PRIMARYEXCHANGE
Nobitex
IR · SDGT + IRAN-EO13902 · >50% of 2025 inflows ($4.7B) · the rial-to-USDT conversion node · ~11M accounts
13edges
12sources
3flags
5
Key Judgments
thesis-level
6
Entities
resolved
15
Relationships
graph edges
15
Sources
graded
4
Assumptions
key-assumptions check
A1
Top Admiralty
reliability / credibility
HIGH
Confidence
designation thesis
Bottom line up front
The 2 June OFAC designation of Nobitex, Wallex, Bitpin, and Ramzinex is almost certainly built to make the global banking and stablecoin system enforce the sanction itself, not to block a wallet list.[A1] Nobitex almost certainly served as Iran's primary rial-to-USDT conversion node — including the Central Bank's defense of the rial through at least $507M in USDT routed and sold for rials.[A2] Because OFAC named entities, rails, and the people who run them rather than addresses, blocklist-only screening is very likely insufficient; the weight sits in FAQ 1257 secondary reach onto foreign banks and VASPs.[A1] On the Garantex-to-Grinex precedent, the action very likely displaces Iranian flows toward undesignated venues and freeze-resistant assets rather than eliminating them.[A2]
5 Key Judgments
KJ-01
Nobitex almost certainly served as the primary rial-to-USDT conversion node in Iran's stablecoin pipeline, including for the Central Bank's defense of the rial through at least $507M in routed USDT.
Confidence: HighSources: A1 · A2, convergent
KJ-02
The action almost certainly creates immediate secondary-sanctions exposure for non-US foreign financial institutions and VASPs that process significant transactions with the four exchanges, independent of any blocklist, via FAQ 1257, E.O. 13902, and the 2012 NDAA.
Confidence: HighSources: A1, primary
KJ-03
Designating entities, rails, and named persons rather than wallet addresses very likely renders address-blocklist-only screening insufficient for compliance; clearing exposure requires tracing counterparty rails that touch the cluster.
Confidence: HighSources: A1 · A2
KJ-04
On the Garantex-to-Grinex precedent, the action very likely displaces Iranian flows toward undesignated venues and freeze-resistant assets rather than eliminating them; a Nobitex successor and a drift to unnamed exchanges are the most likely next chapter.
Confidence: ModerateSources: A2, analytic analogy
KJ-05
Tether is almost certainly both the largest evasion rail and the single most effective freeze point, and very likely faces escalating U.S. legislative and oversight pressure to police Iran-linked USDT.
Confidence: ModerateSources: A1 · B2
4 Competing Hypotheses
click evidence to test diagnosticity| Evidence · click to toggle | H1Financial interdiction | H2Systemic de-risking | H3Coercive signaling | H4Flows displace, not denied |
|---|---|---|---|---|
| FAQ 1257 secondary reach deputizes foreign banks | – | + | + | · |
| Nobitex already wrecked by June 2025 hack | −− | + | + | + |
| Iranian volumes historically resilient (~$10B) | −− | + | · | + |
| Four individuals named, incl. supreme-leader-tied family | · | + | + | · |
| Standing machinery: 1257, NDAA, 50% rule, issuer duties | – | + | – | · |
| Garantex-to-Grinex displacement precedent | · | · | · | + |
| Inconsistency score | 6 | 0 SURVIVES | 1 | 0 SURVIVES |
+Consistent–Inconsistent−−Strongly inconsistent·Neutral
Result: H2 and H4 survive with the fewest inconsistencies (0). Toggle evidence to test how each item discriminates between hypotheses.
