← Nobitex / Wallex / Bitpin / Ramzinexreviewed 2026-10-16 · 30 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Nobitex / Wallex / Bitpin / Ramzinex against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
4 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #3[disputed][awaiting moderator]in section: OFAC Designation — June 2, 2026
“Treasury Secretary Scott Bessent stated: 'Iran's economy is in free fall, the regime has chosen to co-opt digital asset technologies for its own corrupt agenda, including evading sanctions.'”
reviewerTreasury Secretary Bessent is quoted: 'Iran's economy is in free fall, the regime has chosen to co-opt digital asset technologies for its own corrupt agenda, including evading sanctions.'The page presents a composite/altered quotation. The middle clause is verbatim from Treasury; the opening and closing clauses do not appear in the cited source or in any other outlet's rendering of the quote.Proposed correction (not yet applied)Treasury Secretary Scott Bessent stated: 'the regime has chosen to co-opt digital asset technologies for its own corrupt agenda.' - #12[disputed][awaiting moderator]in section: On-Chain Risk Profile and Stablecoin Exposure
“Elliptic's analysis also identified exposure to sanctioned Russian exchanges Garantex and Grinex, as well as multiple Kyrgyzstan-registered entities likely affiliated with Garantex.”
reviewerElliptic's analysis identified exposure to sanctioned Russian exchanges Garantex and Grinex, and multiple Kyrgyzstan-registered entities affiliated with Garantex.The Garantex link to Nobitex is real and well-sourced, but Grinex and the Kyrgyzstan-registered entities appear to be an unrelated Russia-sanctions-evasion story that has been conflated into the Nobitex narrative; no source consulted connects them to Nobitex or Iran.Proposed correction (not yet applied)Elliptic's analysis also identified exposure to the sanctioned Russian exchange Garantex. - #16[disputed][awaiting moderator]in the timeline
“2025-06-17”
reviewerPredatory Sparrow (Gonjeshke Darande) hacked Nobitex on June 17, 2025, draining $90-100 million.Multiple independent outlets (TRM Labs, Cryptopolitan, NBC News, Decrypt, Fortune) place the breach on Wednesday, June 18, 2025, not June 17. The page's own cited Crypto Times article also states June 18 in its body text (only its metadata/URL slug shows '17').Proposed correction (not yet applied)2025-06-18 - #17[disputed][awaiting moderator]in section: June 2025 Predatory Sparrow Hack and Source Code Leak
“Two days after the breach, Predatory Sparrow published Nobitex's complete internal source code, deployment architecture, and security documentation.”
reviewerTwo days after the breach, Predatory Sparrow published Nobitex's complete internal source code.This 'two days' framing follows from the same incorrect June 17 breach date used in the timeline; the breach-to-leak gap was actually one day (June 18 to June 19, both independently confirmed dates).Proposed correction (not yet applied)One day after the breach, Predatory Sparrow published Nobitex's complete internal source code, deployment architecture, and security documentation.
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #9[unverifiable][awaiting moderator]in section: Nobitex — Scale, Ownership, and Regime Connections
“OFAC designated Seyed Mohammad Aghamir specifically for his role as blockchain lead: he authored Nobitex's address-validation software governing deposits and withdrawals and updated it 17 times between 2022 and 2024.”
reviewerSeyed Mohammad Aghamir authored Nobitex's address-validation software and updated it 17 times between 2022 and 2024; the June 2025 leaked code corroborated his operational role.The general role is well supported, but the specific '17 updates between 2022 and 2024' detail could not be verified against any source consulted. - #13[unverifiable][awaiting moderator]in section: Terror Finance and IRGC-Linked Transactions
“Outflows from Nobitex were reported to have surged within minutes of U.S.-Israeli strikes on Iranian targets and continued during Iran's internet blackouts, which analysts characterized as consistent with regime asset-protection operations.”
