Nobitex 

🔴 High Risk

Nobitex, Iran’s dominant cryptocurrency exchange serving over 11 million users, has evolved into a critical conduit for money laundering and sanctions evasion, enabling the Islamic Revolutionary Guard Corps (IRGC)—which controls up to 40% of Iran’s economy—to launder ransomware proceeds, darknet funds, and illicit revenues from proxy groups like Hamas, Hezbollah, and the Houthis through obfuscated multi-chain transfers and third-party platforms in lax jurisdictions. Blockchain analytics from firms like Elliptic and TRM Labs reveal wallet patterns linking Nobitex to sanctioned Russian exchanges such as Garantex, with major shareholders tied to Supreme Leader associates like Seyed Mohammad Baqer Kharazi, underscoring its dual role in retail trading and state-sponsored financial repression. The June 2025 $90 million hack by pro-Israel group Predatory Sparrow exposed these vulnerabilities, freezing millions in IRGC-linked assets via Tether, yet Nobitex persists as high-risk infrastructure, challenging global AML frameworks amid Tehran’s persistent crypto strategies despite U.S. OFAC actions.

Nobitex, Iran’s largest cryptocurrency exchange, has emerged as a pivotal player in facilitating illicit financial flows tied to sanctioned entities and jurisdictions. Through its vast user base and strategic ownership links to IRGC-affiliated political figures, Nobitex serves not only domestic cryptocurrency traders but also state-aligned actors seeking to evade international sanctions. Complex laundering methods involving multi-jurisdictional layering, decentralized asset transfers, and connections to ransomware and darknet funds underscore its integral role in Iran’s shadow financial network. The high-profile hacking incident in June 2025 revealed thousands of wallets linked to Nobitex, moving illicit funds exceeding $90 million. Despite international sanctions and law enforcement efforts, Nobitex continues to operate as a critical conduit for laundering and sanctions circumvention, posing significant challenges for global AML and counterterrorism financing frameworks.

Countries Involved

Iran (primary), with cross-border connections involving Russia and other jurisdictions through third-party exchanges.

The major public reporting surfaced in mid-2025, notably after a significant hack in June 2025 exposed financial flows totaling over $90 million.

Bitcoin (BTC), Ethereum (ETH), Tether (USDT), Dogecoin (DOGE), Ripple (XRP), Solana (SOL), Tron (TRX), Ton

Money laundering, sanctions evasion, cyber theft, and illicit finance supporting sanctioned entities and proxy groups.

Nobitex exchange, Iranian users linked to Islamic Revolutionary Guard Corps (IRGC), sanctioned entities including Hamas, Palestinian Islamic Jihad, Houthi networks, and Russian sanctioned crypto exchanges like Garantex.

Yes. Major shareholders and connections to individuals linked to the Iranian Supreme Leader and the IRGC, a politically exposed powerful military organization controlling significant economic sectors in Iran.

Nobitex has been used as a hub for layering proceeds through digital asset transactions that disguise sanctions compliance evasion. Iranian-linked users route transactions through third-party foreign exchanges in jurisdictions with weaker enforcement, making tracing harder. There is evidence of using decentralized and multi-chain transfers to obfuscate fund origin and destination, including links to ransomware proceeds and darknet market funds. Patterns include structuring transactions to avoid detection thresholds and using wallet behaviors associated with illicit activities to camouflage the movements.

While no exact laundered total is publicly confirmed, investigations identified over $90 million in stolen and illicit funds moved through Nobitex wallets. The linkage to ransomware proceeds and darknet market funds suggests multi-hundred-million-dollar scale money laundering operations over time.

On-chain analysis highlighted Nobitex’s role in facilitating transactions for sanctioned groups and IRGC-affiliated networks. The platform’s wallets showed interaction patterns with entities such as Hamas and Hezbollah-associated groups, plus Russian exchanges previously sanctioned for ransomware and darknet involvement. The exchange operates as a critical infrastructure node enabling Iran to circumvent financial sanctions by leveraging cryptocurrency’s cross-border, pseudonymous nature. Complex layering and use of third-party intermediaries in permissive jurisdictions exacerbate enforcement challenges.

The U.S. Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned individuals connected to Nobitex and the IRGC for ransomware distribution and cyber threat activities. Investigations by international crypto forensics firms have supported U.S. Secret Service actions, including freezing of assets worth millions linked to Nobitex-associated illicit funds. Despite these actions, due to geopolitical complexities and Nobitex’s dominant domestic position in Iran, regulatory enforcement remains difficult, with ongoing concerns about its role in sustaining Iran-related sanctions evasion.

Nobitex
Case Title / Operation Name:
Nobitex Cryptocurrency Exchange Money Laundering and Sanctions Evasion
Country(s) Involved:
Iran, Russia
Platform / Exchange Used:
Nobitex
Cryptocurrency Involved:

Bitcoin (BTC), Ethereum (ETH), Tether (USDT), Dogecoin (DOGE), Ripple (XRP), Solana (SOL), Tron (TRX), Ton

Volume Laundered (USD est.):
Over $90 million identified in stolen and illicit funds
Wallet Addresses / TxIDs :
Multiple wallets linked to Nobitex including those associated with sanctioned entities and illicit actors
Method of Laundering:

Layering via decentralized multi-chain transfers, structuring transactions, use of third-party foreign exchanges

Source of Funds:

Sanctions evasion proceeds, ransomware payments, darknet market funds, IRGC-controlled economic sectors

Associated Shell Companies:

Front companies connected to IRGC and regime-affiliated individuals

PEPs or Individuals Involved:

Shareholders and affiliates connected to Iran’s Supreme Leader, IRGC commanders, and sanctioned political actors

Law Enforcement / Regulatory Action:
US OFAC sanctions on Nobitex-connected individuals, asset freezes of $26 million, international investigations
Year of Occurrence:
2025
Ongoing Case:
Ongoing
🔴 High Risk