In the early morning of June 18, 2025, when tens of millions of Chinese people stayed up late to buy discounted goods, Nobitex, Iran's largest crypto exchange, was also "cleared".

A hacker group called Gonjeshke Darande, which means "plundering bird" in Persian, posted on Just the day before, the group had attacked Bank Sepah, one of Iran's largest state-owned banks.

Then they did something rare in the history of hackers.

They transferred the entire 90 million US dollars into 8 "black hole addresses" for destruction. Once entered into these wallets without private keys, funds can never be withdrawn. Ironically, these addresses all have words like "FuckIRGCTerrorists" embedded in them. IRGC is the abbreviation of the Iranian Revolutionary Guard Corps.

Blockchain intelligence company Elliptic later pointed out that to generate such a string of addresses, a hacker would need to violently generate a large number of encryption key pairs until a key pair containing the required text is found. Hackers who are willing to go to such trouble are obviously not financially motivated.

12 hours later, Nobitex's source code and internal documents were all made public.

Independent investigator Nariman Gharib analyzed the documents and found that the $90 million that was destroyed almost exactly matched the IRGC-related funds that had flowed into Nobitex through specific wallets in the previous months.

So, this is not so much theft as an on-chain political operation of targeted killing.

When we talk about encryption in the Middle East, what often comes to our minds are the license plates in Dubai, the Token 2049 venue and the After Party on the Palm Island. However, there is a more secretive and intricate world that is completely unknown to those who don’t live there.

Few people can tell clearly: What exchange do Iranians use? Why do all the Turks speculate on currencies? Why is Kuwait the country with the toughest crackdown on mining in the Middle East?

The story of Nobitex may be a key to the world.

From chemical engineer to Iran's "Zhao Changpeng"

After the United States and Israel went to war against Iran, a piece of news brought Nobitex to the public: within minutes of the airstrike, the exchange's withdrawal volume soared by 873%.

The founder of Nobitex is Amir Rad. He does not have a financial background, but is an engineer who graduated from Sharif University of Technology in chemical engineering. Before starting his own business, he had been doing process safety and risk assessment in the petrochemical industry.

Last year, he appeared on Karnakon Podcast, a popular business podcast in Iran. Interestingly, the name of this program translated into Chinese is roughly: "Don't be a laborer!"

According to Ladd, in 2017, as a crypto retail investor, he founded Nobitex with three friends. The idea at the time was simple: allow Iranian users to recharge with rial and place orders to buy and sell digital assets by themselves. that's all.

But the effect was much better than they expected. Months after launching in 2018, Iranian regulatory hostility to crypto saw Nobitex hit a year-long blanket blockade. But it was so popular that even after being blocked, the platform continued to grow organically at 20% per month.

Today, Nobitex has 11 million registered users, with total inflows of more than $11 billion, more than the next ten Iranian exchanges combined.

What is the concept of 11 million? With a total population of 89 million, one in eight people in Iran is registered on Nobitex. Excluding minors and the elderly, the actual penetration rate is even higher. This number is roughly the same as that of Kraken, a long-established U.S.-compliant exchange.

A chemical engineer built an exchange covering one-eighth of the country's population in eight years. If the story just stopped here, it would be a pretty good entrepreneurial legend.

The wandering financial ghost

But the story doesn't stop here.

Since 2024, open source intelligence has gradually shown that Nobitex's major shareholders include relatives of Supreme Leader Khamenei and business partners of Revolutionary Guards founder Mohsen Rezaee.

Elliptic's on-chain analysis shows that Nobitex has funds flowing with the sanctioned Russian exchange Garantex, Hamas and Houthi armed wallets.

How did a private company become the white glove of the most powerful people? We don't know the tune. But in Iran, this script is not unfamiliar.

Digikala (Iran's version of Amazon) and Snapp (Iran's version of Didi) have both accepted "strategic capital injections" from shell companies associated with the Revolutionary Guards or national telecommunications groups. In this country, when a private enterprise reaches a certain size, someone will come to "help" you.

It's just that the things Nobitex carries are much more sensitive than e-commerce and taxi-hailing.

In the internal documents released by "Plunder Bird", Gharib tracked a special account. The account was responsible for coordinating the flow of tens of millions of dollars from the Revolutionary Guard’s financial network into Nobitex. But unlike the other 11 million users on the platform, it is completely exempt from KYC verification.

Everyone must undergo identity verification, except for accounts that transfer Revolutionary Guard funds.

TRM Labs' analysis of the leaked source code shows that the account was not registered under the identity of an army officer. It is more like an invisible channel in the system, attached to a VIP whitelist under the name of a shell import and export company under the Revolutionary Guards' "Quds Brigade", which specifically serves politically exposed persons.