6 Entities of Interest
6 resolved · sorted by centralitySOVEREIGNCOUNTERPARTY
Central Bank of Iran
Acquired ≥$507M USDT routed via Nobitex to defend the rial · $344M later frozen by Tether (Apr 2026)
3edges
6sources
1flags
STATEBENEFICIARY
IRGC
IR · SDGT · cited beneficiary in the designation · ransomware and proxy settlement nexus
5edges
7sources
0flags
INFRASTABLECOIN
USDT · Tether
Settlement rail and the only effective freeze point · El Salvador domicile · outside GENIUS audit perimeter
5edges
8sources
0flags
PERSONDESIGNATED
S. M. Aghamir (Kharrazi)
Blockchain lead · SDGT · authored the address-validation software · Kharrazi family by marriage to the supreme leaders
3edges
4sources
1flags
SUCCESSORPRECEDENT
Garantex / Grinex
RU · sanctioned · on-chain interaction with Nobitex · the displacement-by-rebrand precedent (A7A5 ruble stablecoin)
2edges
4sources
1flags
Attributed Volume Signals
2025 on-chain attribution, TRM LabsExchange share of Iran volume
$4.7BNobitex
$1.45BWallex
$B · 2025 attributed inflows
CBI USDT rail vs. frozen
$507MAcquired
$344MFrozen
$M · acquired vs. frozen by Tether
Hack burn to vanity sink
~$90MBurned
$0.94MUSDT tx
$M · drained 18 Jun 2025
Relationship Graph
⌘/Ctrl-scroll to zoom · drag to panPrimary subjectOrganisationRail / infraState / enforcementPerson
Geospatial
stablecoin routing · chokepointsstablecoin routing · chokepoints⌘/Ctrl-scroll to zoom · drag to pan
Chronology
indications & warning · hover a marker, click to jump04 Jun 2026
Sen. Blumenthal opens a probe of Tether's role in Iran's shadow banking
RESPONSE / US / U.S. Senate · graded B2
02 Jun 2026
OFAC designates Nobitex, Wallex, Bitpin, Ramzinex + 4 executives (E.O. 13224/13902)
ENFORCEMENT / US / Treasury SB0519 · graded A1
01 May 2026
Reuters: Kharrazi-family ownership; ≥$2.3B in parallel CBI/IRGC finance since 2023
PIPELINE / IR / Reuters · graded A2
24 Apr 2026
OFAC designates two CBI wallets; $344M USDT frozen by Tether
ENFORCEMENT / US / OFAC · TRM · graded A1
30 Jan 2026
OFAC designates Zedcex & Zedxion — first IRGC-linked exchange (~$1B routed)
ENFORCEMENT / US / TRM Labs · graded A1
15 Jan 2026
Elliptic: CBI acquired ≥$507M USDT, most routed via Nobitex and sold for rials
PIPELINE / IR / Elliptic · graded A2
19 Jun 2025
Predatory Sparrow publishes Nobitex source code and configuration files
FORENSIC / n/a / TRM Labs · graded A2
18 Jun 2025
Predatory Sparrow breaches Nobitex; ~$90M drained and burned to vanity sinks
FORENSIC / n/a / Elliptic · graded A2
Evidence Register
8 sources · graded| Source | Details | Type | Admiralty | Date |
|---|---|---|---|---|
| U.S. Treasury — press release SB0519 ('Economic Fury')↗ | Primary designation: IRGC and ransomware nexus, CBI stablecoin pipeline | Sanctions · Gov | A1 | Jun 2026 |
| Federal Register — 91 FR 34721↗ | SDN entries for the four exchanges and four named individuals | Primary · Registry | A1 | Jun 2026 |
| OFAC — FAQ 1257↗ | Secondary-sanctions guidance for non-US persons and FFIs | Primary · Guidance | A1 | Jun 2026 |
| Etherscan — Ethereum mainnet (self-collected)↗ | On-chain burn manifest: drained Nobitex assets into the vanity sink | Primary · On-chain | A1 | Jun 2025 |
| Elliptic — Nobitex designation analysis↗ | CBI $507M USDT rail; Garantex, Hamas, DPRK and Syria links | Forensics | A2 | Jun 2026 |
| TRM Labs — Three enforcement layers in five months↗ | Volume attribution, the Aghamir code authorship, FAQ 1257 mechanics | Forensics | A2 | Jun 2026 |
| Reuters — investigation↗ | Kharrazi-family ownership; parallel finance for CBI/IRGC; ≥$2.3B since 2023 | Press | A2 | May 2026 |
| Crystal Intelligence — Garantex re-emerges as Grinex↗ | Displacement precedent: pre-positioned successor domain and stablecoin | Forensics | A2 | Nov 2025 |