{"investigation":{"slug":"nobitex","entity_name":"Nobitex","trust_score":5,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Nobitex is Iran's largest cryptocurrency exchange, founded in 2017, claiming over 11 million users and handling approximately 70% of Iran's on-chain crypto volume. A March 2025 Reuters investigation identified its founders as brothers Ali and Mohammad Kharrazi — members of a family with documented ties to Iran's Supreme Leaders and the founding of the Islamic Revolutionary Guard Corps — who operated the exchange under an alternative surname. Blockchain analytics firms including Elliptic, Chainalysis, and TRM Labs have documented billions of dollars in flows through Nobitex connected to sanctioned Iranian state entities including the Central Bank of Iran and the IRGC, making the platform a critical node in Iran's sanctions evasion infrastructure.","sections":[{"content":"Nobitex was founded in 2017 and is Iran's dominant cryptocurrency exchange, claiming over 11 million registered users — more than 10% of Iran's population. The platform handles approximately 70% of Iran's cryptocurrency activity and processes the majority of on-chain exchange flows originating in the country. Chainalysis data indicates Nobitex recorded total inflows exceeding $11 billion between 2019 and 2025, compared to $7.5 billion combined for the next ten largest Iranian exchanges. The platform supports trading in Bitcoin, Tether (USDT), Ethereum, and dozens of other digital assets, functioning as the primary on-ramp between the Iranian rial and global cryptocurrency markets. As of early 2026, TRM Labs estimated approximately $5 billion in observed volume from 2025 onward.","heading":"Overview and Scale","sources":[],"severity":"medium"},{"content":"A Reuters investigation published in March 2025 identified Nobitex's founders as brothers Ali and Mohammad Kharrazi, who registered and operated the exchange under the alternative surname 'Aghamir' in corporate filings, university records, and marketing materials. The Kharrazi family is described by Reuters as one of Iran's most politically connected dynasties. Their grandfather served on the Assembly of Experts — the body that selects Iran's Supreme Leader — and personally tutored Mojtaba Khamenei, who succeeded his father Ali Khamenei as Supreme Leader. Their father, Ayatollah Bagher Kharrazi, founded an Iranian political organization named Hezbollah and was involved in early staffing of the Islamic Revolutionary Guard Corps (IRGC) following the 1979 revolution. Nobitex denied government affiliation in a statement to Reuters, characterizing illicit transactions as a 'very small fraction of overall volume' occurring without management's awareness. The use of an alternative surname to register the exchange has been characterized by analysts as an attempt to mask the founders' connections to Iran's ruling elite.","heading":"Founders and Political Connections","sources":[],"severity":"medium"},{"content":"Nobitex has not been individually listed on the U.S. Treasury's Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) List as of May 2026. However, OFAC clarified on May 1, 2026 that 'Iranian digital asset exchanges are already considered blocked financial institutions, regardless of whether they are individually named on the SDN List.' This means that U.S. persons and entities are legally prohibited from transacting with Nobitex under existing Iran sanctions regulations, even absent a specific SDN designation. Blockchain analytics firm Elliptic identified wallet patterns linking Nobitex infrastructure to addresses associated with specifically sanctioned entities, including interactions with Garantex — the Russian exchange sanctioned by OFAC — as well as addresses linked to Hamas, Palestinian Islamic Jihad, and DPRK-affiliated hacking groups. Elliptic also documented connections to Gaza Now, a sanctioned fundraising network, and Zedcex, a recently sanctioned exchange. Analysts have noted that OFAC's apparent reluctance to individually list Nobitex may stem from the practical difficulty of separating regime-directed flows from those of ordinary Iranian retail users, whose assets are commingled on the platform.","heading":"Sanctions Exposure and OFAC Status","sources":[],"severity":"medium"},{"content":"Multiple blockchain analytics firms have documented large-scale flows through Nobitex connected to designated Iranian state entities. Since January 1, 2023, Nobitex has allegedly moved more than $2 billion on the Tron network and at least $317 million on BNB Chain for sanctioned entities, according to Reuters and Chainalysis. Elliptic