But overseas, the name of the person connected to this ghost account is no longer a secret. His name is Babak Zanjani.

Cat and mouse game

Zanjani's resume reads like a spy novel: sanctioned by OFAC in 2013, sentenced to death in Iran in 2016 for embezzling billions of dollars in NOC funds, had his sentence commuted in 2024, and was released from prison in 2025.

The U.S. Treasury Department said: He was released just to continue laundering money for the regime.

In May 2021, a company called Zedxion Exchange Ltd was registered in the UK. Five months later, a man named Babak Moteza was listed as director and actual controller.

The U.S. Treasury Department later confirmed that this person was Babak Moteza Zanjani.

In July 2022, Zanjani disappeared from company records. A few days later, Zeccex Exchange Ltd was incorporated at the same London address and under the same successor director.

Both companies claim to be "dormant". On paper there are only nominal directors and a virtual office address.

But the data on the chain is another story entirely. Analysis by TRM Labs shows that Zeccex has processed more than $94 billion in transactions since registration. The two exchanges combined processed approximately $1 billion in funds for the Revolutionary Guards, accounting for 87% of the platform's total volume at its peak in 2024.

Funds circulate on the TRON chain in USDT, shuttling between the Revolutionary Guard wallet, offshore nodes and Nobitex.

OCCRP (Organized Crime and Corruption Reporting Project) investigation unearthed more details. The registered address of the two exchanges, 71-75 Sheldon Street, Covent Garden, London, is a bulk-registered virtual office address, and more than a dozen companies are also registered under the same address, including at least six sanctioned entities.

There is an "executive director" named "Elizabeth Newman" in the official videos of both exchanges. OCCRP found that this person did not exist. The female image in the video comes from a piece of commercial material on the photo gallery website, with the label "Pretty Black woman talking to camera".

Fictional characters, ghost companies, and astronomical amounts of money on the chain. But OCCRP initially had only indirect leads. Although Zanjani’s name appears in Zedxion’s director records and white paper metadata, he has long been removed from all public documents.

The real breakthrough was a cat.

In May 2024, Zedxion's official Telegram channel posted a photo of a gray and white cat with a conspicuous purple bell hanging around its neck. A few months later, a cat with the exact same coat, pattern, and purple bells appeared on the Facebook page of Zanjani’s girlfriend, Solmaz Bani.

Following Barney's line, the reporter found that she was the registrant of the Zedxion e-newsletter domain name, and her name also appeared in Zedcex's email login information. In Zedxion’s official YouTube tutorial video, two names flashed across the auto-fill field: Solmaz, and Babak.

In front of cats, even the Revolutionary Guards' money laundering network has nowhere to hide.

"We endure the darkness, but they are mining Bitcoin"

Remember the $90 million Nobitex burned?

It turned out later that it was probably the money of the Revolutionary Guards. But from the outside, this is a $90 million hole in the accounts of a leading exchange. If not handled in time, a run can happen at any time.

Nobitex's choice is to pay for it themselves.

TRM Labs found that after the hack, Nobitex quickly consolidated approximately $2.7 million from more than 100 long-dormant wallets to alleviate the liquidity crisis. These wallets accumulated mining rewards in 2021 and 2022, with no funds previously transferred, and can be traced upstream to two major global mining pools: EMCD and ViaBTC.

We cannot confirm whether the money is an external blood transfusion or Nobitex's own mining treasury. But the incident provides a glimpse into Iran’s vast mining industry.

Crypto mining in Iran became legal starting in 2019. Licensed miners are allowed to mine Bitcoin using subsidized electricity and sell it all to the central bank, which then uses it to pay for imports, bypassing the dollar system.

The government has set the price for industrial electricity at 0.5 cents per kilowatt-hour, and it costs about $1,320 to produce one Bitcoin. Even though the price of the currency has dropped back to US$60,000 to US$70,000, the profit margin is still astonishing.

This profit margin explains everything that happens next.

Parliament passed a bill in 2022 to allow the military to build private power plants. The Revolutionary Guards directly accessed the electricity originally supplied to the city. Mines are located at military bases and special economic zones. Astan Quds Razavi, a large religious foundation directly controlled by the Supreme Leader, is deeply involved, forming a de facto "mining cartel."

As of 2023, of the approximately 180,000 mining machines in Iran, 100,000 belong to companies affiliated with the state or the Revolutionary Guards.

But Iran is a country that is very short of electricity, and rolling blackouts are not uncommon during extreme weather. Not only have residents’ lives been affected, enduring intense heat or cold, frequent factory shutdowns have also left industrial workers unemployed, and small businesses are also struggling due to unstable power supply. This prompted protest chants such as “We endure the darkness while they mine Bitcoin.”

