Nobitex

Overview

Nobitex is Iran’s largest cryptocurrency exchange, with approximately USD 5 billion in observed transaction volume from 2025 to March 2026 (TRM Labs). A 2026 Reuters investigation found the exchange was launched by two brothers from the politically connected Kharrazi family, who used the alternative surname “Aghamir” in corporate records, and that Nobitex accounts for the majority share of Iran’s crypto activity (Cointelegraph). In June 2025, the pro-Israel group Predatory Sparrow breached Nobitex’s hot wallet, burned roughly USD 90 million in stolen cryptocurrency, and leaked the exchange’s source code (CoinDesk).

TRM Labs identifies Amir Rad as CEO and founder, 2017 as the establishment date, and Iran as the base of operations (TRM Labs). Since 2019, TRM has observed tens of billions in total volume on the exchange, serving millions of users across Bitcoin, Ethereum, TRON, and other networks — the primary on-ramp and off-ramp between local currency and global crypto markets for many Iranians (TRM Labs).

The June 2025 hack: sabotage, not theft

On June 18, 2025, the pro-Israel hacktivist group Predatory Sparrow — operating as Gonjeshke Darande — claimed to have breached Nobitex’s hot wallet and drained more than USD 90 million (BleepingComputer). Nobitex reported the breach on X, saying it had detected unauthorized access to its hot wallet and suspended all access (BleepingComputer). Rather than cashing out, the attackers moved the funds to “vanity” wallet addresses embedded with anti-IRGC messages such as “F*ckIRGCterrorists” — addresses computationally infeasible to unlock, permanently destroying the tokens (BleepingComputer).

Elliptic co-founder Tom Robinson characterized the attack as “politically motivated sabotage rather than a financially motivated hack,” with the vanity addresses meant to send a message to Nobitex and the IRGC (CoinDesk). The group had attacked the state-owned Bank Sepah the day before, also for disruption rather than profit (BleepingComputer). On June 19 it published Nobitex’s source code and internal documentation, exposing a multi-tier custody model and VIP-transaction infrastructure for politically connected clients (TRM Labs).

Founders, regime ties, and sanctions scrutiny

A May 2026 Reuters investigation traced Nobitex to brothers Ali and Mohammad Kharrazi of the politically connected Kharrazi family, who ran the exchange under the alternative surname “Aghamir” across corporate records (Cointelegraph). Their grandfather reportedly served on the Assembly of Experts and tutored Mojtaba Khamenei; their father, Ayatollah Bagher Kharrazi, founded an Iranian political group named Hezbollah and helped staff the IRGC after the 1979 revolution (Cointelegraph). Amir Rad, who co-founded the exchange with the brothers, is not part of the family (Cointelegraph). Nobitex denied any government affiliation, calling itself a private, independent business (Cointelegraph).

TRM Labs identified Seyed Mohammad Aghamir as likely holding a senior leadership role in Nobitex’s blockchain and transaction infrastructure; US Treasury designations confirm his senior role in Iran’s cyber governance apparatus, and many senior executives have familial or personal ties to high-level regime officials (TRM Labs). TRM also found Nobitex a recurring nexus for Iranian regime-linked crypto activity — flows tied to the IRGC, sanctioned exchange Zedcex, and financiers Alireza Derakhshan and Arash Estaki Alivand — with on-chain exposure to Garantex, BitPapa, the A7 settlement platform, Hamas (via Gaza Now), and Palestinian Islamic Jihad (TRM Labs). Elliptic linked the exchange to IRGC and leadership ties and to sanctioned individuals who moved DiskCryptor and BitLocker ransomware proceeds through it (BleepingComputer).

Nobitex itself has not been directly designated: on February 14, 2024, the US Treasury sanctioned entities connected to Iran’s central bank digital currency program but did not sanction Nobitex (TRM Labs). Because Iran is a comprehensively sanctioned jurisdiction, transactions involving the exchange carry sanctions exposure regardless (TRM Labs). In September 2025, Accountable.US alleged that a wallet with a Nobitex transaction history had purchased roughly 3,468 WLFI tokens in October 2024 (Standing Record). It remains an allegation: researchers Nick Bax and MetaMask’s Taylor Monahan challenged parts of the report’s analysis, and no enforcement finding has confirmed it (Standing Record). Senators Elizabeth Warren and Jack Reed later cited the findings in a November 2025 letter asking Treasury Secretary Scott Bessent and Attorney General Pamela Bondi whether any inquiries were open into WLFI’s token sales (Standing Record).

