Verify a decision

{"actor":"system:backfill","investigation_id":"8b163075-7fa4-4c47-8b19-f374566ce84f","kind":"publish","page_slug":"iranian-crypto-exchanges-ofac-designation-nobitex-wallex-bitpin-ramzinex-june-2026","published_at":"2026-06-08T02:45:24.590Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Iranian Crypto Exchanges OFAC Designation — Nobitex, Wallex, Bitpin, Ramzinex (June 2026)","sections":[{"content":"On June 2, 2026, OFAC formally designated Nobitex, Wallex, Bitpin, and Ramzinex under Executive Order 13224 (counterterrorism authority, as amended) and Executive Order 13902 (targeting persons operating in the financial sector of Iran's economy), as well as the National Defense Authorization Act for Fiscal Year 2012. The action was framed under the Trump administration's 'Operation Economic Fury' campaign and described by Treasury Secretary Scott Bessent as part of a strategy to 'follow the money' through banking and digital assets. Bessent stated: 'While Iran's economy is in free fall, the regime has chosen to co-opt digital asset technologies for its corrupt agenda.' The designation adds these entities to the SDN list, prohibiting U.S. persons and dollar-system participants from transacting with them, and triggers secondary sanctions exposure for non-U.S. financial institutions under E.O. 13902. Any entity owned 50 percent or more by a designated person is automatically blocked even if not explicitly named.","heading":"Regulatory Action — June 2, 2026 SDN Designations","severity":"critical","sources":[{"credibility":1,"name":"U.S. Department of the Treasury Press Release: Economic Fury Targets Iran's Largest Digital Asset Exchange","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0519"},{"credibility":2,"name":"TRM Labs: Three Enforcement Layers in Five Months","type":"research","url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"credibility":2,"name":"Elliptic: OFAC sanctions Nobitex and three other Iranian cryptoasset exchanges","type":"research","url":"https://www.elliptic.co/blog/ofac-sanctions-nobitex-and-three-other-iranian-cryptoasset-exchanges"}]},{"content":"Nobitex is Iran's largest cryptocurrency exchange, alleged by OFAC and confirmed by multiple blockchain analytics firms to have processed more than 50 percent of all Iranian digital asset inflows in 2025, representing approximately $4.7 billion in volume. OFAC alleged that Nobitex processed hundreds of millions of dollars in stablecoin transfers to assist the Central Bank of Iran in propping up the collapsing Iranian rial, facilitated payments for IRGC-affiliated ransomware actors, and enabled regime insiders to move wealth outside the country during internet blackouts and military operations. Elliptic's on-chain analysis found that the four sanctioned exchanges collectively processed at least $40 billion in lifetime cryptoasset transactions, with Nobitex as the dominant actor. Until approximately June 2025, the Central Bank of Iran routed USDT purchases — totaling at least $507 million according to Elliptic's January 2026 report — primarily through Nobitex before those flows shifted to cross-chain bridge services following a significant security breach. OFAC designated four Nobitex executives individually: Amir Hossein Rad (chairman, co-founder, and former CEO), Seyed Ali Khoee (current CEO), Seyed Mohammad Ali Aghamir Mohammad Ali (co-founder and blockchain lead), and Seyed Mohammad Aghamir Mohammad Ali (co-founder). The Aghamir co-founders are alleged members of the Kharrazi family, described by Reuters as one of the Islamic Republic's most influential dynasties, with marriage connections to all three of Iran's supreme leaders beginning with Ayatollah Khomeini. OFAC noted the founders used an alternative family name to conceal this affiliation.","heading":"Nobitex — Primary Target","severity":"critical","sources":[{"credibility":1,"name":"U.S. Department of the Treasury Press