Billions in Iranian cryptocurrency on the global market: sanctions risks and compliance challenges

On-chain data shows that after the first US and Israeli strikes on Iran, cryptocurrency outflows from Nobitex — the country’s largest crypto platform — surged sharply. GetBlock AML Research explains how the crisis in the Middle East has affected the crypto market and what compliance teams should do in this situation.

Sharp spike in cryptocurrency outflows from Nobitex on February 28. Visualization: Elliptic

The Nobitex platform and its role in Iran’s cryptocurrency ecosystem

In 2025, approximately $7.2 billion in cryptocurrency transactions passed through Nobitex. The platform has more than 11 million users and plays a key role in Iran’s cryptocurrency ecosystem. It has previously been linked to financial activities associated with entities close to the Islamic Revolutionary Guard Corps (IRGC). In January, reports also emerged that Nobitex may have been used by the Central Bank of Iran to support the sharply weakening national currency, the rial.

How Iran’s Nobitex exchange lost more than $80 million. Chronology of the hack

The trading platform was hacked by the pro-Israeli hacker group Predatory Sparrow

Читать дальше

Growth of cryptocurrency outflows from Iran through Nobitex

The sharp increase in cryptocurrency withdrawals last Saturday (February 28) may indicate attempts to move capital out of the country on a large scale. Nobitex allows users to exchange rials for cryptocurrency, after which the funds can be transferred to any external crypto wallet. This makes it possible to move money outside Iran, bypassing part of the controls that exist in the international banking system. Preliminary analysis shows that recent transfers from Nobitex were directed to overseas crypto exchanges, which have previously received significant volumes of funds from Iran.

Other spikes in withdrawals from Nobitex have also been observed since the beginning of the year. The largest occurred on January 9 — immediately after mass protests in Iran and the subsequent internet shutdown organized by the authorities. During that period, withdrawal volumes temporarily declined, directly linked to restricted internet access. However, even during the internet blackout, some transfers were recorded, which may indicate the ability to access the exchange’s crypto assets even when its website was unavailable.

Iranians are withdrawing cryptocurrency en masse to personal wallets. Why is this happening?

There has been a sharp surge in activity among Iranian cryptocurrency users amid mass protests in the country and the high probability of a military confrontation with the United States.

Читать дальше

Military escalation and the risk of new sanctions against Iran

The escalation of military activity by the United States and Israel related to Iran increases the likelihood of new sanctions and stronger enforcement efforts in different countries.

Although sanctions against Iran have been in place for decades, periods of heightened tensions and conflict have historically led to stricter financial and economic restrictions, the expansion of sanctions lists, and increased requirements for financial companies to prevent illegal transactions.

At the same time, in recent years Iran has increasingly used cryptocurrencies as another way to bypass banking and financial restrictions. In January, research indicated that the Central Bank of Iran purchased at least $500 million in the stablecoin USDT as part of efforts to circumvent sanctions and support the national currency — the Iranian rial.

Iranian Authorities Bought Over $500 Million in USDT to Support the Rial

Iranian authorities turned to the popular stablecoin USDT to bypass international sanctions and stabilize the country’s national currency.

Читать дальше

Also in January, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) imposed sanctions on two Iran-linked crypto exchanges — Zedcex and Zedxion, registered in the United Kingdom — for facilitating transactions for the Islamic Revolutionary Guard Corps (IRGC).

It had previously been reported that the IRGC used cryptocurrencies to finance its allied groups in the region. In addition, Iran has been found to conduct large-scale bitcoin mining using its domestic energy resources.

For compliance specialists (sanctions compliance) working at crypto exchanges, stablecoin issuers, payment services, and traditional financial institutions, the conclusion is clear: managing risks related to Iran must become a priority in the current environment. Below are three practical steps that can be taken immediately.

New pressure on Iran: the US sanctions crypto exchanges Zedcex and Zedxion

For the first time, US sanctions target crypto trading platforms linked to Iran rather than individual wallet addresses. The move signals a tougher stance on Iran’s use of crypto to bypass restrictions.

Читать дальше

What sanctions apply to Iran and crypto platforms

Iran is subject to a broad and complex sanctions regime, including longstanding U.S. restrictions as well as significant measures imposed by the European Union, the United Kingdom, and other countries.

