Treasury Listed Nobitex After Iran’s Crypto Volume Collapsed

OFAC listed Nobitex, Iran’s largest crypto exchange, on June 2, 2026, together with Wallex, Bitpin, and Ramzinex. Treasury Secretary Scott Bessent said the firm helped the Islamic Revolutionary Guard Corps and the Central Bank of Iran move money, including during internet blackouts after U.S. combat operations began.

The listing arrived after the heavy wallets had already gone quiet. What OFAC poisoned is the rial-to-crypto door ordinary users still need, while remaining IRGC-linked flow hopped to smaller shops the department then had to name in August.

Four Iranian Exchanges Took 78% of 2025 Crypto Volume

The U.S. Treasury’s Office of Foreign Assets Control more than 50 percent of inflows into Iranian digital assets in 2025 went through Nobitex, and it designated the exchange under Executive Order 13224, the counterterrorism order, and Executive Order 13902, which targets Iran’s financial sector. Wallex took 12 percent of those inflows. Bitpin took 10 percent. Ramzinex, founded in 2018, has processed over $2.45 billion in lifetime transactions, including flows Treasury tied to the IRGC and a state-backed Iranian financial institution.

Today, Treasury’s Office of Foreign Assets Control designated Nobitex, Iran’s largest digital asset exchange, along with three other Iranian digital asset exchanges, as part of Economic Fury and the Trump Administration’s efforts to eliminate the threat posed by the Iranian…

— Treasury Department (@USTreasury) June 2, 2026

TRM Labs, a blockchain intelligence firm, put Iran’s attributed crypto volume at $9.9 billion in 2025. The four named platforms accounted for $7.7 billion, or 78% of Iran’s attributed crypto volume that year. Nobitex alone processed $4.7 billion on TRM’s books, ahead of Wallex at $1.45 billion, Bitpin at $821 million, and Ramzinex at $739 million. Those dollar figures measure attributed volume, which is a wider net than Treasury’s inflow-share percentages.

THE FOUR EXCHANGES OFAC NAMED

Foreign firms now treat the June SDN listing of Nobitex as a screening event, not a polite watchlist. OFAC also named four people at the firm: chairman and former chief executive Amir Hossein Rad; current chief executive Seyed Ali Khoee, who previously ran product and marketing; and co-founders Seyed Mohammad Ali Aghamir Mohammad Ali (Ali Aghamir) and Seyed Mohammad Aghamir Mohammad Ali (Mohammad Aghamir), both identified as members of the Kharrazi family.

Nobitex Volume Had Already Collapsed Before the Listing

The 2025 totals make Nobitex look like a giant. The 2026 tape does not. Global Ledger, which tracked Nobitex flows in bitcoin, ether, litecoin, TRON, and USDT, found the exchange processed $2.5 billion in 2024 and only $46.97 million from January through mid-May 2026, about $10.4 million a month, nearly 20 times below 2024’s monthly average.

U.S. combat operations in Iran began on February 28, 2026. Nobitex volume fell from about $14.73 million in February to about $6.37 million in March, a drop of more than 50 percent, then recovered to about $15.72 million in April, still a fraction of the 2024 run-rate. By mid-May, Global Ledger found the share of large transactions had fallen to zero, meaning the leftover activity sat under $10,000.

That sequence matters because Treasury’s own case leans on wartime use. OFAC said that after combat operations began, Nobitex helped protect and move assets out of Iran to shield regime wealth despite internet blackouts. The on-chain record shows the platform stayed up. It also shows the heavy flow had already thinned before the SDN stamp landed in June.

THE 2026 ENFORCEMENT SEQUENCE

1. January 2026: OFAC designates Zedcex and Zedxion, exchange-branded stablecoin infrastructure TRM tied to IRGC-linked flows.
2. April 2026: OFAC lists wallets as property of Iran’s Central Bank, and Tether freezes $344 million in USDT in a coordinated action.
3. June 2, 2026: OFAC lists Nobitex, Wallex, Bitpin, and Ramzinex, plus four Nobitex officials.
4. August 7, 2026: OFAC lists Aban Tether, Shelbit Exchange, and Siavash Kayvanpour’s multi-country network after funds still moved through Nobitex-linked rails.

Treasury said those earlier steps had already led to the freezing of nearly half a billion dollars in regime-linked cryptocurrency, a wider tally than the April USDT freeze. The June action therefore hit the domestic exchange layer after the reserve wallets and the first IRGC-branded shops had already been named.

A Thin Slice of Addresses Moved 85% of the Flow

Global Ledger’s wallet split is the part the designation does not advertise. Addresses that transacted above $200,000 were 4.2% of addresses drove 85% of Nobitex volume in the firm’s sample. Addresses below $10,000 made up about 83% of addresses and only about 5.5% of volume.