Release: Economic Fury Targets Iran's Largest Digital Asset Exchange","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0519"},{"credibility":2,"name":"Chainalysis: OFAC Sanctions Nobitex and Major Iranian Cryptocurrency Exchanges","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-iranian-crypto-exchanges-june-2026/"},{"credibility":2,"name":"Elliptic: Central Bank of Iran has acquired at least $507 million in USDT","type":"research","url":"https://www.elliptic.co/blog/iran-has-acquired-us-dollar-stablecoins-worth-at-least-half-a-billion-dollars"},{"credibility":2,"name":"TRM Labs: Three Enforcement Layers in Five Months","type":"research","url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"credibility":2,"name":"Elliptic: OFAC sanctions Nobitex and three other Iranian cryptoasset exchanges","type":"research","url":"https://www.elliptic.co/blog/ofac-sanctions-nobitex-and-three-other-iranian-cryptoasset-exchanges"}]},{"content":"Wallex is Iran's second-largest digital asset exchange by 2025 volume, having received an alleged 12 percent of all Iranian digital asset inflows in 2025 (approximately $1.45 billion). OFAC alleged Wallex facilitated numerous transactions linked to the IRGC. A May 2026 Reuters investigation cited by multiple outlets alleged the platform had processed at least $2.3 billion since 2023 for sanctioned Iranian entities. Bitpin, the third-largest exchange, accounted for an alleged 10 percent of Iranian digital asset inflows in 2025 (approximately $821 million) and allegedly processed millions of dollars in transactions linked to the IRGC; its investors were further alleged to be connected to Iranian sanctions evasion efforts. Ramzinex, a Tehran-based exchange founded in 2018, processed an alleged $2.45 billion in lifetime transactions, including activity tied to the IRGC and a government-backed Iranian financial institution. All three exchanges are alleged to have transacted with previously-designated Iranian entities and proxies including the IRGC, Hamas, and the Central Bank of Iran.","heading":"Wallex, Bitpin, and Ramzinex — Co-Designated Exchanges","severity":"critical","sources":[{"credibility":1,"name":"U.S. Department of the Treasury Press Release: Economic Fury Targets Iran's Largest Digital Asset Exchange","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0519"},{"credibility":2,"name":"TRM Labs: Three Enforcement Layers in Five Months","type":"research","url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"credibility":2,"name":"Chainalysis: OFAC Sanctions Nobitex and Major Iranian Cryptocurrency Exchanges","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-iranian-crypto-exchanges-june-2026/"}]},{"content":"Blockchain analytics firm Elliptic published a report on January 21, 2026, documenting that the Central Bank of Iran had acquired at least $507 million in USDT stablecoin, with funds routed primarily through Nobitex until approximately June 2025. Leaked documents detailed purchases denominated in UAE dirhams in April and May 2025. Following the June 2025 Nobitex breach, the CBI shifted routing to cross-chain bridge services to move funds from the TRON blockchain to Ethereum, with subsequent conversion through decentralized exchanges continuing through year-end 2025. On April 24, 2026, OFAC updated its existing 2019 CBI designation by adding two TRON-network wallet addresses — TTiDLWE6fZK8okMJv6ijg42yrH6W2pjSr9 and TNiq9AXBp9EjUqhDhrwrfvAA8U3GUQZH81 — to the SDN list. Tether coordinated with U.S. law enforcement to freeze a combined $344 million in USDT held across those two addresses on the same day as the designation, representing the largest known on-chain freeze of Iranian sovereign crypto reserves on public record. The IRGC-Qods Force and Hezbollah were identified as the ultimate beneficial controllers of those wallets. By the time of the June 2026 designations, Treasury stated it had frozen nearly $500 million