Executive Summary

The Iranian regime is currently grappling with an unprecedented economic and energy crisis that is directly impacting its domestic, regional, and international policies. One of the clearest manifestations of this crisis is the severe damage inflicted on the financial system during the war with Israel—particularly in the sphere of cryptocurrencies. Cyberattacks targeted both central banks and Nobitex, Iran’s largest crypto exchange, from which approximately $90 million was stolen in a June 2025 cyberattack. As a result, crypto trading volume in Iran fell by about 70 percent in July 2025 compared to the previous year.

In addition, Israeli and U.S. authorities have recently taken measures against Iranian financing infrastructures that rely on cryptocurrencies. In September 2025, Israel’s National Bureau for Counter-Terror Financing (NBCTF) announced the addresses of 187 USDT wallets it had identified as belonging to the IRGC.[1] Following the disclosure, the UK-based compliance firm Elliptic published an analysis showing that these wallets had received $1.5 billion in USDT. The analysis noted, however, that it could not determine whether the funds had in fact been used by the IRGC.[2]

At the same time, the U.S. Treasury Department issued designations against a broad Iranian oil-export network that was evading American sanctions. This network employed a wide array of front companies operating in multiple countries to facilitate illicit trade in Iranian oil. According to the announcement, two Iranian nationals played a central role in the scheme by purchasing roughly $100 million worth of cryptocurrencies between 2023 and 2025 as payment to the Iranian government for oil. The network’s cryptocurrency fundraising activity was also used by the regime to transfer money to Hezbollah-linked entities, thereby contributing not only to sanctions evasion but also directly to the financing of terrorism.[3]

This paper examines the consequences of the June 2025 cyberattack on Nobitex for Iran’s ability to rely on cryptocurrencies to preserve economic and social stability, as well as to facilitate strategic trade—including in security and military components—at a time of continued international sanctions.

The developments in Iran’s crypto sector highlight its growing importance for the Iranian economy—both for those seeking to evade the international sanctions regime, including regime actors such as the IRGC and oil traders, and for ordinary citizens trying to preserve the value of their savings. At the same time, they underscore the vulnerabilities and problems inherent in relying on cryptocurrencies, as well as the importance of U.S. and Israeli efforts to address this system in order to prevent its illicit use by the regime and to undermine it.

Iran’s Economic Crisis and the Place of Cryptocurrencies in Its Economy

High inflation in Iran, driven largely by U.S. sanctions imposed after Washington’s withdrawal from the JCPOA nuclear deal in 2018, has forced ordinary citizens to seek ways to preserve the value of their savings, which have consistently eroded. Traditionally, two main tools have served this purpose: the purchase of gold and foreign currency (primarily U.S. dollars). Iranians buy and hold these assets, converting them back into local currency when needed. In recent years, however, many have also turned to cryptocurrencies.[4]

Because sanctions have led to ordinary Iranians being cut off from international financial institutions where cryptocurrencies can be purchased, most trading is conducted through local Iranian crypto exchanges. These exchanges convert the Iranian rial into digital currencies, enabling citizens to trade and thus serving as a key role in enabling the Iranian public to manage economic instability.

In addition to private citizens, Iranian authorities—especially security agencies—also use cryptocurrencies to purchase equipment, finance proxies, and pay operatives abroad, thereby circumventing sanctions. As we shall show below, following the Nobitex attack, the U.S. firm Tether, which issues the USDT stablecoin, froze wallets linked to Nobitex and to the Islamic Revolutionary Guard Corps (IRGC). These wallets had been exposed by the NBCTF.

This is not the first time Iranian security structures have been caught using digital assets. In September 2025, U.S. authorities seized about $584,000 in USDT linked to Mohammad Abedini Najafabadi. Abedini is CEO of San’at va Danesh Rahpooyan Aflak (SDRA Co.),[5] a company that supplies navigation systems to Iran’s military drone industry.[6]

Abedini, 39, a Tehran resident and founder and CEO of the company, had previously been indicted in the United States for “providing material support to a foreign terrorist organization, the IRGC Aerospace Force,” according to the Iran International website. He was arrested in Milan, Italy in December 2024 at Washington’s request, but released in January 2025 after Iran detained Italian journalist Cecilia Sala three days after his arrest. The investigation reportedly stemmed from an Iranian drone strike on a U.S. base in Jordan in January 2024 that killed three soldiers and wounded about 40.[7]

In addition, Israeli and U.S. authorities have recently taken steps against Iranian financing infrastructures that make use of cryptocurrencies:

In September 2025 Israel’s NBCTF revealed the addresses of 187 USDT wallets it had identified as belonging to the IRGC.[8] Following the disclosure, the UK-based crypto compliance firm Elliptic published an analysis showing that these wallets had received $1.5 billion in USDT. The report noted, however, that it could not determine whether the funds had actually been used by the IRGC.[9]