reviewerOutflows from Nobitex surged within minutes of U.S.-Israeli strikes on Iranian targets and continued during Iran's internet blackouts, consistent with regime asset-protection operations.Plausible given reporting on Nobitex continuing to process transactions during blackouts (per a separate May 2026 Reuters item), but the precise 'within minutes' framing could not be independently verified.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #5[partially supported][awaiting moderator]in section: OFAC Designation — June 2, 2026
“Treasury reported seizing approximately $1 billion in cryptocurrency from Iranian exchanges and wallets since the Economic Fury campaign began in March 2025.”
reviewerTreasury reported seizing approximately $1 billion in cryptocurrency from Iranian exchanges and wallets since the Economic Fury campaign began in March 2025.The $1B figure is real and attributable to Treasury Secretary Bessent, and is directly supported by the Unchained Crypto citation, but it does not come from the sb0519 press release also cited for this sentence, which gives a materially smaller figure. - #18[partially supported][awaiting moderator]in section: June 2025 Predatory Sparrow Hack and Source Code Leak
“Approximately $55 million remained recoverable as USDT.”
reviewerApproximately $55 million of the stolen funds remained recoverable as USDT.The $55M USDT figure is roughly consistent with one analyst's estimate, but 'remained recoverable' overstates a conditional, speculative statement as settled fact; no stablecoin issuer action was reported.
confirmed
22 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: OFAC Designation — June 2, 2026
“On June 2, 2026, OFAC designated Nobitex, Wallex, Bitpin, and Ramzinex under Executive Order 13224 (counterterrorism, for alleged IRGC material support) and Executive Order 13902 (Iranian financial sector).”
reviewerOn June 2, 2026, OFAC designated Nobitex, Wallex, Bitpin, and Ramzinex on the SDN list under E.O. 13224 and E.O. 13902.Core designation facts are accurately reported. - #2[confirmed][no action needed]in section: OFAC Designation — June 2, 2026
“Four individuals associated with Nobitex were also designated: Amir Hossein Rad (chairman, co-founder, former CEO), Seyed Ali Khoee (current CEO), Seyed Mohammad Ali Aghamir (co-founder, identified by Reuters as a member of the Kharrazi family), and Seyed Mohammad Aghamir (co-founder and blockchain lead, also Kharrazi family).”
reviewerFour individuals associated with Nobitex were designated: Amir Hossein Rad, Seyed Ali Khoee, Seyed Mohammad Ali Aghamir, and Seyed Mohammad Aghamir.Names and roles match the primary source. - #4[confirmed][no action needed]in section: OFAC Designation — June 2, 2026
“This is described by TRM Labs as the third enforcement layer in five months, following designations of UK-registered exchange infrastructure in January 2026 and the freezing of Central Bank of Iran wallets in April 2026.”
reviewerThe June 2026 action is the third enforcement layer in five months, following January 2026 (Zedcex/Zedxion) and April 2026 (CBI wallet freeze).Matches the cited TRM Labs analysis. - #6[confirmed][no action needed]in section: Nobitex — Scale, Ownership, and Regime Connections
“It processed over 50% of all Iranian digital asset inflows in 2025, representing a 2025 volume of approximately $4.7 billion according to TRM Labs.”
reviewerNobitex processed over 50% of Iranian digital asset inflows in 2025, approximately $4.7 billion, per TRM Labs.Figure matches cited source. - #7[confirmed][no action needed]in section: Nobitex — Scale, Ownership, and Regime Connections
“Reuters reported that the Nobitex domain was registered in 2017 using an email address containing the Kharrazi surname, and that co-founders Ali and Mohammad Kharrazi (who used the surname Aghamir in public filings) belong to one of the most politically connected families in the Islamic Republic.”
reviewerReuters: Nobitex domain registered in 2017 with an email containing the Kharrazi surname; co-founders Ali and Mohammad Kharrazi (publicly using surname Aghamir) belong to a politically connected family whose father allegedly founded Iran's Hezbollah and helped create the IRGC.Matches the Reuters reporting closely. - #8[confirmed][no action needed]in section: Nobitex — Scale, Ownership, and Regime Connections
“Open-source investigations cited by Elliptic linked major Nobitex shareholders to individuals with ties to Seyed Mohammad Baqer Kharazi (a relative of Iran's Supreme Leader) and Mohsen Rezaee Mirqaed (a founding IRGC commander).”