in regime-linked cryptocurrency through the cumulative enforcement campaign.","heading":"On-Chain Context — Central Bank of Iran and Stablecoin Operations","severity":"critical","sources":[{"credibility":2,"name":"Elliptic: Central Bank of Iran has acquired at least $507 million in USDT","type":"research","url":"https://www.elliptic.co/blog/iran-has-acquired-us-dollar-stablecoins-worth-at-least-half-a-billion-dollars"},{"credibility":2,"name":"Chainalysis: OFAC Updates Central Bank of Iran Designation — April 2026","type":"research","url":"https://www.chainalysis.com/blog/central-bank-of-iran-designation-ofac-update-april-2026/"},{"credibility":2,"name":"TRM Labs: OFAC Sanctions Crypto Addresses Associated with the Central Bank of Iran, Freezes $344M","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-sanctions-crypto-addresses-associated-with-the-central-bank-of-iran-freezes-usd-344-million"},{"credibility":2,"name":"CoinDesk: Iran's Central Bank Bought $507M USDT to Underpin Rial","type":"news_article","url":"https://www.coindesk.com/business/2026/01/21/iran-s-central-bank-bought-usd507-million-usdt-to-underpin-rial-report-finds"}]},{"content":"The June 2026 action was the third wave of a five-month coordinated enforcement campaign. On January 30, 2026, OFAC designated Zedcex Exchange Ltd and Zedxion Exchange Ltd — two UK-registered entities — along with Iranian financier Babak Morteza Zanjani, in what Treasury described as the first-ever designation of an IRGC-linked digital asset exchange. TRM Labs documented that the two exchanges functioned as unified USDT clearing infrastructure for approximately $1 billion in IRGC-linked stablecoin flows between 2023 and 2025, and that more than $10 million in USDT was transferred to Houthi financier Sa'id Ahmad Muhammad al-Jamal in late 2024. Activity primarily involved USDT on the TRON blockchain. Six high-volume wallet addresses were designated alongside the corporate entities.","heading":"Prior Enforcement — January 2026 Zedcex and Zedxion Designations","severity":"high","sources":[{"credibility":2,"name":"TRM Labs: OFAC Sanctions Zedcex and Zedxion — First-Ever IRGC-Linked Exchange Designation","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-sanctions-zedcex-and-zedxion-in-first-ever-designation-of-an-irgc-linked-digital-asset-exchange"},{"credibility":2,"name":"Elliptic: OFAC sanctions exchanges Zedcex and Zedxion","type":"research","url":"https://www.elliptic.co/blog/ofac-sanctions-exchanges-zedcex-and-zedxion-for-assisting-in-iranian-sanctions-evasion-and-irgc-operations"},{"credibility":2,"name":"Chainalysis: OFAC Designates Iranian-Linked Crypto Exchanges — January 2026","type":"research","url":"https://www.chainalysis.com/blog/ofac-designates-iranian-crypto-exchanges-january-2026/"}]},{"content":"On June 18, 2025, Nobitex suffered a security breach attributed to the pro-Israel hacktivist group Gonjeshke Darande (also known as Predatory Sparrow), resulting in the loss of more than $90 million across multiple cryptocurrencies including Bitcoin, Ethereum, Dogecoin, Ripple, Solana, TRON, and TON. Unlike typical financially motivated crypto thefts, the stolen funds were sent to inaccessible vanity addresses bearing anti-IRGC messaging rather than being laundered for profit. The root cause was assessed by security researchers as compromised private keys. Gonjeshke Darande characterized Nobitex as 'at the heart of the regime's efforts to finance terror worldwide.' The breach preceded a shift in the Central Bank of Iran's USDT routing away from Nobitex toward cross-chain bridge infrastructure, as documented by Elliptic. CNBC, PBS NewsHour, and Elliptic all reported on the incident at the time.","heading":"Nobitex Security Breach — June 2025","severity":"high","sources":[{"credibility":1,"name":"CNBC: Pro-Israel hackers destroy $90 million in Iran crypto exchange