Audit log

Every state-changing event for Nobitex / Wallex / Bitpin / Ramzinex: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-06-21 17:11:33Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 427,983,820

   sig

   4kyDWVcizfQz…fFtMCKrFcopyexplorer ↗

   hash

   6rycsfCyQKjx…89dRGarpcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (25139 B) ▸

   {"actor":"system:backfill","investigation_id":"a8f09035-635e-4b29-9611-310c173e1f31","kind":"publish","page_slug":"nobitex-wallex-bitpin-ramzinex","published_at":"2026-06-21T17:11:33.684Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Nobitex / Wallex / Bitpin / Ramzinex","sections":[{"content":"On June 2, 2026, OFAC designated Nobitex, Wallex, Bitpin, and Ramzinex under Executive Order 13224 (counterterrorism, for alleged IRGC material support) and Executive Order 13902 (Iranian financial sector). Four individuals associated with Nobitex were also designated: Amir Hossein Rad (chairman, co-founder, former CEO), Seyed Ali Khoee (current CEO), Seyed Mohammad Ali Aghamir (co-founder, identified by Reuters as a member of the Kharrazi family), and Seyed Mohammad Aghamir (co-founder and blockchain lead, also Kharrazi family). Treasury Secretary Scott Bessent stated: 'Iran's economy is in free fall, the regime has chosen to co-opt digital asset technologies for its own corrupt agenda, including evading sanctions.' This is described by TRM Labs as the third enforcement layer in five months, following designations of UK-registered exchange infrastructure in January 2026 and the freezing of Central Bank of Iran wallets in April 2026. Treasury reported seizing approximately $1 billion in cryptocurrency from Iranian exchanges and wallets since the Economic Fury campaign began in March 2025.","heading":"OFAC Designation — June 2, 2026","severity":"critical","sources":[{"credibility":1,"name":"U.S. Treasury Press Release: Economic Fury Targets Iran's Largest Digital Asset Exchange","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0519"},{"credibility":2,"name":"TRM Labs: Three Enforcement Layers in Five Months","type":"research","url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"credibility":2,"name":"Unchained Crypto: US Treasury Sanctions Iran's Largest Crypto Exchange Nobitex","type":"news_article","url":"https://unchainedcrypto.com/us-treasury-sanctions-irans-largest-crypto-exchange-nobitex-along-with-three-other-iranian-platforms-under-economic-fury-campaign/"},{"credibility":2,"name":"CoinDesk: U.S. Sanctions Iranian Crypto Exchanges","type":"news_article","url":"https://www.coindesk.com/policy/2026/06/02/u-s-sanctions-iranian-crypto-exchanges-in-ongoing-war-against-country"}]},{"content":"All four designations carry explicit secondary sanctions under E.O. 13902 and the National Defense Authorization Act of 2012. Any non-U.S. financial institution or foreign person that conducts 'significant transactions' with these exchanges after June 2, 2026 risks: (1) designation as a Specially Designated National themselves; (2) strict conditions on or prohibition of U.S. dollar correspondent or payable-through account access. OFAC FAQ 1257, added June 2, 2026, clarifies that the secondary sanctions exposure extends to entities providing material support or services to the designated exchanges, regardless of where the institution operates. Compliance teams are required to update screening systems with new SDN addresses, block and report designated assets within 10 business days, and apply the 'fifty percent rule' to automatically block entities in which designated persons hold 50% or more ownership. The primary stablecoin routing risk involves USDT transactions on the TRON and Ethereum networks.","heading":"Secondary Sanctions and Compliance Obligations","severity":"critical","sources":[{"credibility":1,"name":"OFAC FAQ 1257 — Added June 2, 2026","type":"regulatory","url":"https://ofac.treasury.gov/faqs/added/2026-06-02"},{"credibility":2,"name":"Scorechain: OFAC Iran Crypto Sanctions June 2026 — Compliance Brief","type":"research","url":"https://www.scorechain.com/blog/ofac-iran-crypto-sanctions-june-2026"}]},{"content":"Nobitex