reviewerOpen-source investigations cited by Elliptic linked Nobitex shareholders to Seyed Mohammad Baqer Kharazi (relative of Iran's Supreme Leader) and Mohsen Rezaee Mirqaed (founding IRGC commander).Confirmed, with the nuance that Mirqaed is linked via Kharazi rather than directly to a shareholder, which the page's wording ('individuals with ties to') adequately captures. - #10[confirmed][no action needed]in section: Nobitex — Scale, Ownership, and Regime Connections
“Nobitex denied any government affiliation in a statement to Reuters and characterized illicit funds moving through the platform as a 'very small fraction of overall volume' occurring without management's awareness.”
reviewerNobitex denied government affiliation to Reuters, calling illicit flows a 'very small fraction of overall volume' occurring without management's awareness.Matches cited source. - #11[confirmed][no action needed]in section: Terror Finance and IRGC-Linked Transactions
“OFAC alleged that Nobitex facilitated transactions for IRGC-affiliated ransomware actors and processed at least $2.3 billion in sanctioned entity transactions since 2023.”
reviewerNobitex processed at least $2.3 billion in sanctioned entity transactions since 2023; Hamas, DPRK-affiliated, Syrian-based actors and Garantex wallet-level interactions identified by Elliptic.Both the dollar figure and the illicit-actor exposure are independently confirmed. - #14[confirmed][no action needed]in section: Wallex, Bitpin, and Ramzinex — Individual Profiles
“Wallex is Iran's second-largest digital asset exchange by volume and received approximately 12% of all Iranian digital asset inflows in 2025, representing approximately $1.45 billion in annual volume per TRM Labs.”
reviewerWallex (12% / ~$1.45B), Bitpin (10% / ~$821M, Anzali Free Zone), Ramzinex (founded Tehran 2018, $2.45B lifetime, ~$739M 2025) -- individual exchange profiles.All per-exchange figures and the Anzali Free Zone detail check out against TRM Labs and OFAC's own listing. - #15[confirmed][no action needed]in section: Wallex, Bitpin, and Ramzinex — Individual Profiles
“Combined, the four exchanges processed roughly $7.7 billion — approximately 78% of Iran's attributed 2025 crypto volume — according to TRM Labs.”
reviewerCombined, the four exchanges processed roughly $7.7 billion -- approximately 78% of Iran's attributed 2025 crypto volume -- per TRM Labs.Figure matches cited source exactly. - #19[confirmed][no action needed]in section: June 2025 Predatory Sparrow Hack and Source Code Leak
“Iran's central bank responded by restricting crypto exchange operating hours to 10 a.m.–8 p.m.”
reviewerIran's central bank responded to the hack by restricting crypto exchange operating hours to 10 a.m.-8 p.m.Confirmed by independent reporting, though a minority of outlets give a 9pm close instead of 8pm. - #20[confirmed][no action needed]in section: June 2025 Predatory Sparrow Hack and Source Code Leak
“The leaked code revealed anti-surveillance modules including components named 'owshen,' 'zpk,' and 'incentivized_mixer,' designed for stealth address generation, transaction batching, output splitting, and real-time endpoint switching — capabilities consistent with deliberate blockchain intelligence evasion.”
reviewerThe leaked code revealed anti-surveillance modules named 'owshen,' 'zpk,' and 'incentivized_mixer' for stealth addressing, batching, output splitting, and endpoint switching.Confirmed, though the page omits TRM's caveat that it is unclear whether these modules were fully deployed in production. - #21[confirmed][no action needed]in section: Secondary Sanctions and Compliance Obligations
“OFAC FAQ 1257, added June 2, 2026, clarifies that the secondary sanctions exposure extends to entities providing material support or services to the designated exchanges, regardless of where the institution operates.”
