US Treasury Targets Major Iranian Cryptocurrency Exchanges in Sweeping Sanctions Crackdown

The United States Department of the Treasury's Office of Foreign Assets Control (OFAC) has imposed sanctions on four of Iran's most significant cryptocurrency trading platforms, accusing them of enabling illicit financial activity, supporting terrorism-related financing, and assisting in the circumvention of international economic restrictions. The action specifically names Nobitex, the country's largest digital asset exchange by market share, along with Wallex, Bitpin, and Ramzinex. As a result of the designations, the platforms are effectively barred from participating in the international financial system.

According to US authorities, the exchanges functioned as alternative financial channels for the Iranian state, processing extensive volumes of cryptocurrency transactions allegedly linked to the Islamic Revolutionary Guard Corps (IRGC) and a range of state-associated cybercriminal actors. Utilizing authorities granted under counterterrorism and sanctions legislation, the US government has ordered the immediate blocking of all property and interests in property connected to the designated entities that fall within domestic jurisdiction. Financial institutions and service providers worldwide now face heightened compliance obligations, substantial regulatory risks, and possible secondary sanctions exposure should they continue conducting business with the sanctioned exchanges.

The enforcement action reflects OFAC's broader strategy of using advanced financial intelligence and transaction tracing capabilities to isolate digital asset platforms that authorities believe combine legitimate cryptocurrency services with state-sponsored illicit financial activity. Central to the investigation is Nobitex, which reportedly handled more than half of all inbound cryptocurrency activity within Iran during the previous year. Regulators contend that the platform's dominant market position enabled it to serve as a critical mechanism for obscuring the origins, destinations, and beneficial ownership of funds transferred across borders. Operating beyond many internationally recognized compliance standards, the exchange allegedly created an environment in which individuals and organizations connected to the IRGC could move assets without activating conventional anti-money laundering monitoring systems or institutional compliance reviews.

Investigators further allege that the operational structure supporting this activity relied heavily on the combination of domestic fiat-currency services and decentralized blockchain networks. Through this model, Iranian state actors were reportedly able to convert local funds into globally liquid digital assets that could circulate outside traditional banking channels. Regulatory filings claim that Nobitex maintained close cooperation with the Central Bank of Iran, facilitating access to hundreds of millions of dollars in stablecoins linked to fiat currencies. Authorities assert that these activities were intended in part to provide support for the Iranian rial, which has faced sustained pressure as a consequence of economic isolation and sanctions. Stablecoin transactions allegedly enabled the development of a parallel financial infrastructure that reduced reliance on the conventional SWIFT banking network and weakened the effectiveness of traditional banking restrictions.

Beyond its alleged role in supporting national economic objectives, the exchange is also accused of acting as a processing hub for cybercriminal organizations connected to the Iranian state. Regulatory findings indicate that ransomware operators linked to government interests routinely deposited extortion proceeds into wallets controlled by the exchange. Once received, those assets were reportedly mixed into broader liquidity pools before being converted into fiat currency or exchanged for alternative digital assets. Authorities argue that this process demonstrates how state actors can leverage cryptocurrency infrastructure to create durable financial ecosystems capable of functioning outside established regulatory frameworks. In response, OFAC has added the exchange itself, its principal founders, and senior executives—including former chief executive Amir Hossein Rad—to the Specially Designated Nationals (SDN) list.

The sanctions extend beyond a single exchange and reveal what regulators describe as a diversified cryptocurrency ecosystem designed to survive targeted enforcement actions. Wallex, identified as the second-largest cryptocurrency platform in the country, reportedly processed approximately 12 percent of inbound virtual asset flows and served as an important secondary channel for larger transactions. Bitpin accounted for roughly 10 percent of incoming activity, while Ramzinex handled significant independent transaction volumes and reportedly processed more than $2.5 billion in cumulative transactions over the course of its operations. Collectively, authorities believe the four exchanges formed a distributed network that spread financial activity across multiple platforms, reducing the impact that any single enforcement action might have on overall operations.

