Understanding Nobitex: Iran’s Largest Crypto Exchange

Key takeaways

• Nobitex is central to Iran’s crypto ecosystem.  With over USD 5 billion in observed volume from 2025 to the present — and tens of billions processed since 2019 — Nobitex serves as Iran’s primary crypto on- and off-ramp, connecting domestic users to global markets.
  
• Post-strike activity reflected operational fund management — not clear capital flight. Following the February 28 US-Israeli strikes, TRM observed increased flows, including transfers exceeding USD 35 million to cold storage. Based on historical behavior and wallet attribution, these movements aligned with routine liquidity management rather than user-driven withdrawals.
  
• The 2025 hack exposed sophisticated internal architecture. The June 2025 breach — resulting in approximately USD 90 million in losses — revealed a multi-tier custody system (hot, warm, and cold wallets), automated routing logic, and differentiated controls for high-value or politically connected clients. Documentation suggested additional structures designed to mitigate sanctions-related constraints.
  
• Dormant mining reserves helped stabilize operations. After the breach, TRM identified approximately USD 2.7 million consolidated from more than 100 previously dormant mining-linked wallets. The timing suggests Nobitex mobilized reserves to restore liquidity as it resumed services.
  
• Nobitex sits at the nexus of a sanctioned cross-border ecosystem.On-chain exposure includes flows linked to sanctioned exchanges such as Garantex, high-risk platforms like BitPapa and A7, and wallets associated with designated terrorist organizations. These patterns reflect Nobitex’s role within a broader network connecting sanctioned jurisdictions and offshore facilitators.

{{horizontal-line}}

Background

Iran’s crypto economy has grown as both ordinary Iranians and regime-linked actors look for alternate settlement rails under strict sanctions – a trend likely to continue even as the conflict shifts into the kinetic following strikes on Iran and the onset of a broader regional war. Nobitex, Iran’s largest digital asset platform, provides a focal point through which to consider the regime’s financial strategy and assess how it might evolve. 

Nobitex is the central hub of the country’s crypto ecosystem, with approximately USD 5 billion in observed volume from 2025 to the present. It serves both as a retail gateway for ordinary Iranians seeking access to foreign currency and as a key component of Iran’s financial infrastructure, facilitating cross border value transfers outside traditional banking channels.

Given its scale, reach, and integration into Iran’s economy, Nobitex is one of the most consequential exchanges operating within a comprehensively sanctioned jurisdiction. In a country largely cut off from the global financial system, the platform plays an important role in enabling liquidity, settlement, and capital movement.

Nobitex employs sophisticated operational techniques to manage liquidity, reduce transaction costs, and obscure the origin and destination of customer funds when interacting with global services. These behaviors are common for exchanges operating in heavily sanctioned environments. Details regarding aspects of these operational methods became public following a hack and leak operation in 2025, offering rare insight into how a major exchange adapts to sustained sanctions pressure.

Understanding Nobitex is essential to understanding how crypto functions within Iran’s broader economic and geopolitical strategy during periods of escalation and conflict.

Nobitex showed increased activity in wake of US-Israeli strikes

In the immediate aftermath of the US-Israeli strikes on February 28, Nobitex recorded higher incoming and outgoing activity compared to the prior day. TRM observed an increase of nearly USD 3 million in aggregate flows on February 28 relative to February 27. Our analysis indicates that this increase was driven primarily by an internal transfer on Polygon from a Nobitex hot wallet to a cold storage wallet.

TRM also identified a separate transfer of more than USD 35 million from a Nobitex hot wallet to a Nobitex-controlled cold wallet during the same period. Based on historical behavior and wallet attribution, we assess that this movement reflects routine infrastructure liquidity management rather than user-driven withdrawals. In context, these transfers align with normal operational fund rebalancing and do not, at this stage, provide evidence of capital flight from the exchange.

2025 hack showed Nobitex inner workings

In June 2025, the Israel-linked hacking group Predatory Sparrow breached Nobitex, resulting in the loss of approximately USD 90 million in digital assets. TRM’s on-chain analysis in the immediate aftermath showed rapid cross-chain movement of compromised funds alongside defensive repositioning of exchange-controlled assets. Shortly after the breach, attackers published Nobitex’s internal source code, configuration files, and system documentation.

The leaked materials provided rare visibility into the exchange’s internal architecture. Nobitex operated a multi-tier custody model structured around hot, warm, and cold wallet layers, each managed through distinct internal services and APIs. Asset movement relied on orchestration logic spanning internal approval flows, automated routing rules, and system-level reconciliation processes. The documentation also revealed differentiated handling for high-value and politically connected clients, with transaction pathways and controls that diverged from those applied to general users.

The breach exposed how ownership records, withdrawal logic, and internal ledger reconciliation were distributed across both on-chain and off-chain systems. While this design mirrors patterns used by global exchanges, the Nobitex implementation showed additional layers specifically designed to minimize the impact of sanctions and external monitoring. Additionally, Nobitex explicitly outlines in the documents that the structures are designed to defeat US regulatory bodies.

In the aftermath of the hack, incoming transaction volumes dropped by more than 70% year over year. However, Nobitex resumed service in stages beginning in late June, aided in part by reserves held in bitcoin, including funds consolidated from previously dormant mining-linked wallets.  

