Nobitex ownership allegations revive sanctions-risk focus on Iran’s biggest exchange
Claims of elite-family ties and wartime outflows collide with widely split on-chain estimates of suspect flows.
Allegations that Nobitex was founded by brothers tied to Iran’s politically connected Kharrazi family are putting the country’s dominant crypto venue back under a compliance microscope. The same report links the exchange to wartime outflows and sanctions-adjacent activity, but blockchain-analytics estimates vary by an order of magnitude.
Key Takeaways
- Nobitex is described as Iran’s largest crypto exchange and as handling the majority share of the country’s crypto activity.
- Ali and Mohammad Kharrazi are alleged to have founded the venue and used the surname “Aghamir” across corporate records and professional life to obscure family ties.
- The platform reportedly serves more than 11 million customers and stayed online during a nationwide internet blackout amid a conflict period.
- Sanctions-linked or suspect-flow estimates tied to Nobitex diverge sharply across analytics firms, ranging from about $22 million to roughly $366 million depending on definitions.
Nobitex Ownership Allegations Put Iran’s Biggest Exchange Back in Focus
Nobitex, described as Iran’s largest crypto exchange and the majority venue for Iran’s crypto activity, is facing renewed scrutiny after allegations about its founders’ political connections and the platform’s role in sanctions-adjacent flows.
The exchange was reportedly launched by Ali and Mohammad Kharrazi. The same account alleges the brothers used an alternative surname, “Aghamir,” across corporate records and professional life to mask links to the Kharrazi family, which is described as having multigenerational ties to Iran’s leadership.
For traders and risk teams, the immediate relevance is not a directional price catalyst. It is counterparty and compliance risk. When a single venue is framed as the dominant on-ramp for a sanctioned jurisdiction, downstream exposure can show up in unexpected places, including OTC routing, stablecoin flows, and exchange-to-exchange settlement.
Scale and Wartime Activity: 11M Users, Blackout Continuity, and $100M+ Processed
Nobitex reportedly serves over 11 million customers, a scale that matters because it implies deep local liquidity and a large surface area for cross-border outflows when conditions tighten.
The report also says Nobitex remained operational during an ongoing conflict period involving the United States and Israel, including during a nationwide internet blackout. Analysts cited in the same account said more than $100 million in transactions were processed during the war period, with “significant outflows moving abroad.”
That operational-continuity detail is the kind of trigger that tends to elevate monitoring intensity. A venue that stays live through connectivity shocks can become a pressure valve for capital flight, and the “outflows moving abroad” framing is exactly what compliance teams and on-chain investigators look for when they decide whether to widen screening rules.
Why the Sanctions-Flow Numbers Diverge: Elliptic vs Chainalysis vs Crystal
Investigators cited in the report allege the platform processed transactions linked to sanctioned entities, but the numbers are not cleanly comparable.
Elliptic estimated roughly $366 million in “suspect flows.” Chainalysis put the figure closer to $68 million. Crystal Intelligence identified about $22 million, explicitly described as “direct transfers from sanctioned wallets.”
Traders should treat any single headline figure here as a category label, not a precise measurement. “Suspect flows” can include broader heuristics and indirect exposure, while “direct transfers from sanctioned wallets” is a narrower slice by definition. The spread from ~$22 million to ~$366 million is the market signal: methodology is doing most of the work.
The same report also claims wallets associated with Iran’s central bank sent hundreds of millions of dollars’ worth of cryptocurrency to Nobitex in 2025 as part of a strategy to bypass financial restrictions. Separately, a dispute involving Babak Zanjani reportedly exposed wallet addresses that analysts said revealed at least $20 million in routed state funds. Those details frame the venue as potentially relevant to state-linked routing narratives, not only retail usage.
Nobitex reportedly denied any government affiliation and said illicit transactions represent a small share of overall activity.
Signals Traders Should Monitor From Here
The next market-relevant signals are likely to come from infrastructure chokepoints rather than from Iran headlines.
One is whether major stablecoin issuers, including Tether, make follow-on statements or take actions tied to freezing or blocking Iran-linked flows. The packet references Tether assisting in freezing funds in connection with previously disclosed totals.
Another is primary-source documentation or on-chain identifiers that substantiate, or refute, the claim that central-bank-associated wallets sent hundreds of millions of dollars’ worth of crypto to Nobitex in 2025.
Methodology reconciliation is also a live variable. Any updates from Elliptic, Chainalysis, or Crystal Intelligence that explain the gap between ~$366 million, ~$68 million, and ~$22 million would change how risk desks interpret the exposure.
Finally, the packet references nearly $500 million seized under a campaign called “Operation Economic Fury,” described as an increase from previously disclosed totals including $344 million in frozen digital assets. Additional U.S. enforcement disclosures with dates and case details would be the clearest catalyst for broader compliance tightening.
Marcus Hale’s Take: The Real Risk Is Second-Order Exposure, Not Iran Headlines
I don’t see this as a clean “Iran risk-on/risk-off” trade. The story reads like a compliance and market-structure problem: a dominant local venue with 11 million-plus users, alleged wartime outflow behavior, and a set of sanctions-flow estimates that are not even measuring the same thing.
The threshold that matters is whether primary on-chain identifiers and enforcement actions start mapping Iran-linked flows into venues and stablecoin rails that global desks actually touch. If that linkage holds, the setup starts to look structural rather than narrative-driven, and the practical impact is tighter screening, more frozen funds, and wider friction in cross-border settlement.
