Nobitex

Is Nobitex safe?

For most readers the answer is no, and the reason is legal more than technical. Since 2 June 2026 Nobitex, Iran's largest crypto exchange, has been on the US Treasury's list of Specially Designated Nationals. The Treasury says it processed more than half of all crypto flowing into Iran in 2025 and handled payments linked to the Islamic Revolutionary Guard Corps (IRGC), including wallets tied to IRGC-affiliated ransomware actors. A year earlier, attackers wiped out more than $90 million of its hot-walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary funds.

We score it 30/100, just below WazirX (31), whose 2024 hack losses were passed on to users, and below HTX (39). It is the only exchange in our ranking whose operator is itself under US sanctions.

What the US sanctions mean for users

OFAC designated Nobitex under Executive Order 13224 (counterterrorism) and Executive Order 13902 (Iran's financial sector). It also listed chairman and former CEO Amir Hossein Rad, current CEO Seyed Ali Khoee and two co-founders. The Treasury's release says Nobitex helped the Central Bank of Iran obtain hundreds of millions of dollars in stablecoins and helped move regime wealth out of the country during internet blackouts.

The practical effects:

• US persons may not deal with Nobitex, and any of its property under US control is blocked.
• OFAC's FAQ 1257, updated on 7 August 2026, warns that foreign banks and other non-US firms that transact with Nobitex, Wallex, Bitpin, Ramzinex or Aban Tether may themselves face sanctions.
• Coins sent from a Nobitex wallet to a global exchange can be flagged by compliance tools and frozen. Stablecoin issuers can freeze tokens at addresses they link to sanctioned parties.

For an Iranian resident, the designation does not shut the exchange inside Iran. It does make getting money out to the wider crypto world harder and riskier.

The June 2025 hack

On 18 June 2025, amid escalating hostilities between Israel and Iran, more than $90 million in bitcoin, ether, dogecoin, XRP, Solana, Tron and TON left Nobitex wallets. Elliptic found the money had gone to vanity addresses spelling out an insult to the IRGC. Generating keys for addresses with such long text strings is computationally infeasible, so, in Elliptic's analysis, nobody holds the keys and the coins are gone for good. Chainalysis reached the same conclusion, calling it the first hack of this size carried out purely for geopolitical ends.

The pro-Israel group Gonjeshke Darande (Predatory Sparrow) had warned that it would attack Nobitex and publish its source code, and the next day it posted what it said was the full code. Elliptic noted there was no confirmation that the group itself moved the funds. Nobitex took its site and app offline, said that most user funds were in cold walletsCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary, and pledged to cover the loss from an insurance fund and its own resources. The Treasury later said Rad helped Nobitex rebuild its operations after the hack.

What we could not find is proof that every customer was made whole. The exchange reopened, but there was no outside audit or post-mortem, and the leaked source code is a lasting risk if any of it is still in use.

Proof of reserves without an auditor

Nobitex deserves some credit here. Its Sigma-B system, built by its research arm Nobitex Labs, places every customer balance in a "liabilities tree", sums them to a total at the root, and uses zero-knowledge proofs to show that Nobitex controls addresses holding more than that total. A logged-in user can install a browser extension and check that their own balance is in the tree for a chosen date.

That is more than many exchanges publish, and it includes liabilities. But Nobitex designed and runs the whole system, with no accounting firm or independent auditor checking it, and we could not confirm how often it is refreshed.

Who should be careful

• Anyone outside Iran. Dealing with a sanctioned entity carries legal risk, and your other exchange or bank may freeze funds that touched Nobitex. Take legal advice before doing anything.
• Iranian users. Keep only what you are trading on the exchange. Move savings to a wallet you control, and check the deposit address with a small amount first.
• Holders of stablecoins. Tokens on addresses linked to Nobitex can be frozen by the issuer, regardless of what Nobitex does.
• Everyone. Use app-based two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary and an address allowlist.

How we scored it

Legal record (5) and licensing (10) are the weakest factors: the company and its leaders are under US counterterrorism and Iran sanctions, and it holds no licence from a strict regulator. Reserves (50) is the strongest, because its proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary includes liabilities and lets users check their balance, though no outsider verifies it. Security history (45) reflects a $90 million loss with only the company's word on reimbursement. Confidence is medium: the sanctions and hack figures come from the Treasury and named analytics firms, while Iranian sources were thin.