TRM identified a newly created bitcoin address associated with the exchange that received approximately USD 2.7 million from more than 100 previously dormant mining-linked wallets over a ten-day period after the breach. These wallets had accumulated mining rewards in 2021 and 2022 and had not previously moved funds. The majority of upstream flows traced back to two major global mining pools, EMCD and ViaBTC. The timing of this consolidation, immediately after the hack and shortly before withdrawals were reportedly restored, indicates that the exchange mobilized dormant reserves to stabilize operations during a period of acute stress.

Leadership links to the Iranian regime

TRM analysis indicates that Seyed Mohammad Aghamir likely plays a senior leadership role within Nobitex’s blockchain and transaction infrastructure, based on open-source reporting, sanctions records, and analysis of leaked internal Nobitex source code following the June 2025 breach. 

Open source information consistently identifies Aghamir as Nobitex’s blockchain lead, while US Treasury sanctions designations confirm his senior role within Iran’s cyber governance apparatus. This assessment is strengthened by review of internal Nobitex code and documentation released by the Predatory Sparrow hack, which revealed centralized control over high-value and VIP transaction flows and identified oversight functions that align with Aghamir’s publicly reported role. Many senior Nobitex executives have familial and/or personal ties to Iranian officials at the highest levels of the regime.

Little is known about Nobitex’s CEO and founder Amir Rad aside from his educational background and position with the exchange.

Operational model and on-chain footprint

Since 2019, Nobitex has processed tens of billions of dollars in transaction volume, supporting millions of users across Bitcoin, Ethereum, TRON, and other major networks. It functions as the primary gateway between Iran’s local currency environment and global crypto markets, serving as the central on and off-ramp for digital assets within the country.

Over time, Nobitex has emerged as a recurring nexus point in blockchain tracing connected to Iranian regime linked activity. On-chain exposure includes transaction flows associated with entities tied to the Islamic Revolutionary Guard Corps (IRGC), the recently sanctioned exchange Zedcex, and regime financiers such as Alireza Derakhshan and Arash Estaki Alivand. These patterns reflect the exchange’s position within a broader national financial architecture.

Nobitex operates as a critical node in what can be described as a shadow financial ecosystem linking sanctioned jurisdictions and their offshore facilitators. Domestic exchanges, offshore brokers, shell companies, Russian and Venezuelan intermediaries, and Chinese suppliers interact across shared settlement pathways, with cryptocurrency serving as a flexible rail for cross border value transfer. Within that ecosystem, Nobitex provides liquidity, routing, and integration between domestic capital and external counterparties, anchoring a network designed to access foreign currency and sustain financial connectivity under sanctions pressure.

On-chain analysis shows that Nobitex maintains extensive transactional exposure to a range of sanctioned and high-risk entities. This includes flows linked to the sanctioned and now-defunct Russian exchange Garantex, peer-to-peer platform BitPapa, and cross-border settlement network A7. TRM has also identified interactions connected to wallets associated with Hamas, including through the sanctioned fundraising network Gaza Now, and designated foreign terrorist organization Palestinian Islamic Jihad.

These patterns reflect the exchange’s position within a broader transnational ecosystem where sanctioned actors, facilitators, and aligned organizations intersect across shared digital asset infrastructure.

Outlook

As the conflict evolves and economies adjust, monitoring Nobitex’s liquidity posture, exchange controls, and on-chain counterparties will be important to assess how Iran’s broader crypto financial ecosystem adapts under geopolitical strain. Nobitex is so closely linked to the regime that its operational picture as the conflict continues or settles will likely be directly connected to the fate of regime actors – reflecting capital flight if they flee, or falling back into old patterns if appointed successors return to the negotiating table.

TRM will continue to closely monitor developments and provide updates as conditions change.

{{horizontal-line}}

Frequently asked questions (FAQs)

1. What is Nobitex?

Nobitex is Iran’s largest cryptocurrency exchange and the country’s primary gateway between the domestic currency environment and global crypto markets. It supports major networks such as Bitcoin, Ethereum, and TRON, and serves millions of users.

2. Why is Nobitex significant in the context of sanctions?

Iran faces comprehensive sanctions that limit access to traditional banking infrastructure. Nobitex provides an alternative settlement rail, enabling cross-border value transfers and access to foreign-denominated assets outside conventional financial channels.

3. Did users withdraw funds after the February 28 strikes?

TRM observed increased activity immediately following the strikes, including large transfers to cold storage. However, the available on-chain evidence suggests these movements were consistent with internal liquidity management rather than widespread customer withdrawals.

4. What did the June 2025 hack reveal?

The breach exposed internal source code and system documentation, revealing a layered custody model and orchestration systems governing asset movement. It also highlighted differentiated controls for certain client categories and structures designed to operate under sustained sanctions pressure.

5. How did Nobitex recover after losing approximately USD 90 million?

Incoming transaction volumes initially dropped more than 70% year over year. Nobitex resumed services in stages and consolidated bitcoin from dormant mining-linked wallets, indicating the use of reserve assets to stabilize operations.

6. What is Nobitex’s exposure to sanctioned or high-risk entities?

On-chain analysis shows transactional exposure to sanctioned exchanges, cross-border settlement networks, and wallets associated with designated organizations. These flows reflect Nobitex’s position within a broader transnational financial ecosystem where sanctioned actors intersect through shared digital asset infrastructure.