identified approximately $366 million in direct transfers from sanctioned wallets; Chainalysis estimated $68 million; Crystal Intelligence identified approximately $22 million. Iran's Central Bank — itself under U.S. sanctions — transferred hundreds of millions of dollars in cryptocurrency to Nobitex in 2025 alone, with Elliptic and Reuters sources estimating approximately $347 million sent from Central Bank wallets to Nobitex in the first half of 2025. Elliptic's January 2026 report further documented that Iran's Central Bank acquired at least $507 million in USDT through a UAE-based broker, with funds routed 'primarily' to Nobitex. In Q4 2025, IRGC-linked addresses accounted for over half of all value received by Iranian entities, with more than $3 billion moved to support regional militia networks, facilitate oil sales, and procure dual-use equipment, according to Chainalysis. Nobitex denied these characterizations in public statements.","heading":"IRGC and Sanctioned State Entity Flows","sources":[],"severity":"medium"},{"content":"Tether has taken multiple enforcement actions against wallets linked to Iranian sanctions evasion that intersect with Nobitex's documented transaction graph. In April 2026, CoinDesk reported that Tether froze $344 million in USDT across two Tron-based blockchain addresses linked to U.S. Treasury 'Economic Fury' actions against the Iranian regime. Tether subsequently carried out its largest Iranian-linked freeze action on July 2, 2025, blacklisting 42 wallets. Since 2023, Tether has blacklisted over $3.3 billion in USDT across more than 7,000 wallets in actions tied to Iran-related sanctions. Wallex, another Iran-connected exchange, also had wallets frozen by both Tether and Circle. A court dispute emerged in May 2026 over the $344 million Tether freeze, with parties seeking to redirect the frozen assets to sanctions victims. Iran's Central Bank reportedly used USDT extensively through Nobitex to bypass the US dollar banking system and support the rial. As of May 2026, crypto flows through Iran dropped approximately 11% following the combined impact of the Nobitex hack and Tether enforcement actions.","heading":"Tether Blacklisting and Stablecoin Enforcement","sources":[],"severity":"medium"},{"content":"On June 18, 2025, Nobitex suffered a major security incident in which over $90 million in cryptocurrency assets were stolen from its hot wallets. On-chain investigator ZachXBT was among the first to publicly identify suspicious outflows, initially reporting $48.65 million in suspicious transactions on the Tron network before updating the estimate to $81 million as additional transactions were identified on EVM-compatible chains. Final estimates from multiple analytics firms placed losses above $90 million across Bitcoin, Ethereum, Dogecoin, Ripple, Solana, Tron, and TON. The pro-Israel hacking group Gonjeshke Darande, also known as Predatory Sparrow, claimed responsibility for the attack. The group stated that 'Nobitex is at the heart of the regime's efforts to finance terror worldwide, as well as being the regime's favorite sanctions violation tool.' In a politically symbolic act, the attackers transferred stolen funds to invalid burn addresses containing the string 'FuckiRGCTerroristsNoBiTE,' effectively destroying the assets rather than retaining them. The attackers also leaked Nobitex's source code and sensitive configuration data from its servers. Halborn security researchers assessed the root cause as compromised private keys stored insecurely on systems accessed by the attackers. Nobitex stated it would compensate users for all losses through its insurance fund. Iran's Central Bank subsequently directed domestic exchanges to limit operating hours to 10 AM–8 PM. Within minutes of the first US-Israeli military strikes in June 2025, outgoing transaction volumes from Nobitex surged by 700%, according to Elliptic.","heading":"June 2025 Hack by Gonjeshke Darande (Predatory Sparrow)","sources":[],"severity":"medium"},{"content":"Any non-Iranian individual or entity transacting with Nobitex faces significant legal exposure under U.S. sanctions law. OFAC has clarified that Iranian digital asset exchanges constitute blocked financial institutions under existing Iran sanctions frameworks regardless of SDN listing status, meaning that U.S. persons engaging with Nobitex — including transacting with its wallets or facilitating transactions on its behalf — may face civil or criminal penalties. Non-U.S. persons may face secondary sanctions exposure depending on their jurisdiction and the nature of their dealings. The platform does not