reviewerOFAC FAQ 1257, added June 2, 2026, clarifies secondary sanctions exposure extends to entities providing material support regardless of where they operate.Confirmed against the primary regulatory source. - #22[confirmed][no action needed]in section: Secondary Sanctions and Compliance Obligations
“Compliance teams are required to update screening systems with new SDN addresses, block and report designated assets within 10 business days, and apply the 'fifty percent rule' to automatically block entities in which designated persons hold 50% or more ownership.”
reviewerCompliance teams must block and report designated assets within 10 business days and apply the 'fifty percent rule.'Confirmed via the Scorechain source, though FAQ 1257 itself (the other cited source for this section) does not independently state these two rules. - #23[confirmed][no action needed]in section: Terror Finance and IRGC-Linked Transactions
“The Central Bank of Iran allegedly acquired at least $507 million in USDT, with the majority routed through Nobitex until mid-2025, to support the declining rial.”
reviewerCentral Bank of Iran acquired at least $507 million in USDT, majority routed through Nobitex until mid-2025.Matches cited source exactly. - #24[confirmed][no action needed]in section: Economic Fury Campaign Context
“January 2026 — designation of Zedcex and Zedxion, UK-registered entities providing exchange-branded stablecoin infrastructure with IRGC connections, with approximately $1 billion in routed funds”
reviewerZedcex and Zedxion (UK-registered, IRGC-linked) designated January 2026 as the first Economic Fury enforcement layer, with approximately $1 billion routed through the platform.Matches cited source. - #25[confirmed][no action needed]in section: Economic Fury Campaign Context
“April 2026 — freezing of Central Bank of Iran cryptocurrency wallets, including a coordinated Tether freeze of $344.2 million in USDT as the second Economic Fury enforcement layer”
reviewerApril 2026: OFAC froze Central Bank of Iran wallets, with a coordinated Tether freeze of $344.2 million in USDT, as the second enforcement layer.Matches cited source within rounding ($344M vs $344.2M). - #26[confirmed][no action needed]in section: Economic Fury Campaign Context
“Treasury also warned during the June 2026 action of sanctions risks for entities complying with Iranian demands for passage fees through the Strait of Hormuz, including payments via cryptocurrency, fiat, or in-kind transfers.”
reviewerTreasury warned of sanctions risk for entities paying Iranian demands for Strait of Hormuz passage fees, via crypto, fiat, or in-kind transfers.Confirmed. - #27[confirmed][no action needed]in section: Economic Fury Campaign Context
“Iran recorded approximately $9.9 billion in attributed crypto volume in 2025, despite a decade of international sanctions.”
reviewerIran recorded approximately $9.9 billion in attributed crypto volume in 2025.Matches cited source exactly. - #28[confirmed][no action needed]in section: Designated Individuals
“No individuals from Wallex, Bitpin, or Ramzinex were named in the initial designation.”
reviewerNo individuals from Wallex, Bitpin, or Ramzinex were named in the initial designation.Confirmed against OFAC's own SDN listing. - #29[confirmed][no action needed]in section: On-Chain Risk Profile and Stablecoin Exposure
“According to Elliptic, the four sanctioned exchanges have collectively sent or received cryptoasset transactions totaling at least $40 billion in their operational history.”
reviewerThe four sanctioned exchanges collectively sent or received at least $40 billion in cryptoasset transactions in their operational history, per Elliptic.Confirmed; correctly distinguished from the 2025-only annual volume figures elsewhere on the page. - #30[confirmed][no action needed]in section: On-Chain Risk Profile and Stablecoin Exposure
“Blockchain analytics firms including Elliptic, Chainalysis, TRM Labs, and Crystal Intelligence have all flagged these entities as high-risk and updated their compliance screening tools following the June 2 designations.”
reviewerBlockchain analytics firms Elliptic, Chainalysis, TRM Labs, and Crystal Intelligence all flagged these entities as high-risk and updated compliance screening tools following the June 2 designations.Each named firm published its own analysis of the designations, consistent with the claim; exact timing of screening-tool updates relative to June 2 was not independently confirmed for each firm.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.