NOBITEX FLOW BY WALLET SIZE

• Whale slice: 4.2% of addresses above $200,000 produced nearly 85% of volume.
• Retail slice: About 83% of addresses below $10,000 produced about 5.5% of volume.
• Dollar rail: USDT was 84.4% of the tracked volume, or $3.89 billion.
• 2026 leftover: By mid-May, remaining activity sat in transfers under $10,000.

USDT is the product Iranians use when the rial is sliding, and it is also the product a private issuer can freeze. The April freeze of $344 million showed that chokepoint months before Nobitex’s name hit the SDN list. Listing the exchange does not freeze Tether. It does put secondary-sanctions heat on anyone still banking, listing, or making markets for a platform whose retail base and whale base were never the same market.

Nick Smart, chief intelligence officer at Crystal Intelligence, put the mixing problem in one line after tracing the wartime flows.

The concern with Nobitex is that since it has so much activity that belongs to normal Iranians, it is hard to separate the regime from the people using the platform.

Nick Smart, Chief Intelligence Officer, Crystal Intelligence

An SDN stamp does not do that separation. It treats the whole door as hostile, which is the point of a listing and also the cost borne by the small wallets that never moved IRGC money.

The Kharrazi Brothers Ran the Rails Through Blackouts

OFAC said Ali Aghamir and Mohammad Aghamir are members of the Kharrazi family, which it placed in Supreme Leader Khamenei’s inner circle, and that two co-founders are close associates of the family of former Supreme Leader Ayatollah Ali Khamenei. A May 1 investigation, drawing on corporate records, found the brothers built the exchange in 2018 under the Aghamir name, a surname relatives rarely use in public, and that the clan is related by marriage to all three supreme leaders of the Islamic Republic.

The Federal Register notice lists Nobitex’s legal alias as Rahkar Fanavari Nooyan in Sharif Technology Tower, Unit 1002, Floor 10, in Tehran’s Tarasht district, company number 1400769571. Ali Aghamir’s date of birth is August 23, 1986. Mohammad Aghamir’s is 1992. Both carry Kharrazi as an also-known-as.

TRM’s review of source code leaked in the June 18, 2025 hack found Mohammad Aghamir was the named author of Nobitex’s address-validation software, the tool that checks every deposit and withdrawal address, and that he updated it 17 times between 2022 and 2024. Several production API keys sat on his personal accounts. That is not a passive shareholder. It is the person who kept the pipes working.

Rad, OFAC said, helped the firm reconstitute operations after that $90 million hack, which Global Ledger and TRM both tie to the Israel-linked group Predatory Sparrow. In an April email, Nobitex said it had no direct government connections, that any illicit funds moved without management approval or awareness, and that the two brothers had never used an alternative identity or changed identity. Treasury’s June file rejects that defense in full.

While Iran’s economy is in free fall, the regime has chosen to co-opt digital asset technologies for its own corrupt agenda, including evading sanctions and transferring wealth out of the country.

Scott Bessent, Secretary of the Treasury, June 2 statement

WHERE THE COMPANY AND TREASURY DIVERGE

• Control: Nobitex denied direct government ties; OFAC said the co-founders sit in the Kharrazi circle around the supreme leader’s family.
• Illicit flow: Nobitex said any bad funds moved without management awareness; OFAC said the exchange gave significant support to the IRGC and the Central Bank of Iran.
• Identity: Nobitex said the brothers never used an alternative name; corporate records cited in the May 1 investigation show the Aghamir surname on early filings.

Treasury also said Nobitex helped the Central Bank of Iran obtain hundreds of millions of dollars in stablecoins used to prop up the rial, and that IRGC-affiliated ransomware wallets had used the platform. Those are regime functions running on the same matching engine as household trades.

OFAC Spent August Chasing the Shops That Replaced Nobitex

If the June action had closed the rail, August would have been quiet. It was not. On August 7, OFAC named Aban Tether, an Iran-based exchange that had processed millions of dollars of transactions involving Nobitex, Wallex, Bitpin, and Ramzinex. It also named Siavash Kayvanpour, who holds Iranian, Dominican, and Afghan citizenship and has lived in the United Arab Emirates, along with his Georgia-based Shelbit Exchange and UAE and Poland companies in the same group.

IRGC digital-currency addresses had sent over $1 million to Shelbit Exchange addresses, and more than $2 million had moved the other way. Addresses belonging to or controlled by Kayvanpour sent over $2 million to Nobitex after Nobitex was already a blocked person. That is the hop in plain figures: the listed brand was still useful as a counterparty, so OFAC listed the counterparty too.

THE AUGUST ADD-ON LIST

• Aban Tether: Iran-based shop that kept processing deals with all four June exchanges.
• Shelbit Exchange: Georgia- and UAE-facing platform that took IRGC-linked deposits and withdrawals in the millions.
• Kayvanpour companies: Shelbit, Shelbit Technologies in Poland, Crypto Home DMCC, and NFT Home DMCC, all listed as his network.

