before this is reconsidered for approval.
   anchoranchored

   chain

   ●mainnet-betaslot 443,519,322

   sig

   4JzC7ibozMxt…NUavyyPycopyexplorer ↗

   hash

   4fmXiY9NZEYw…sctK5wBGcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2768 B) ▸

   {"actor":"judge","decided_at":"2026-08-26T05:06:20.271Z","decision":"review_revise","investigation_id":"e8d3f545-e0ed-42f0-8fa0-79ef47f530fc","new_score":0,"page_slug":"amir-hossein-rad","prev_score":2,"reason":"Of 23 factual claims checked against the page's cited sources, 17 were confirmed, 5 were partially supported, and 1 was disputed, for a raw disputed rate of 4.3% (claim_findings index 17). On the standard metric alone that rate would round to a clean approval. But the one disputed finding is a fabrication, not an overstatement: the page states that TRM Labs documented a named Nobitex co-founder authoring and updating the exchange's address-validation software 17 times between 2022 and 2024, and attributes this to a specific TRM Labs report. A full-text check of that report found no mention of code authorship, commit counts, or any individual developer at all -- the claim has no basis in the cited source, and it appears twice on the page (once in prose, once in the timeline). That is a different and more serious defect than a dropped hedge or a rounded-off qualifier; it is an invented, specific detail attached to a real research firm's name. The five partially-supported findings are lower-severity sourcing-precision problems: a 'largest ... to date' superlative wrongly attributed directly to Treasury when it actually comes from a compliance blog's own analysis (claim_findings index 4); a 'material support for a designated entity' framing that overstates precision, since the entity in question was not yet designated at the time of the conduct described (index 9); a $2.3 billion figure that is accurate but does not appear in any of the four sources the page cites for it (index 11); and two timeline entries with invented day-level precision where the underlying sources give only a month (indices 19-20). None of this touches the page's core, well-supported findings: the designation date, the legal authorities (E.O. 13224 and 13902), the scale and nature of the allegations against Nobitex, and Rad's role at the exchange are all confirmed by Treasury's own release and corroborated independently, the page correctly keeps Rad separate from the unrelated Kharrazi family, and the designation remains active as of today. Because this page names a living individual under active sanction, a specific fabricated attribution to a named research firm is treated as a correction-worthy defect rather than being absorbed into a clean pass by the disputed-claim percentage alone; the page should have the code-authorship claim removed or properly sourced before this is reconsidered for approval.","score_delta":-12,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c7d8e6bb-c607-4ec9-a5dc-2d3ac7bd739ecopy