Ali Kharrazi and Mohammad Kharrazi, graduates of Sharif University of Technology and grandsons of an ayatollah who taught Iran's supreme leader Mojtaba Khamenei, built Nobitex into a platform with 11 million registered users since its 2018 launch. Mojtaba Khamenei succeeded his father, Ali Khamenei, as supreme leader, a transition that may be unfamiliar to many international readers. The family's political reach extends well beyond that generational connection. Their father, Ayatollah Bagher Kharrazi, founded Hezbollah in Iran and participated in building early post-1979 IRGC structures. Their great-uncle, Kamal Kharrazi, served as Iran's foreign minister and later became a senior adviser to both Ali and Mojtaba Khamenei.

The brothers registered the company under the surname "Aghamir" rather than their well-known family name, a practice their former colleagues described as startling when it came to light. They are the only members of the Kharrazi family who routinely conceal the surname in professional settings.

Three blockchain analytics firms independently traced flows from sanctioned entities through the exchange. Crystal Intelligence identified $22 million in direct exposure; Chainalysis traced approximately $68 million; and Elliptic estimated approximately $366 million. The variation across estimates reflects significant differences in methodology.

Nine former employees confirmed to Reuters that they knew state funds subject to sanctions had moved through the platform.

---

Nobitex issued a flat denial. "Nobitex is a private and independent business," the company said in a statement to Reuters. "It has never been an arm of the government and has never had any relationship, arrangement, agreement, or contract with the Central Bank of Iran, the IRGC, or any other governmental body."

The on-chain record tells a more complicated story. Elliptic documented that Iran's Central Bank purchased $507 million in USDT between April and June 2025, routing payments through Nobitex using UAE Dirhams, a pattern that points to Emirati intermediaries handling the currency leg of each transaction.

TRM Labs, which has tracked the exchange since 2019, puts Nobitex's total transaction volume in the tens of billions of dollars and observed more than $5 billion in activity from 2025 onward.

---

The exchange's political exposure did not develop quietly. The Islamic Revolutionary Guard Corps visited Nobitex's offices shortly after its 2018 opening and questioned its then-CEO, Amir Hosein Rad. The IRGC arrested Rad in 2021, seizing equipment and sealing the office without recorded charges.

Mohammad Bagher Nahvi, Nobitex's former chairman and an early major investor, had connections to Safiran Airport Services, which the US Treasury designated in 2022 for supplying Iranian drones to Russia.

The platform also stayed online during government-imposed internet shutdowns, remaining accessible when only around 1 to 2 percent of Iranians could reach the internet through the state-approved whitelist.

Miad Maleki, a former US Treasury official, offered a blunt assessment of the dynamic: "As soon as a business becomes meaningfully profitable you will see the government coming in and taking its slice. You can't have a successful business in Iran without it being controlled by the regime."

---

In June 2025, the pro-Israel hacker group Gonjeshke Darande, which translates roughly as "Predatory Sparrow," breached Nobitex's systems and stole approximately $90 million in digital assets. The intrusion exposed the exchange's internal wallet structure, including what TRM Labs described as "differentiated handling for high-value and politically connected clients" and infrastructure explicitly built to function under sanctions constraints.

On June 15, 2025, Tether blacklisted wallets linked to Iran's Central Bank, freezing 37 million USDT. The Central Bank subsequently shifted its routing strategy, moving funds through cross-chain bridge services, decentralized exchanges, and multi-hop paths across other centralized platforms to avoid further freezes. TRM Labs has also flagged Nobitex's on-chain connections to Guarantex (a sanctioned Russian exchange), BitPapa (a peer-to-peer trading platform), A7 (a cross-border settlement service), and Gaza Now, a network designated for terrorist fundraising.

---

The story carries direct implications for users and developers across South Asia and Africa. Iran's Central Bank routed its USDT purchases through UAE-based Dirham brokers, the same Gulf hub that Pakistani and Indian traders routinely use as a crypto on-ramp. East African traders, who rely heavily on USDT for remittances and peer-to-peer transactions, face related compliance concerns given the region's deep TRON and USDT adoption, though the precise routing overlap with UAE intermediaries requires further documentation.

India ranks first and Pakistan ranks third in Chainalysis's 2025 Global Crypto Adoption Index.

Both countries have active informal value-transfer networks with long-running UAE connections, and analysts expect regulators at Pakistan's Financial Monitoring Unit and India's Financial Intelligence Unit to face growing pressure to screen against Nobitex-linked wallet addresses.

In Sub-Saharan Africa, where crypto adoption grew 52% in 2025 and USDT on the TRON blockchain is the dominant tool for remittances and peer-to-peer trading, exchanges with limited compliance infrastructure face inadvertent exposure if they do not add flagged addresses to their screening databases. Chainalysis recorded a 694% year-on-year surge in state-driven sanctions evasion volume in 2025, underscoring the growing scale of the enforcement challenge. Iran's total crypto inflows reached an estimated $7.8 to $10 billion that year, and TRM Labs calculated that the IRGC accounted for approximately 50% of all Iran crypto activity in the fourth quarter of 2025 alone.

---

US enforcement has been accelerating around this network. In January 2026, OFAC designated two UK-registered exchanges, Zedcex and Zedxion, for facilitating IRGC crypto transactions, marking the first time the agency specifically targeted digital asset platforms for operating in Iran's financial sector. Separately, the US Department of Justice has been probing exchanges, including Binance, for Iran-related sanctions evasion.

In April 2026, the US froze $344.2 million in USDT linked to Iran's Central Bank, the largest recorded on-chain freeze of Iranian sovereign crypto reserves.

Senator Elizabeth Warren offered a direct assessment of the findings: "This latest reporting is a flashing red light: Adversaries are using digital assets as an alternative to the U.S.-led global financial system."

With OFAC's designation authority now clearly extending to crypto exchanges and stablecoin issuers already acting as enforcement proxies, compliance specialists argue that wallet screening is no longer optional for any platform processing TRON or Ethereum stablecoin flows.