Loading story…
The U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned four Tehran-based cryptocurrency exchanges—Nobitex, Wallex, Bitpin, and Ramzinex—along with several executives and founders, alleging they helped Iran evade sanctions and move regime funds through digital assets. Treasury said Nobitex, Iran's largest exchange, processed more than half of Iranian digital-asset inflows in 2025, enabled the Central Bank of Iran to access hundreds of millions of dollars in stablecoins, and facilitated transactions tied to the Islamic Revolutionary Guard Corps (IRGC), including IRGC-affiliated ransomware operators and other illicit finance activity.
The designations, issued under the Trump administration's Economic Fury campaign, freeze any sanctioned assets under U.S. jurisdiction and bar U.S. persons from dealing with the listed entities and individuals. Treasury described the move as the first time OFAC has individually placed an Iran-incorporated digital-asset exchange on the SDN list, while reporting that Ramzinex alone processed more than $2.45 billion in transactions and that Iran's crypto ecosystem received nearly $7.8 billion in 2025. The action expands U.S. pressure on Iranian financial networks that officials say support sanctions evasion, terrorism-linked finance, and ransomware-related transactions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
In June 2025, the pro-Israel hacking group Predatory Sparrow claimed it breached Nobitex and stole about $90 million in digital assets from the exchange.
The U.S. Treasury Department's Office of Foreign Assets Control sanctioned Nobitex, Wallex, Bitpin, and Ramzinex, along with associated leaders, for allegedly helping Iran evade sanctions and move funds tied to the central bank, IRGC, and IRGC-affiliated ransomware actors. Treasury described it as the first time OFAC individually listed an Iran-incorporated digital-asset exchange on the SDN list and the first entity-level crypto escalation under the Economic Fury campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcethedefiant.io
Open sourcehome.treasury.gov
Open sourceofac.treasury.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Treasury expanded sanctions against Iranian businessman **Babak Morteza Zanjani** and a broader commercial network accused of helping **Zedcex Exchange Ltd.** and **Zedxion Exchange Ltd.** evade sanctions and move funds for Iran’s **Islamic Revolutionary Guard Corps**. The action designated four individuals and nine entities, including **Bahareh Morteza Zanjani**, **Solmaz Bani**, **Mehdi Rezazadeh**, **Sukhrob Oimakhmadov**, **ZEDX DMCC**, **ZedPay**, **BZ Diamond DMCC**, and multiple **Dot One** companies operating across the UAE, Turkey, and Iran. Treasury said the measures extend beyond the exchanges themselves to target a vertically integrated ecosystem spanning digital assets, payments, gold, transportation, aviation, rail, and travel. Reporting on the sanctions says the network used shared leadership, rotating corporate entities, and persistent digital infrastructure to support the exchanges and related commercial operations. TRM Labs previously said Zedcex and Zedxion processed **tens of billions of dollars** in cryptocurrency transactions, while separate reporting linked the exchanges to more than **$10 million** in transfers to **Sa’id Ahmad Muhammad al-Jamal**, a senior Houthi financial official. The sanctions freeze U.S.-based property and interests of the designated parties, prohibit U.S. persons from dealing with them, and expose foreign firms that continue assisting the network to secondary sanctions risk.
Jul 27, 2026
The U.S. Treasury Department’s Office of Foreign Assets Control expanded sanctions on the **Central Bank of Iran** by adding four cryptocurrency wallet addresses as identifiers under an existing designation that also covers the **National Development Fund of Iran**. Treasury had previously sanctioned the bank and fund for providing financial support to the Islamic Revolutionary Guard Corps-Qods Force and other activities tied to Iran’s regional operations. Blockchain analysis cited in reporting said the newly listed wallets received more than **$165 million** in stablecoins, and **Tether** froze about **$131 million** linked to those addresses after the designation update. The action highlights U.S. efforts to disrupt alleged sanctions evasion through digital assets, with reporting stating that wallets attributed to the Central Bank of Iran have been used to move funds to regional partners including **Hezbollah** and that Tether has now frozen nearly **$475 million** tied to OFAC-identified Central Bank of Iran addresses.
Jul 16, 2026
New reporting highlighted the growing role of **cryptocurrency in sanctions evasion and illicit finance**, with 2025 seeing a sharp increase in value received by sanctioned entities and record illicit transaction volume. Chainalysis reported a **694% surge** in value received by sanctioned entities and described nation-state integration of crypto into national financial infrastructure, including **Iranian state-linked activity** (with **IRGC/proxy networks** accounting for over half of value received in Q4 2025) and Russia-linked sanctions workarounds such as the **ruble-backed A7A5 stablecoin**, which processed **$93.3B** in under a year. The same reporting noted sanctions against exchanges **Grinex** and **Meer** for facilitating A7A5-related activity, and assessed that **North Korea stole over $2B in crypto in 2025**, with proceeds reportedly supporting the regime’s **WMD program**; it also pointed to sanctions targeting Southeast Asian scam facilitators tied to “**pig butchering**” operations. Separate analysis of Iran’s crypto ecosystem described **Nobitex** as a major on/off-ramp with **>$5B** in observed volume since 2025 and extensive exposure to sanctioned and high-risk counterparties. TRM Labs said post–Feb. 28 US-Israeli strikes activity (including **>$35M** moved to cold storage) appeared consistent with operational liquidity management rather than user capital flight, and it detailed how a **June 2025 breach (~$90M loss)** revealed a multi-tier custody architecture (hot/warm/cold wallets) and controls for high-value or politically connected clients, alongside structures intended to mitigate sanctions constraints; TRM also observed **~$2.7M** consolidated from dormant mining-linked wallets after the breach, suggesting reserve mobilization to restore liquidity. Other items in the set—an Europol-backed takedown of a gambling-fraud money-laundering ring exploiting Ukrainian women and a US guilty plea by an alleged **Phobos ransomware** administrator—concern cyber-enabled crime but do not materially address the same crypto-sanctions focus, while a TRM post about legislative testimony is primarily an event write-up rather than incident-specific intelligence.
Jun 29, 2026