is Iran's largest cryptocurrency exchange, founded in 2017–2018 and claiming approximately 11 million users. It processed over 50% of all Iranian digital asset inflows in 2025, representing a 2025 volume of approximately $4.7 billion according to TRM Labs. The platform is particularly dominant in Bitcoin and USDT trading. Reuters reported that the Nobitex domain was registered in 2017 using an email address containing the Kharrazi surname, and that co-founders Ali and Mohammad Kharrazi (who used the surname Aghamir in public filings) belong to one of the most politically connected families in the Islamic Republic. Their father is alleged to have founded Iran's Hezbollah movement and participated in the creation of the IRGC. Open-source investigations cited by Elliptic linked major Nobitex shareholders to individuals with ties to Seyed Mohammad Baqer Kharazi (a relative of Iran's Supreme Leader) and Mohsen Rezaee Mirqaed (a founding IRGC commander). OFAC designated Seyed Mohammad Aghamir specifically for his role as blockchain lead: he authored Nobitex's address-validation software governing deposits and withdrawals and updated it 17 times between 2022 and 2024. Code leaked in the June 2025 Predatory Sparrow hack corroborated his operational role. Nobitex denied any government affiliation in a statement to Reuters and characterized illicit funds moving through the platform as a 'very small fraction of overall volume' occurring without management's awareness.","heading":"Nobitex — Scale, Ownership, and Regime Connections","severity":"critical","sources":[{"credibility":1,"name":"The Block: Nobitex Founded by Sons of Elite Political Family Tied to Supreme Leaders (Reuters)","type":"news_article","url":"https://www.theblock.co/amp/post/399784/leading-iranian-crypto-exchange-nobitex-was-founded-by-sons-of-elite-political-family-tied-to-supreme-leaders-reuters"},{"credibility":2,"name":"Elliptic: Inside Nobitex — How Iran's Largest Crypto Exchange Fuels Sanctions Evasion","type":"research","url":"https://www.elliptic.co/blog/inside-nobitex-how-irans-largest-crypto-exchange-fuels-sanctions-evasion-and-illicit-finance"},{"credibility":2,"name":"TRM Labs: Three Enforcement Layers in Five Months","type":"research","url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"credibility":1,"name":"U.S. Treasury Press Release: Economic Fury Targets Iran's Largest Digital Asset Exchange","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0519"}]},{"content":"OFAC alleged that Nobitex facilitated transactions for IRGC-affiliated ransomware actors and processed at least $2.3 billion in sanctioned entity transactions since 2023. The Central Bank of Iran allegedly acquired at least $507 million in USDT, with the majority routed through Nobitex until mid-2025, to support the declining rial. Elliptic's on-chain analysis identified wallet-level interactions between Nobitex infrastructure and addresses linked to: Hamas; DPRK-affiliated hacking groups; Syrian-based actors; and Garantex, the Russian exchange previously sanctioned by OFAC for laundering ransomware proceeds and darknet market funds. Outflows from Nobitex were reported to have surged within minutes of U.S.-Israeli strikes on Iranian targets and continued during Iran's internet blackouts, which analysts characterized as consistent with regime asset-protection operations. Wallex, Bitpin, and Ramzinex were also designated for IRGC-linked transaction facilitation. Bitpin's investors have been reported as linked to Iranian sanctions evasion efforts. Ramzinex was specifically noted to have processed transactions for a financial institution backed by the Iranian government.","heading":"Terror Finance and IRGC-Linked Transactions","severity":"critical","sources":[{"credibility":1,"name":"U.S. Treasury Press Release: Economic Fury Targets Iran's Largest Digital Asset Exchange","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0519"},{"credibility":2,"name":"Elliptic: OFAC Sanctions Nobitex and Three Other Iranian Cryptoasset