Where is the mining machine hidden? A popular theory is that of a mosque. In Iran, mosques are legally entitled to free electricity. The 2025 budget bill exempted all Revolutionary Guard bases, Basij centers and mosques from electricity bills, the same year electricity bills for ordinary citizens increased by 38%.

In 2019, an Iranian researcher photographed around 100 mining rigs spread across different rooms in a mosque, fueling this claim.

But there are also practitioners who hold the opposite view. Transformers in urban areas have load limits, and large-scale mining can cause the system to be overloaded or even explode. If the government wants to mine, they certainly have more secluded sites.

No matter where the mining machines are, there is one number that cannot be avoided: the computing power of illegal mining is approximately 400 times that of legal mining. Tavanir, the national power company under the Ministry of Energy of Iran, can only offer a reward for catching miners. The initial reward for reporting each illegal mining machine is 1 million tomans, about 24 US dollars, and later rose to 200 million tomans, about 2,300 US dollars.

People at the bottom turn on each other for $24 and bear the burden of rising electricity bills. And mines with military protection are very popular. When the Energy Department attempted to shut down a mine in 2021, armed members of the Revolutionary Guards were present and physically blocked the raid.

This is the background of Iranian encryption: one country, two sets of rules.

The other side of the bay

As written before, the cost of producing one Bitcoin in Iran is approximately US$1,320. Across the Persian Gulf in Kuwait, the figure is $1,400. In the face of huge profits, some people will take risks, but the Kuwaitis chose their own bedrooms. In order to avoid arousing official suspicion, miners will even choose to turn off the air conditioner at home to conceal the power consumption of the mining machine.

Kuwait will completely ban crypto activities in 2023, but the ban cannot stop profits. In April 2025, the Ministry of Interior raided and seized more than 100 illegal mines, and electricity consumption in the southern Wafra region plummeted by 55% within a week.

The story of mining has different versions in different countries, and so does the story of currency devaluation. Why did Nobitex grow so fast in those years? Because it was precisely when the rial collapsed the most. In 2018, it was 92,000 to 1 US dollar on the black market, and now it has fallen below 1.5 million.

Turkey's lira is following a similar path, with inflation exceeding 30% for a long period of time, and the annual trading volume of USDT/lira on Binance exceeds $22 billion, which is larger than any single Bitcoin trading pair. Turkey will receive nearly $200 billion in crypto assets between 2024 and 2025, and more than half of adults hold crypto assets. If they don’t believe in the local currency, they can only believe in the U.S. dollar on the chain, even if many people don’t like the United States. This happens every day in Tehran and Istanbul.

While some people are struggling to maintain their purchasing power, more countries in the Persian Gulf are already talking about the next era. The UAE has written crypto into the blueprint of the country’s financial infrastructure. Dubai and Abu Dhabi have each established virtual asset regulatory agencies. The dirham stablecoin has been approved to go online. Annual crypto inflows are US$53 billion. The same technology is a survival tool on one side of the bay and a business card for attracting investment on the other side.

But what is booming enough is that the crypto brand event in the Middle East, Token2049 Dubai, originally scheduled to be held in late April, was directly postponed to next year due to the war in Iran.

Israel, the sworn enemy of this attack on Iran, plays a more cold role in the encryption world. The country doesn’t have cheap electricity or the need to use crypto to circumvent sanctions, but it has the highest density of blockchain startups in the world. Many core projects in the field of zero-knowledge proofs come from Israeli teams, and StarkWare is valued at $8 billion in 2025. Although its token, STRK, has dropped by 90% since its launch and has become a representative of death-level projects, the ecosystem has not been used by many people so far.

Same bay, different world, but now they are also involved in the same war. When I finished writing this article, some of the names that appeared in it were no longer there. Khamenei died in an airstrike in late February 2026. Many senior members of the Revolutionary Guards were eliminated in a joint US-Israeli strike. The funds flowing through Nobitex through ghost accounts are still recorded on the chain, but the owner behind the address may have changed batch after batch. Nine hundred years ago, the Persian poet Khayyam wrote in the Rubaiyat:

In the palace where Jamshid toasted and feasted

Now the doe is giving birth,The lion lives there

The Bahram who hunted wild ass all his life

Now captured in the grave, sleeping on the ground

Encryption has never been a thing in the Middle East. It's many things. It’s a compliance license plate in an office building in Dubai, a life preserver after the depreciation of the lira on the streets of Ankara, the sound of a fan suspected to be coming from the basement of a mosque in Isfahan, the $94 billion behind a virtual address in Covent Garden, a cat with a purple bell.

Many years from now, when people look back at this encrypted past in the Middle East, they may be surprised that it contains both the most advanced technology and the oldest conflicts of this era. But for ordinary people in the Middle East who are still depositing their meager salaries into Nobitex to preserve value, this is not the past, this is their today.

(Full text completed)