Investigators also point to what they describe as a close relationship between the leadership of these platforms and influential figures within Iran's political establishment. Regulatory reviews indicate that several founders and senior technology executives, including Seyed Mohammad Ali Aghamir Mohammad Ali and blockchain specialist Seyed Mohammad Aghamir Mohammad Ali, maintain connections to individuals within the country's highest leadership circles. Authorities contend that these relationships ensured the strategic priorities of the exchanges remained closely aligned with broader state objectives. According to the findings, periods of international tension or domestic instability often prompted coordinated efforts to move significant volumes of assets outside the country in order to shield them from potential freezes or economic disruptions. Such transfers allegedly occurred even during periods in which internet access within the country was heavily restricted.

The investigation further highlights the sophisticated methods allegedly employed to integrate cryptocurrency exchanges with traditional state-backed financial institutions. By establishing deep liquidity reserves in stablecoins and major digital assets, the platforms enabled politically connected users to gain access to international trading venues. Regulators describe the use of nested exchange arrangements as a particularly important component of this system. Under this model, a locally operating exchange opens accounts at larger foreign trading venues through intermediary corporate entities, concealing the true source of the transactions. Authorities argue that such arrangements allowed sanctioned individuals to access global liquidity, acquire foreign goods, and finance external activities while avoiding conventional compliance screening mechanisms.

The legal basis for the sanctions rests on a combination of longstanding executive authorities focused on terrorism financing and sector-specific restrictions. OFAC invoked Executive Order 13224, which targets international terrorism, alongside Executive Order 13902, which addresses activities involving Iran's financial sector. Through these measures, US authorities have established comprehensive restrictions around the designated entities. All property, accounts, and financial interests under US jurisdiction or controlled by US persons must be blocked immediately. Furthermore, any organization that is owned, directly or indirectly, by 50 percent or more by one or more designated parties becomes subject to automatic blocking under established sanctions guidance.

The consequences for financial institutions, cryptocurrency service providers, and intermediaries operating internationally are substantial. US sanctions regulations generally function under a strict liability framework, meaning organizations may face significant civil penalties for engaging in prohibited transactions regardless of whether they knowingly violated the restrictions. Foreign banks and financial institutions that intentionally facilitate substantial transactions involving the sanctioned exchanges also risk becoming targets of secondary sanctions, potentially losing access to the US financial system. This enforcement approach places international businesses in a position where they must choose between maintaining relationships with high-risk cryptocurrency platforms and preserving access to global financial markets.

To reinforce the effectiveness of the sanctions campaign, US authorities have linked the designations to broader incentive programs aimed at dismantling the financial infrastructure supporting the IRGC. The Department of State continues to offer rewards of up to $15 million for information that contributes to disrupting financial networks connected to the organization. At the same time, the Financial Crimes Enforcement Network (FinCEN) operates a whistleblower program that provides financial rewards to individuals who supply information leading to successful enforcement actions involving sanctions violations or anti-money laundering failures. Officials view these initiatives as powerful tools for encouraging insiders, compliance personnel, and technology professionals to expose hidden financial networks and unlawful activity.

Financial crime specialists and blockchain investigators are being encouraged to monitor transaction activity for patterns that may indicate interaction with the sanctioned ecosystem. Particular attention is being directed toward nested exchange arrangements in which virtual asset service providers operate under vague corporate identities while generating transaction volumes consistent with large exchange businesses. Analysts also consider repeated stablecoin transfers originating from unhosted wallets and quickly routed toward entities in high-risk jurisdictions to be significant warning signs. Additional indicators include transaction paths that converge with known ransomware payment wallets before entering large corporate liquidity pools and ultimately being converted into fiat currency.

Investigators also caution institutions to scrutinize users who consistently access cryptocurrency services through virtual private networks, anonymity tools, or onion-routing technologies from areas bordering sanctioned jurisdictions. Finally, authorities highlight sudden surges in outbound digital asset transfers during periods of geopolitical instability or widespread communication disruptions as another important behavioral pattern that may signal attempts to move or protect assets connected to sanctioned networks.

Through this sweeping enforcement action, US regulators aim not only to isolate specific cryptocurrency platforms but also to disrupt what they characterize as an extensive financial infrastructure supporting sanctions evasion, cybercrime, and state-sponsored illicit finance on an international scale.

By fLEXI tEAM