What the top results don’t tell you: how it recovered, and the enforcement actions coverage skips

Most reporting ends with the burn and the leak, but TRM Labs’ on-chain analysis shows how Nobitex survived: volumes fell more than 70% year over year, yet service resumed in stages beginning in late June, aided partly by bitcoin reserves consolidated from previously dormant mining-linked wallets (TRM Labs). A new exchange-linked bitcoin address received approximately USD 2.7 million from more than 100 previously dormant mining wallets over 10 days after the hack, with most upstream flows tracing to the mining pools EMCD and ViaBTC — timing suggesting the funds were mobilized to carry the exchange through the crisis; the wallets had accumulated mining rewards in 2021–2022 and never moved them, with most upstream flows tracing to the large mining pools EMCD and ViaBTC — timing suggesting the funds were mobilized to carry the exchange through the crisis (TRM Labs).

Two enforcement details rarely make general coverage. First, Israel’s National Bureau for Counter Terror Financing issued Administrative Seizure Order ASO22/25 in June 2025 against two Nobitex-associated wallets (0x53b9B72DC6f96Eb4B54143B211B22e2548e4cf5c and 0xE3740C1B2FcDA407027E2c80906306604E5260e7), designating them entities of interest for terrorism financing (TRM Labs). Second, the February 2024 US Treasury action is often misread as targeting Nobitex itself; TRM’s account makes clear it named CBDC-program entities while leaving Nobitex undesignated (TRM Labs). The compliance upshot: no entity designation, but broad sanctions exposure on anything touching the exchange.

Suspect-flow estimates diverge sharply across analytics firms

Firm (as cited by Reuters)	Estimated sanctioned/suspect flows	Scope note
Elliptic	~USD 366 million	Suspect flows through Nobitex
Chainalysis	~USD 68 million	Same reporting line, different methodology
Crystal Intelligence	~USD 22 million	Direct transfers from sanctioned wallets only

The range reflects genuinely different measurement definitions, not a typo (Cointelegraph). Separately, Reuters reported that wallets associated with Iran’s central bank sent hundreds of millions in cryptocurrency to Nobitex during 2025, and the Babak Zanjani dispute exposed wallets showing at least USD 20 million in routed state funds (Cointelegraph). The stat-plus-implication: Elliptic’s USD 366 million is a ceiling over loosely defined suspect flows; Crystal Intelligence’s USD 22 million is a floor over directly sanctioned wallets — the range matters more than any single estimate.

FAQ

Is Nobitex officially sanctioned? No. The Treasury’s February 14, 2024 action named entities tied to Iran’s central bank digital currency program while leaving Nobitex off the list (TRM Labs). But because Iran is a comprehensively sanctioned jurisdiction, transactions involving the exchange carry sanctions exposure regardless (TRM Labs).

Who actually founded Nobitex? TRM Labs identifies Amir Rad as CEO and founder, with 2017 as the establishment date (TRM Labs). A 2026 Reuters investigation additionally found brothers Ali and Mohammad Kharrazi of the Kharrazi family launched it under the surname “Aghamir,” with Rad as a co-founder outside that family (Cointelegraph).

Why did the hackers burn USD 90 million instead of stealing it? The June 18, 2025 attack was politically motivated sabotage: Predatory Sparrow moved the funds to vanity addresses embedded with anti-IRGC slogans, computationally infeasible to unlock, permanently destroying the tokens (CoinDesk). The group called the exchange “the regime’s favorite sanctions violation tool,” framing the burn as punishment, not profit (BleepingComputer).

Did Nobitex survive the 2025 hack? Yes. Volumes fell more than 70% year over year after the breach, but service resumed in stages beginning in late June — partly using about USD 2.7 million in bitcoin consolidated from over 100 previously dormant mining-linked wallets (TRM Labs).

What was the WLFI allegation involving Nobitex? In September 2025, Accountable.US alleged a wallet with a Nobitex transaction history had purchased roughly 3,468 WLFI tokens in October 2024 (Standing Record). That is an allegation, not a proven link: independent researchers challenged parts of the report’s analysis, and no enforcement finding has confirmed it (Standing Record).

What this profile does not claim

• It does not claim Nobitex has been directly designated by the US, EU, or UK; the Treasury’s February 2024 action named CBDC-program entities, not the exchange itself (TRM Labs).
• It does not treat the Accountable.US WLFI allegation as proven, nor the disputed portions of that report as established.
• It does not present the Kharrazi-family claims as Nobitex’s own position; the exchange has denied government ties, and that denial is recorded above (Cointelegraph).
• It does not merge the conflicting suspect-flow estimates into a single number; the firms use different definitions and are shown separately.
• It does not state an exact founding date; sources agree on the exchange and its scale but not on every early detail.