offer KYC/AML controls compatible with international standards, and its documented transaction graph includes wallet addresses flagged by Elliptic, Chainalysis, TRM Labs, and Crystal Intelligence as linked to designated entities. Al Jazeera reported in April 2026 that the U.S. and Iran are engaged in an escalating 'crypto cat-and-mouse game' in which enforcement actions are intensifying, increasing the risk of additional OFAC designations, wallet freezes, and enforcement actions targeting Nobitex counterparties.","heading":"Regulatory Risk for Non-Iranian Users","sources":[],"severity":"medium"}],"timeline":[{"date":"2017","event":"Nobitex founded in Iran by brothers Ali and Mohammad Kharrazi, operating under the alternative surname Aghamir.","source":"","source_url":"https://cointelegraph.com/news/irans-largest-crypto-exchange-founded-by-sons-of-family-tied-to-supreme-leaders-reuters","date_original":"2017-01-01"},{"date":"2023","event":"Nobitex begins period of documented flows exceeding $2.3 billion on Tron and BNB Chain for sanctioned Iranian state entities including the Central Bank of Iran and IRGC, according to Chainalysis and Reuters.","source":"","source_url":"https://coinalertnews.com/news/2026/05/18/iran-irgc-nobitex-tron-bnb","date_original":"2023-01-01"},{"date":"2025-03-25","event":"Reuters publishes investigation linking Nobitex's founders to the Kharrazi political dynasty, with documented connections to Iran's Supreme Leaders and IRGC founding, and identifying hundreds of millions of dollars in state-linked flows through the exchange.","source":"","source_url":"https://cointelegraph.com/news/irans-largest-crypto-exchange-founded-by-sons-of-family-tied-to-supreme-leaders-reuters"},{"date":"2025-06-18","event":"Pro-Israel hacking group Gonjeshke Darande (Predatory Sparrow) exploits Nobitex hot wallets, draining over $90 million in cryptocurrency across multiple chains. ZachXBT identifies suspicious outflows of $48.65 million on Tron, later revised to $81 million. Stolen funds are burned at invalid wallet addresses.","source":"","source_url":"https://www.chainalysis.com/blog/nobitex-iranian-exchange-exploit-june-2025/"},{"date":"2025-07-02","event":"Tether executes its largest Iran-linked USDT freeze to date, blacklisting 42 wallets. Iran's crypto flows drop approximately 11% in the months following the Nobitex hack and stablecoin enforcement actions.","source":"","source_url":"https://www.bitget.com/news/detail/12560604932819"},{"date":"2026","event":"Elliptic publishes report documenting that Iran's Central Bank acquired at least $507 million in USDT routed primarily to Nobitex, using a UAE-based broker.","source":"","source_url":"https://www.elliptic.co/blog/iran-has-acquired-us-dollar-stablecoins-worth-at-least-half-a-billion-dollars","date_original":"2026-01-01"},{"date":"2026-04-24","event":"Tether freezes $344 million in USDT across two Tron-based addresses linked to Iran, in connection with U.S. Treasury 'Economic Fury' enforcement actions.","source":"","source_url":"https://www.coindesk.com/policy/2026/04/24/tether-s-usd344-million-usdt-freeze-linked-to-u-s-economic-fury-against-iran-regime"},{"date":"2026-04-29","event":"Al Jazeera reports on escalating US-Iran crypto enforcement conflict, describing an ongoing 'cat-and-mouse game' over sanctions with Nobitex at the center.","source":"","source_url":"https://www.aljazeera.com/news/2026/4/29/how-us-and-iran-are-playing-a-crypto-cat-and-mouse-game-over-sanctions"},{"date":"2026-05","event":"OFAC clarifies that Iranian digital asset exchanges are considered blocked financial institutions under existing US sanctions law regardless of whether they appear on the SDN list by name.","source":"","source_url":"https://cointelegraph.com/features/the-nobitex-dilemma-how-irans-biggest-crypto-exchange-stays-off-the-ofac-blacklist","date_original":"2026-05-01"},{"date":"2026-05-15","event":"Tether faces court dispute over the $344 million Iran-linked USDT freeze, with parties seeking to redirect frozen assets to sanctions victims.","source":"","source_url":"https://www.thecoinrepublic.com/2026/05/15/tether-faces-court-dispute-over-344m-iran-linked-usdt-freeze/"},{"date":"2026-05-18","event":"Chainalysis and Reuters publish joint findings documenting IRGC and Nobitex moving billions through Tron and BNB Chain, raising renewed sanctions concerns.","source":"","source_url":"https://coinalertnews.com/news/2026/05/18/iran-irgc-nobitex-tron-bnb"}],"sources_used":[],"source_tags":["zachxbt","defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T02:54:22.939997+00:00","updated_at":"2026-08-29T01:36:04.508+00:00"}}