Exchanges","type":"research","url":"https://www.elliptic.co/blog/ofac-sanctions-nobitex-and-three-other-iranian-cryptoasset-exchanges"},{"credibility":2,"name":"Elliptic: Inside Nobitex — How Iran's Largest Crypto Exchange Fuels Sanctions Evasion","type":"research","url":"https://www.elliptic.co/blog/inside-nobitex-how-irans-largest-crypto-exchange-fuels-sanctions-evasion-and-illicit-finance"},{"credibility":2,"name":"Unchained Crypto: US Treasury Sanctions Iran's Largest Crypto Exchange Nobitex","type":"news_article","url":"https://unchainedcrypto.com/us-treasury-sanctions-irans-largest-crypto-exchange-nobitex-along-with-three-other-iranian-platforms-under-economic-fury-campaign/"}]},{"content":"Wallex is Iran's second-largest digital asset exchange by volume and received approximately 12% of all Iranian digital asset inflows in 2025, representing approximately $1.45 billion in annual volume per TRM Labs. It was designated under Iran-related OFAC authorities for facilitating IRGC-linked transactions. Bitpin received approximately 10% of Iranian digital asset inflows in 2025, representing approximately $821 million in annual volume. It operates from the Anzali Free Zone in Iran. Its investors have been reported as linked to Iranian efforts to evade U.S. sanctions, and it processed transactions linked to the IRGC. Ramzinex was founded in Tehran in 2018 and processed over $2.45 billion in lifetime transactions, including transactions linked to the IRGC and a government-backed Iranian financial institution. It recorded approximately $739 million in 2025 volume. Combined, the four exchanges processed roughly $7.7 billion — approximately 78% of Iran's attributed 2025 crypto volume — according to TRM Labs.","heading":"Wallex, Bitpin, and Ramzinex — Individual Profiles","severity":"critical","sources":[{"credibility":1,"name":"U.S. Treasury Press Release: Economic Fury Targets Iran's Largest Digital Asset Exchange","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0519"},{"credibility":2,"name":"TRM Labs: Three Enforcement Layers in Five Months","type":"research","url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"credibility":2,"name":"Scorechain: OFAC Iran Crypto Sanctions June 2026","type":"research","url":"https://www.scorechain.com/blog/ofac-iran-crypto-sanctions-june-2026"}]},{"content":"In June 2025, approximately one year before the OFAC designation, Nobitex was breached by Gonjeshke Darande (also known as Predatory Sparrow), a pro-Israeli hacktivist group. Estimates of funds drained from hot wallets range from $90 million to $100 million across Bitcoin, Ethereum, and other cryptocurrencies. The group stated it destroyed approximately $90 million of the stolen assets by routing them to inaccessible addresses as a political protest against Nobitex's alleged role in regime sanctions evasion. Approximately $55 million remained recoverable as USDT. Two days after the breach, Predatory Sparrow published Nobitex's complete internal source code, deployment architecture, and security documentation. Iran's central bank responded by restricting crypto exchange operating hours to 10 a.m.–8 p.m. The leaked code revealed anti-surveillance modules including components named 'owshen,' 'zpk,' and 'incentivized_mixer,' designed for stealth address generation, transaction batching, output splitting, and real-time endpoint switching — capabilities consistent with deliberate blockchain intelligence evasion. The code also corroborated the operational role of Seyed Mohammad Aghamir, who was later designated by OFAC. TRM Labs noted that the leaked code informed subsequent U.S. enforcement analysis.","heading":"June 2025 Predatory Sparrow Hack and Source Code Leak","severity":"high","sources":[{"credibility":2,"name":"Crypto Times: Israeli Hackers Leak Nobitex Source Code After $100M Crypto Heist","type":"news_article","url":"https://www.cryptotimes.io/2025/06/19/israeli-hackers-leak-nobitex-source-code-after-100m-crypto-heist/"},{"credibility":2,"name":"TRM Labs: Inside the Nobitex Breach — What the Leaked Source Code Reveals","type":"research","url":"https://www.trmlabs.com/resources/blog/inside-the-nobitex-breach-what-the-leaked-source-code-reveals-about-irans-crypto-infrastructure"},{"credibility":2,"name":"Cryptopolitan: Pro-Israel Hacker Releases Nobitex's Source Code After BTC, XRP Exploits","type":"news_article","url":"https://www.cryptopolitan.com/israel-hacker-releases-nobitexs-source-code/"},{"credibility":2,"name":"Scorechain: OFAC Iran Crypto Sanctions June 2026","type":"research","url":"https://www.scorechain.com/blog/ofac-iran-crypto-sanctions-june-2026"}]},{"content":"The June 2026 designations are the third and largest enforcement action under the Trump administration's Economic Fury campaign, launched in March 2025. The campaign targets Iran's financial infrastructure through coordinated sanctions, asset seizures, and diplomatic pressure. The three enforcement layers between January and June 2026 were: (1) January 2026 — designation of Zedcex and Zedxion, UK-registered entities providing exchange-branded stablecoin infrastructure with IRGC connections, with approximately $1 billion in routed funds; (2) April 2026 — freezing of Central Bank of Iran cryptocurrency wallets, including a coordinated Tether freeze of $344.2 million in USDT; (3) June 2026 — designation of the domestic retail exchange layer (Nobitex, Wallex, Bitpin, Ramzinex). Treasury also warned during the June 2026 action of sanctions risks for entities complying with Iranian demands for passage fees through the Strait of Hormuz, including payments via cryptocurrency, fiat, or in-kind transfers. Iran recorded approximately $9.9 billion in attributed crypto volume in 2025, despite a decade of international sanctions.","heading":"Economic Fury Campaign Context","severity":"high","sources":[{"credibility":2,"name":"TRM Labs: Three Enforcement Layers in Five Months","type":"research","url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"credibility":2,"name":"CoinDesk: U.S. Sanctions Iranian Crypto Exchanges","type":"news_article","url":"https://www.coindesk.com/policy/2026/06/02/u-s-sanctions-iranian-crypto-exchanges-in-ongoing-war-against-country"},{"credibility":2,"name":"Unchained Crypto: US Treasury Sanctions Iran's Largest Crypto Exchange Nobitex","type":"news_article","url":"https://unchainedcrypto.com/us-treasury-sanctions-irans-largest-crypto-exchange-nobitex-along-with-three-other-iranian-platforms-under-economic-fury-campaign/"}]},{"content":"Four Iranian nationals were designated alongside the exchanges, all connected to Nobitex. Amir Hossein Rad is the chairman, co-founder, and former CEO of Nobitex. Seyed Ali Khoee is the current CEO. Seyed Mohammad Ali Aghamir Mohammad Ali and Seyed Mohammad Aghamir Mohammad Ali are co-founders identified by Reuters as members of the Kharrazi family — one of Iran's most politically connected dynasties, with familial ties to Iran's Supreme Leader and IRGC founding figures. The latter was specifically designated for his role authoring and maintaining Nobitex's core address-validation software. No individuals from Wallex, Bitpin, or Ramzinex were named in the initial designation.","heading":"Designated Individuals","severity":"critical","sources":[{"credibility":1,"name":"U.S. Treasury Press Release: Economic Fury Targets Iran's Largest Digital Asset Exchange","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0519"},{"credibility":2,"name":"Elliptic: OFAC Sanctions Nobitex and Three Other Iranian Cryptoasset Exchanges","type":"research","url":"https://www.elliptic.co/blog/ofac-sanctions-nobitex-and-three-other-iranian-cryptoasset-exchanges"}]},{"content":"According to Elliptic, the four sanctioned exchanges have collectively sent or received cryptoasset transactions totaling at least $40 billion in their operational history. The primary vector of concern is USDT stablecoin routing, predominantly on the TRON and Ethereum networks. Iran's Central Bank acquired at least $507 million in USDT routed primarily through Nobitex until mid-2025 to defend the rial. Elliptic's analysis also identified exposure to sanctioned Russian exchanges Garantex and Grinex, as well as multiple Kyrgyzstan-registered entities likely affiliated with Garantex. The leaked Nobitex