US Sanctions Iran's Largest Crypto Exchange Nobitex for Facilitating Ransomware Payments
The U.S. Treasury has sanctioned Nobitex, Iran's largest cryptocurrency exchange, for its role in facilitating ransomware payments and evading sanctions.
The U.S. Treasury's Office of Foreign Assets Control (OFAC) has imposed sanctions on Nobitex, identified as Iran's largest cryptocurrency exchange, citing its alleged involvement in facilitating payments for ransomware attacks and other illicit financial activities. This move is part of a broader U.S. strategy to disrupt the financial infrastructure utilized by cybercriminals and state-sponsored malicious actors.
According to OFAC, Nobitex has provided substantial support to the Iranian regime by processing over half of all digital asset inflows into Iran in 2025. The exchange is accused of enabling sanctions evasion and facilitating transactions linked to the Islamic Revolutionary Guard Corps (IRGC), including those associated with IRGC-affiliated ransomware threat actors. Furthermore, Nobitex allegedly assisted the Central Bank of Iran in accessing hundreds of millions of dollars in stablecoins to support the depreciating Iranian rial, while also enabling regime insiders to access international digital asset markets.
In addition to sanctioning the exchange itself, OFAC has designated specific individuals identified as Nobitex executives and founders. These include chairman Amir Hossein Rad, CEO Seyed Ali Khoee, co-founder Seyed Mohammad Ali Aghamir Mohammad Ali, and blockchain lead Seyed Mohammad Aghamir Mohammad Ali. These designations aim to further isolate the individuals and entities involved in these illicit financial operations.
The sanctions are part of the U.S. government’s ongoing “Economic Fury” campaign. In conjunction with the action against Nobitex, OFAC also designated three other Iranian cryptocurrency exchanges: Wallex, Bitpin, and Ramzinex. This coordinated action underscores the U.S. government's commitment to targeting the broader ecosystem of cryptocurrency exchanges used for illicit purposes.
Data from blockchain intelligence firm Chainalysis indicates the significant scale of the Iranian cryptocurrency ecosystem, which received nearly $7.8 billion in 2025. Addresses associated with the IRGC accounted for over 50% of the value received in the fourth quarter of 2025. Nobitex alone processed more than half of the total Iranian crypto inflows, with Wallex and Bitpin handling 12% and 10% respectively, highlighting their central roles in these financial flows.
From a practical standpoint, these sanctions freeze any assets or property of the designated entities and individuals that fall under U.S. jurisdiction. Additionally, U.S. persons are prohibited from conducting any business with them. The sanctions also exert international pressure, making foreign companies and allies hesitant to engage with the sanctioned parties due to the associated risks.
This action follows a reported security incident in June 2025, where the pro-Israel hacking group "Predatory Sparrow" claimed to have breached Nobitex, stealing approximately $90 million worth of digital assets and leaving politically motivated messages. While the current sanctions focus on financial facilitation of illicit activities, the past breach highlights potential vulnerabilities within the exchange's infrastructure.