breach","type":"news_article","url":"https://www.cnbc.com/2025/06/18/pro-israel-hackers-iran-crypto.html"},{"credibility":2,"name":"Elliptic: Iranian crypto exchange Nobitex hacked for over $90 million by pro-Israel group","type":"research","url":"https://www.elliptic.co/blog/iranian-crypto-exchange-nobitex-hacked-pro-israel-group"},{"credibility":1,"name":"PBS NewsHour: Hackers reportedly wipe out $90 million from largest Iranian cryptocurrency exchange","type":"news_article","url":"https://www.pbs.org/newshour/world/hackers-reportedly-wipe-out-90-million-from-largest-iranian-cryptocurrency-exchange"},{"credibility":2,"name":"Chainalysis: The $90M Nobitex Exploit — June 2025","type":"research","url":"https://www.chainalysis.com/blog/nobitex-iranian-exchange-exploit-june-2025/"}]},{"content":"The June 2026 designations carry explicit secondary sanctions exposure under E.O. 13902 for any foreign financial institution that conducts significant transactions with the named exchanges. Blockchain compliance firm GlobalLedger and TRM Labs both noted that the addition of counterterrorism authority (E.O. 13224) beyond the pre-existing Iran financial-sector blocking authority (E.O. 13902) materially escalates the designation severity and widens the universe of potentially sanctionable counterparties. The State Department simultaneously announced a $15 million reward under the Rewards for Justice program for information enabling disruption of IRGC financial operations, indicating continued investigative posture. Any entity interacting with Nobitex, Wallex, Bitpin, or Ramzinex — or any entity 50 percent or more owned by the individually named designees — is subject to automatic blocking under OFAC's 50 percent rule, whether or not that entity appears explicitly on the SDN list.","heading":"Compliance and Secondary Sanctions Risk","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: Three Enforcement Layers in Five Months","type":"research","url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"credibility":2,"name":"GlobalLedger: OFAC Nobitex Iranian Crypto Exchanges Compliance Brief","type":"research","url":"https://blog.globalledger.io/research-investigations/ofac-nobitex-iranian-crypto-exchanges"},{"credibility":1,"name":"U.S. Department of the Treasury Press Release: Economic Fury Targets Iran's Largest Digital Asset Exchange","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0519"}]},{"content":"According to data aggregated by TRM Labs and Chainalysis, Iran's total attributed cryptocurrency volume in 2025 reached approximately $9.9 billion. The four exchanges designated on June 2, 2026, collectively represented approximately $7.78 billion of that total — roughly 78 percent of the country's attributed crypto volume. Nobitex alone accounted for $4.7 billion (approximately 47 percent of the national total). By the time of the June designations, OFAC-coordinated enforcement actions had frozen nearly $500 million in regime-linked cryptocurrency, with $344 million frozen in the April 2026 CBI wallet action alone. Elliptic's cumulative analysis placed the four exchanges' all-time transaction volume at a combined minimum of $40 billion. CoinDesk reported the action as part of 'an ongoing war against the country,' citing the continued cat-and-mouse dynamic in which Iran shifted USDT routing to bridges and decentralized exchanges after each enforcement action.","heading":"Scale of Iran's Crypto Economy and Enforcement Impact","severity":"high","sources":[{"credibility":2,"name":"TRM Labs: Three Enforcement Layers in Five Months","type":"research","url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"credibility":2,"name":"Chainalysis: OFAC Sanctions Nobitex and Major Iranian Cryptocurrency Exchanges","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-iranian-crypto-exchanges-june-2026/"},{"credibility":2,"name":"CoinDesk: U.S. sanctions Iranian crypto exchanges in ongoing war against the