source code revealed anti-surveillance modules (owshen, zpk, incentivized_mixer) consistent with deliberate efforts to frustrate blockchain analytics. Blockchain analytics firms including Elliptic, Chainalysis, TRM Labs, and Crystal Intelligence have all flagged these entities as high-risk and updated their compliance screening tools following the June 2 designations.","heading":"On-Chain Risk Profile and Stablecoin Exposure","severity":"critical","sources":[{"credibility":2,"name":"Elliptic: OFAC Sanctions Nobitex and Three Other Iranian Cryptoasset Exchanges","type":"research","url":"https://www.elliptic.co/blog/ofac-sanctions-nobitex-and-three-other-iranian-cryptoasset-exchanges"},{"credibility":2,"name":"Chainalysis: OFAC Sanctions Iranian Crypto Exchanges","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-iranian-crypto-exchanges-june-2026/"},{"credibility":2,"name":"Crystal Intelligence: Crypto Sanctions Screening — OFAC Targets Iran Exchanges","type":"research","url":"https://crystalintelligence.com/sanctions/crypto-sanctions-screening-ofac-targets-iran-exchanges/"}]}],"sources_used":[{"credibility":1,"name":"U.S. Treasury Press Release: Economic Fury Targets Iran's Largest Digital Asset Exchange","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0519"},{"credibility":1,"name":"OFAC FAQ 1257 — Added June 2, 2026","type":"regulatory","url":"https://ofac.treasury.gov/faqs/added/2026-06-02"},{"credibility":2,"name":"Elliptic: OFAC Sanctions Nobitex and Three Other Iranian Cryptoasset Exchanges","type":"research","url":"https://www.elliptic.co/blog/ofac-sanctions-nobitex-and-three-other-iranian-cryptoasset-exchanges"},{"credibility":2,"name":"Elliptic: Inside Nobitex — How Iran's Largest Crypto Exchange Fuels Sanctions Evasion","type":"research","url":"https://www.elliptic.co/blog/inside-nobitex-how-irans-largest-crypto-exchange-fuels-sanctions-evasion-and-illicit-finance"},{"credibility":2,"name":"Chainalysis: OFAC Sanctions Iranian Crypto Exchanges","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-iranian-crypto-exchanges-june-2026/"},{"credibility":2,"name":"TRM Labs: Three Enforcement Layers in Five Months","type":"research","url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"credibility":2,"name":"TRM Labs: Inside the Nobitex Breach — What the Leaked Source Code Reveals","type":"research","url":"https://www.trmlabs.com/resources/blog/inside-the-nobitex-breach-what-the-leaked-source-code-reveals-about-irans-crypto-infrastructure"},{"credibility":2,"name":"Scorechain: OFAC Iran Crypto Sanctions June 2026","type":"research","url":"https://www.scorechain.com/blog/ofac-iran-crypto-sanctions-june-2026"},{"credibility":2,"name":"CoinDesk: U.S. Sanctions Iranian Crypto Exchanges","type":"news_article","url":"https://www.coindesk.com/policy/2026/06/02/u-s-sanctions-iranian-crypto-exchanges-in-ongoing-war-against-country"},{"credibility":2,"name":"Unchained Crypto: US Treasury Sanctions Iran's Largest Crypto Exchange Nobitex","type":"news_article","url":"https://unchainedcrypto.com/us-treasury-sanctions-irans-largest-crypto-exchange-nobitex-along-with-three-other-iranian-platforms-under-economic-fury-campaign/"},{"credibility":1,"name":"The Block: Nobitex Founded by Sons of Elite Political Family Tied to Supreme Leaders (Reuters)","type":"news_article","url":"https://www.theblock.co/amp/post/399784/leading-iranian-crypto-exchange-nobitex-was-founded-by-sons-of-elite-political-family-tied-to-supreme-leaders-reuters"},{"credibility":2,"name":"Crypto Times: Israeli Hackers Leak Nobitex Source Code After $100M Crypto Heist","type":"news_article","url":"https://www.cryptotimes.io/2025/06/19/israeli-hackers-leak-nobitex-source-code-after-100m-crypto-heist/"},{"credibility":2,"name":"Cryptopolitan: Pro-Israel Hacker Releases Nobitex's Source Code","type":"news_article","url":"https://www.cryptopolitan.com/israel-hacker-releases-nobitexs-source-code/"},{"credibility":2,"name":"Crystal Intelligence: Crypto Sanctions Screening — OFAC Targets Iran Exchanges","type":"research","url":"https://crystalintelligence.com/sanctions/crypto-sanctions-screening-ofac-targets-iran-exchanges/"},{"credibility":2,"name":"BleepingComputer: U.S. Sanctions Nobitex Crypto Exchange Used by Ransomware","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/the-us-sanctions-nobitex-crypto-exchange-used-by-ransomware/"}],"summary":"On June 2, 2026, the U.S. Treasury's Office of Foreign Assets Control (OFAC) designated four Iranian cryptocurrency exchanges — Nobitex, Wallex, Bitpin, and Ramzinex — on the Specially Designated Nationals (SDN) list under Executive Orders 13224 and 13902 as part of the Trump administration's 'Economic Fury' maximum pressure campaign against Iran. The four exchanges collectively processed approximately $7.7 billion in 2025, representing roughly 78% of Iran's attributed crypto volume, and allegedly facilitated terror finance, sanctions evasion, IRGC-linked ransomware payments, and the Iranian Central Bank's acquisition of hundreds of millions in USDT. Secondary sanctions apply, meaning any foreign financial institution transacting with these entities after June 2, 2026 risks losing U.S. dollar correspondent banking access.","timeline":[{"date":"2017-01-01","event":"Nobitex domain registered using an email address containing the Kharrazi surname, per Reuters investigation.","source":"The Block (Reuters report)","source_url":"https://www.theblock.co/amp/post/399784/leading-iranian-crypto-exchange-nobitex-was-founded-by-sons-of-elite-political-family-tied-to-supreme-leaders-reuters"},{"date":"2018-01-01","event":"Nobitex formally founded by Ali and Mohammad Kharrazi (operating under surname Aghamir). Ramzinex also founded in Tehran.","source":"U.S. Treasury / Unchained Crypto","source_url":"https://home.treasury.gov/news/press-releases/sb0519"},{"date":"2025-03-01","event":"Trump administration launches 'Economic Fury' campaign targeting Iran's financial infrastructure.","source":"Unchained Crypto","source_url":"https://unchainedcrypto.com/us-treasury-sanctions-irans-largest-crypto-exchange-nobitex-along-with-three-other-iranian-platforms-under-economic-fury-campaign/"},{"date":"2026-01-01","event":"OFAC designates Zedcex and Zedxion — UK-registered, IRGC-linked exchange stablecoin infrastructure — as the first Economic Fury enforcement layer against Iran's crypto sector.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"date":"2026-04-01","event":"OFAC freezes Central Bank of Iran cryptocurrency wallets; Tether coordinates freeze of $344.2 million in USDT as the second Economic Fury enforcement layer.","source":"TRM Labs / Scorechain","source_url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"date":"2025-06-17","event":"Predatory Sparrow (Gonjeshke Darande) hacks Nobitex, draining approximately $90–100 million from hot wallets and routing funds to inaccessible addresses.","source":"Crypto Times / TRM Labs","source_url":"https://www.cryptotimes.io/2025/06/19/israeli-hackers-leak-nobitex-source-code-after-100m-crypto-heist/"},{"date":"2025-06-19","event":"Predatory Sparrow publishes Nobitex's complete internal source code, revealing anti-surveillance modules (owshen, zpk, incentivized_mixer) and corroborating the operational role of designated individual Seyed Mohammad Aghamir.","source":"Crypto Times / TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/inside-the-nobitex-breach-what-the-leaked-source-code-reveals-about-irans-crypto-infrastructure"},{"date":"2026-06-02","event":"OFAC designates Nobitex, Wallex, Bitpin, and Ramzinex on the SDN list under E.O. 13224 and E.O. 13902, alongside four Nobitex executives. Secondary sanctions apply. Treasury Secretary Bessent cites terror finance, sanctions evasion, and IRGC material support.","source":"U.S. Treasury","source_url":"https://home.treasury.gov/news/press-releases/sb0519"},{"date":"2026-06-02","event":"OFAC publishes FAQ 1257 clarifying secondary sanctions exposure for foreign financial institutions transacting with the four designated Iranian exchanges.","source":"OFAC","source_url":"https://ofac.treasury.gov/faqs/added/2026-06-02"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision f373624c-1087-4d0f-b96f-336a9577f8a0copy