For many companies, the main risk lies not only in direct dealings with individuals or entities on sanctions lists but also in indirect interactions — through clients, partners, intermediaries, and transaction chains on the blockchain. Companies operating internationally should consider the following restrictions:

Broad prohibitions on interactions with Iranian financial institutions. Even indirect dealings with Iranian crypto exchanges that are not directly listed under sanctions may lead to violations for companies required to comply with U.S. law and may also create the risk of secondary sanctions for foreign companies.

Targeted sanctions imposed by the United States, the EU, the United Kingdom, and other countries against specific individuals and organizations in Iran using cryptocurrencies. These include the IRGC, weapons procurement networks, entities involved in illegal oil sales, cybercriminals, and the exchanges mentioned above. Both direct and indirect transactions with such persons and their assets are prohibited.

How to Bypass Sanctions and Launder Crypto: An Iranian Businessman Shows How

Crypto compliance systems have once again shown their limitations. An Iranian businessman has revealed a scheme that allows international sanctions to be bypassed and cryptocurrency to be laundered with little risk of consequences.

Читать дальше

Sanctions against Iran’s allied organizations, including groups designated as terrorist organizations — such as Hezbollah in Lebanon, Hamas in Gaza, and the Houthis in Yemen.

In practice, geopolitical escalation may lead to the following developments relevant for compliance professionals:

• A higher probability of new sanctions — including against companies and individuals linked to defense procurement, shipping, illicit financial operations, cyber activity, and Iran’s regional allies.
• An increase in sanctions evasion attempts — using stablecoins, cross-chain transfers, over-the-counter intermediaries, complex transaction chains, and crypto services in third countries.
• Greater activity from private investors in Iran seeking to move funds abroad (“capital flight”), which increases the risk of interactions with Iranian exchanges and services.

In addition, regulators and law enforcement agencies may tighten requirements for reviewing transactions linked to Iran. This includes deeper blockchain transaction analysis rather than simply checking addresses against sanctions lists.

What compliance teams should do: three steps to reduce sanctions risks

Given the rapidly evolving situation and the multi-layered nature of sanctions against Iran, compliance professionals should consider three steps.

1. Assess sanctions risks and client connections to Iran

Compliance teams should review client information (KYC — customer identification procedures), past reports on blocked transactions and suspicious activity, as well as the results of recent wallet and transaction checks.

The goal is to understand where the company may be exposed to higher risks and determine whether additional controls are required.

Questions for analysis:

• Are there direct or indirect transactions with Iranian exchanges, wallets associated with Iranian government entities, or other known Iranian market participants? If so, how effectively does the company identify such transactions?
• Are there clients conducting business with Iran or showing indicators of Iranian connections that may have been overlooked? For example, do their transactions show unusually high activity involving Iranian services?
• Are there risks linked to other countries in the region where high-risk transactions have historically been observed?
• Are there signs of sanctions evasion schemes — such as a sharp increase in stablecoin transfers, complex transaction chains across different services, or transfers between multiple blockchains?
• Have there been past cases of reporting, blocking transactions, or terminating client relationships due to Iranian connections? Do certain patterns repeat?

Based on the results of the analysis, companies may:

• Adjust their internal client risk assessments
• Update sanctions policies and procedures
• Reconsider whether to continue working with certain clients or products
• Provide additional employee training

2. Strengthen transaction and wallet screening

After reassessing risks, it is necessary to ensure that wallet screening and transaction monitoring systems are adapted to the rapidly changing environment.

It is important that systems identify not only direct transactions with sanctioned persons but also indirect links through multiple intermediary transfers. The UK’s Office of Financial Sanctions Implementation (OFSI), for example, states that companies should review transactions at a distance of at least 3–5 “hops” on the blockchain.

Behavioral indicators of sanctions evasion should also be considered — including the use of so-called “smurfing chains,” transaction mixing services, and other methods used to conceal transaction trails.

Special attention should also be paid to geographic risks. In the current situation, this means heightened scrutiny not only of Iran but also of countries such as Yemen, Lebanon, Syria, and other regions with elevated sanctions risks.

3. Regularly re-screen clients and transactions

Sanctions screening is not a one-time action. Client and transaction data must be reviewed regularly. Re-screening wallets and transactions allows companies to detect changes in a timely manner — for example, if a previously “clean” address later becomes linked to a sanctioned individual.

Companies should determine the frequency and scope of such reviews in order to respond quickly to new risks and take appropriate measures.