country","type":"news_article","url":"https://www.coindesk.com/policy/2026/06/02/u-s-sanctions-iranian-crypto-exchanges-in-ongoing-war-against-country"},{"credibility":2,"name":"Elliptic: OFAC sanctions Nobitex and three other Iranian cryptoasset exchanges","type":"research","url":"https://www.elliptic.co/blog/ofac-sanctions-nobitex-and-three-other-iranian-cryptoasset-exchanges"}]}],"sources_used":[{"credibility":1,"name":"U.S. Department of the Treasury Press Release: Economic Fury Targets Iran's Largest Digital Asset Exchange","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0519"},{"credibility":2,"name":"Chainalysis: OFAC Sanctions Nobitex and Major Iranian Cryptocurrency Exchanges in Sweeping Evasion Crackdown","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-iranian-crypto-exchanges-june-2026/"},{"credibility":2,"name":"TRM Labs: Three Enforcement Layers in Five Months: OFAC Designates Iran's Domestic Crypto Exchanges","type":"research","url":"https://www.trmlabs.com/resources/blog/three-enforcement-layers-in-five-months-ofac-designates-irans-domestic-crypto-exchanges"},{"credibility":2,"name":"Elliptic: OFAC sanctions Nobitex and three other Iranian cryptoasset exchanges","type":"research","url":"https://www.elliptic.co/blog/ofac-sanctions-nobitex-and-three-other-iranian-cryptoasset-exchanges"},{"credibility":2,"name":"CoinDesk: U.S. sanctions Iranian crypto exchanges in ongoing war against the country","type":"news_article","url":"https://www.coindesk.com/policy/2026/06/02/u-s-sanctions-iranian-crypto-exchanges-in-ongoing-war-against-country"},{"credibility":2,"name":"Chainalysis: OFAC Updates Central Bank of Iran Designation Following Tether Seizure — April 2026","type":"research","url":"https://www.chainalysis.com/blog/central-bank-of-iran-designation-ofac-update-april-2026/"},{"credibility":2,"name":"TRM Labs: OFAC Sanctions Crypto Addresses Associated with the Central Bank of Iran, Freezes $344M","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-sanctions-crypto-addresses-associated-with-the-central-bank-of-iran-freezes-usd-344-million"},{"credibility":2,"name":"Elliptic: Central Bank of Iran has acquired at least $507 million in USDT","type":"research","url":"https://www.elliptic.co/blog/iran-has-acquired-us-dollar-stablecoins-worth-at-least-half-a-billion-dollars"},{"credibility":2,"name":"CoinDesk: Iran's Central Bank Bought $507M USDT to Underpin Rial","type":"news_article","url":"https://www.coindesk.com/business/2026/01/21/iran-s-central-bank-bought-usd507-million-usdt-to-underpin-rial-report-finds"},{"credibility":2,"name":"TRM Labs: OFAC Sanctions Zedcex and Zedxion — First-Ever IRGC-Linked Exchange Designation","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-sanctions-zedcex-and-zedxion-in-first-ever-designation-of-an-irgc-linked-digital-asset-exchange"},{"credibility":2,"name":"Elliptic: OFAC sanctions exchanges Zedcex and Zedxion","type":"research","url":"https://www.elliptic.co/blog/ofac-sanctions-exchanges-zedcex-and-zedxion-for-assisting-in-iranian-sanctions-evasion-and-irgc-operations"},{"credibility":2,"name":"Chainalysis: OFAC Designates Iranian-Linked Crypto Exchanges — January 2026","type":"research","url":"https://www.chainalysis.com/blog/ofac-designates-iranian-crypto-exchanges-january-2026/"},{"credibility":1,"name":"CNBC: Pro-Israel hackers destroy $90 million in Iran crypto exchange breach","type":"news_article","url":"https://www.cnbc.com/2025/06/18/pro-israel-hackers-iran-crypto.html"},{"credibility":1,"name":"PBS NewsHour: Hackers reportedly wipe out $90 million from largest Iranian cryptocurrency exchange","type":"news_article","url":"https://www.pbs.org/newshour/world/hackers-reportedly-wipe-out-90-million-from-largest-iranian-cryptocurrency-exchange"},{"credibility":2,"name":"Elliptic: Iranian crypto exchange Nobitex hacked for over $90 million by pro-Israel group","type":"research","url":"https://www.elliptic.co/blog/iranian-crypto-exchange-nobitex-hacked-pro-israel-group"},{"credibility":2,"name":"Chainalysis: The $90M Nobitex Exploit — June 2025","type":"research","url":"https://www.chainalysis.com/blog/nobitex-iranian-exchange-exploit-june-2025/"},{"credibility":2,"name":"GlobalLedger: OFAC Nobitex Iranian Crypto Exchanges Compliance Brief","type":"research","url":"https://blog.globalledger.io/research-investigations/ofac-nobitex-iranian-crypto-exchanges"},{"credibility":1,"name":"OFAC Iran Sanctions Program Page","type":"regulatory","url":"https://ofac.treasury.gov/sanctions-programs-and-country-information/iran-sanctions"}],"summary":"On June 2, 2026, the U.S. Treasury's Office of Foreign Assets Control (OFAC) added four Iranian cryptocurrency exchanges — Nobitex, Wallex, Bitpin, and Ramzinex — to the Specially Designated Nationals (SDN) list under counterterrorism and Iran financial-sector authorities, representing the Treasury Department's largest single enforcement action to date against Iran's digital asset economy. The four exchanges collectively handled approximately 78 percent of Iran's attributed 2025 crypto volume, totaling roughly $7.78 billion, and were alleged to have facilitated sanctions evasion, terrorist financing for the IRGC, and support for other U.S.-designated entities including Hamas. The action forms the third layer of a five-month OFAC enforcement campaign that began in January 2026 and has frozen nearly $500 million in regime-linked cryptocurrency.","timeline":[{"date":"2019-01-01","event":"OFAC originally designates the Central Bank of Iran for providing billions of dollars to the IRGC and Hezbollah.","source":"Chainalysis / OFAC","source_url":"https://www.chainalysis.com/blog/central-bank-of-iran-designation-ofac-update-april-2026/"},{"date":"2025-06-18","event":"Pro-Israel hacktivist group Gonjeshke Darande (Predatory Sparrow) breaches Nobitex, destroying over $90 million across multiple cryptocurrencies. Stolen funds sent to vanity addresses bearing anti-IRGC messages.","source":"CNBC / Elliptic / Chainalysis","source_url":"https://www.cnbc.com/2025/06/18/pro-israel-hackers-iran-crypto.html"},{"date":"2026-01-21","event":"Elliptic publishes report documenting Central Bank of Iran's acquisition of at least $507 million in USDT, routed primarily through Nobitex until June 2025, then shifted to cross-chain bridges.","source":"Elliptic","source_url":"https://www.elliptic.co/blog/iran-has-acquired-us-dollar-stablecoins-worth-at-least-half-a-billion-dollars"},{"date":"2026-01-30","event":"OFAC designates Zedcex Exchange Ltd, Zedxion Exchange Ltd, and Babak Morteza Zanjani — described as the first-ever designation of an IRGC-linked digital asset exchange. Six TRON-network wallet addresses designated alongside the entities.","source":"TRM Labs / Elliptic / Chainalysis","source_url":"https://www.trmlabs.com/resources/blog/ofac-sanctions-zedcex-and-zedxion-in-first-ever-designation-of-an-irgc-linked-digital-asset-exchange"},{"date":"2026-04-24","event":"OFAC updates its 2019 Central Bank of Iran designation, adding two TRON wallet addresses (TTiDLWE6fZK8okMJv6ijg42yrH6W2pjSr9 and TNiq9AXBp9EjUqhDhrwrfvAA8U3GUQZH81) to the SDN list. Tether simultaneously freezes $344 million in USDT held across those addresses in coordination with U.S. law enforcement.","source":"Chainalysis / TRM Labs / CoinDesk","source_url":"https://www.chainalysis.com/blog/central-bank-of-iran-designation-ofac-update-april-2026/"},{"date":"2026-06-02","event":"OFAC designates Nobitex, Wallex, Bitpin, and Ramzinex under E.O. 13224 and E.O. 13902, representing Treasury's largest single enforcement action against Iran's digital asset economy. Four Nobitex executives individually designated. Total prior enforcement freeze reaches nearly $500 million.","source":"U.S. Department of the Treasury / Chainalysis / TRM Labs / Elliptic / CoinDesk","source_url":"https://home.treasury.gov/news/press-releases/sb0519"}]},"v":1}