The same week the June announcement went up, blockchain investigator ZachXBT told Treasury it should also list Iranian OTC brokers in Canada, naming Nia Nations Exchange and Million Exchange as desks used in violent home-invasion robbery and extortion cases. Those names were not in the August package. The pattern is the same one August did catch: when the Tehran front door is stained, flow moves to a desk that still answers the phone.

Bessent’s August line treated that chase as proof of pressure, not as a miss.

The Iranian regime’s reliance on digital assets and shadow banking networks is further evidence that Economic Fury is working. We will continue to increase the economic pressure. Whether in dollars, rials, or crypto, Treasury will hunt down and dismantle the illicit financial networks that keep the regime afloat.

Scott Bessent, Secretary of the Treasury, August 7 statement

What Secondary Sanctions Mean for Banks Still Touching These Names

For U.S. persons the rule is simple. All property and interests in property of the listed people and firms that are in the United States, or in the possession or control of U.S. persons, are blocked and must be reported to OFAC. Any entity owned 50 percent or more, directly or indirectly, by one or more blocked persons is blocked too.

WHAT THE LISTING ACTUALLY BLOCKS

• U.S. nexus: No U.S. person, and no transaction through the United States, may deal in the blocked parties’ property unless OFAC licenses it.
• Ownership math: The 50 percent rule aggregates owners, so a joint venture can be blocked even if no single listed person holds a majority.
• Foreign banks: Under E.O. 13902, foreign financial institutions that conduct significant transactions with the four exchanges face correspondent-account limits and the risk of being named themselves.
• IRGC reward: The State Department’s Rewards for Justice program offers up to $15 million for information that disrupts IRGC financial mechanisms.

TRM noted that Iran’s attributed crypto volume had held near $10 billion a year even under prior enforcement, and that other exchange infrastructure with Iran-linked address exposure remained unnamed on June 2. Aban Tether’s August listing is one answer to that gap. Unhosted wallets, TRON USDT, and OTC desks that never take a public brand are the rest of it, and they do not show up on an SDN search the way nobitex.ir does.

The June file is still the one that changed screening queues. It put Iran’s largest retail exchange, its chairman, its sitting chief executive, and two co-founders from a ruling-family orbit on the same list as the IRGC they were accused of serving. The volume charts say the whales had already left. The August follow-on says the hop did not.

Frequently Asked Questions

Which U.S. orders put Nobitex on the SDN list?

OFAC listed Nobitex under Executive Order 13224, as amended, for material support to the IRGC, and under Executive Order 13902 for operating in Iran’s financial sector. Wallex, Bitpin, and Ramzinex were listed under E.O. 13902 only. The June 8, 2026 Federal Register notice is the official publication of those names, aliases, and the Tehran address.

What is Nobitex’s legal company name?

The SDN entry records the alias Rahkar Fanavari Nooyan, Iranian company number 1400769571, at Unit 1002, Floor 10, Sharif Technology Tower, Akbari Corner, Salehi Boulevard, Tarasht, Tehran, with the website nobitex.ir. That corporate wrapper is what screening tools now match, not only the trading brand.

Who is Seyed Ali Khoee?

Khoee is Nobitex’s current chief executive. OFAC said he previously served as director of product and marketing and listed him under E.O. 13224 as a leader or official of the exchange. He is not described as a member of the Kharrazi family; that tag is attached to the two Aghamir co-founders.

Can a foreign bank be hit for handling Nobitex trades?

Yes. OFAC’s companion FAQ on Iranian digital-asset exchanges, cited in the June 2 release as FAQ 1257, states that non-U.S. persons, including foreign financial institutions, that conduct significant transactions with the four exchanges face correspondent-account restrictions and secondary designation risk under E.O. 13902. Mandatory sanctions under the National Defense Authorization Act for Fiscal Year 2012 can also apply to significant transactions with designated Iranian financial institutions.

What did the June 2025 Nobitex hack change?

On June 18, 2025, attackers drained $90 million. OFAC said Rad then helped rebuild operations. TRM’s reading of leaked source code is what tied Mohammad Aghamir to the address-validation software and to personal API keys in production, which later appeared in the June 2 personnel listings. The hack did not end the exchange; it produced the files investigators used against it.

Disclaimer: This article is news reporting and analysis of U.S. sanctions actions and on-chain research. It is informational only and is not legal, compliance, investment, or trading advice. It does not tell readers whether to hold, freeze, screen, or transact in any digital asset, or how to treat any counterparty under OFAC rules. Anyone who may have exposure to listed persons, Iranian digital-asset platforms, or stablecoin freezes should consult a qualified sanctions attorney or licensed compliance officer before acting. Figures and listing statuses reflect the Treasury notices, Federal Register entry, and research cited here as of those publications and can change with new designations, licenses, or delistings.