At the same time, the U.S. Treasury Department issued designations against an Iranian oil-export network that was evading American sanctions. This network relied on a wide range of front companies operating in multiple countries to facilitate illicit trade in Iranian oil. According to the announcement, two Iranian nationals played a significant role in the scheme by purchasing approximately $100 million worth of cryptocurrencies between 2023 and 2025 as payment to the Iranian government for oil. The statement further noted that this cryptocurrency fundraising infrastructure was also used by the Iranian regime to transfer funds to Hezbollah-linked entities, thereby contributing not only to sanctions evasion but also directly to the financing of terrorism.[10]

The Vulnerabilities of Cryptocurrencies

The main weakness of cryptocurrencies, compared to gold or cash, is their built-in susceptibility to cyberattacks. Unlike official currencies, crypto assets can be stolen relatively easily by hacking into the servers of exchanges that manage client transactions, or by breaching individual wallets. Since no regulator oversees cryptocurrencies, once assets are stolen, no enforcement authority can reverse the theft or restore the stolen funds.

This structural flaw has made crypto a prime target for hackers, particularly those linked to North Korea. One of the most notorious breaches in recent years was of Dubai-based ByBit, where hackers stole $1.5 billion worth of crypto—one of the largest such thefts in recent memory.[11]

The Nobitex Exchange

Nobitex was founded in Iran in 2018 by four co-founders and is believed today to be owned by Rahkar Fanavari Novian.[12] According to TRM data, as of 2025 Nobitex is the largest crypto exchange in Iran by trading volume, accounting for more than 87 percent of all crypto transactions in the country.[13] Nobitex was also the first Iranian exchange to allow decentralized peer-to-peer trading, enabling clients to transact independently[14]—a feature that deepened its financial role in Iran (as detailed later in this paper).

In recent years, Nobitex has drawn the attention of international crypto-monitoring firms. In September 2022, the analytics company Chainalysis flagged Nobitex as part of a money-transfer chain linked to ransomware attacks attributed to Iranian actors.[15] TRM reports also indicated that Nobitex may have been used as a sanctions-busting vehicle for trade with the Houthis and Russia,[16] as well as for Palestinian Islamic Jihad and media outlets tied to Hamas.

It is worth noting, however, that TRM analysis from August 2025 found that criminal or sanctions-evasion activity on Nobitex accounted for only 0.9 percent of total transactions. This data suggests that most of the exchange’s activity is driven by ordinary Iranian clients,[17] although, given insufficient information, this figure should be treated cautiously.

The June 2025 Cyberattack on Nobitex

During the June 2025 war between Israel and Iran, several major cyberattacks hit Iran’s financial system, one of the most significant being the assault on Nobitex. The hack was carried out by “Predatory Sparrow,” a hacker group associated with pro-Israel cyber operations.[18] Roughly $90 million in crypto (value at the time of the breach) was stolen, and the exchange’s source code was leaked online.[19]

The Nobitex hack occurred alongside other cyber incidents: on June 17, Predatory Sparrow claimed responsibility for a major cyberattack that severely disrupted Bank Sepah, one of Iran’s largest banks. Two days later, another attack targeted Bank Pasargad, though no group claimed responsibility.[20] Together, these strikes crippled Iran’s financial system during the war, causing widespread disruptions to its services to the public, even after the attacks were over.

What set the Nobitex attack apart was that the stolen funds were not repurposed by the hackers for personal gain. Instead, they appear to have been “frozen” by being transferred to vanity addresses generated without private keys, rendering the fiunds unspendable.[21] This indicates a deliberate intent to damage the exchange and undermine its stability, rather than profit directly from the theft.

Nobitex management assumed full responsibility for the damages and promised to compensate clients for losses.[22] The exchange suspended operations until recovery was complete, with management regularly updating the public on the investigation and restoration of service. On July 24, Nobitex announced that the recovery of the exchange had been completed and that it had resumed full activities.[23]

The Cyberattack’s Impact on Iran’s Cryptocurrency Economy

According to analysis conducted by TRM, Iranian citizens relied on Nobitex as a key vehicle for safeguarding their money during regional crises. For instance, during Iranian–Israeli exchanges of fire in April and October 2024, transfers of cryptocurrencies from Nobitex wallets to private, off-exchange wallets surged by 150 percent. This suggests that Iranians prefer to hold cryptocurrencies privately during times of crisis rather than trust regulated platforms like Nobitex.

After the June 2025 hack and the war’s end, however, deposit volume on Nobitex fell by 70 percent year-on-year in early July, according to TRM.[24] Beyond the regional tensions, this decline was also shaped by wartime hardships endured by Iranian citizens—such as internet outages, power cuts, and other disruptions.

Compounding the fallout, in July, the U.S. company Tether froze 42 wallets holding USDT, the dollar-pegged stablecoin it issues. TRM found that more than half of the frozen wallets were linked to Nobitex and the IRGC (as identified by Israel’s National Bureau for Counter-Terror Financing).[25] The move was apparently connected to anti-terror financing measures, but in practice it also reduced the supply of stablecoins accessible to ordinary Iranians.

The impact on the local civilian market was evident in an Iranian online campaign in July in which local influencers and government-affiliated channels urged crypto traders to abandon USDT and adopt the dollar-pegged DAI stablecoin instead. [26]Iranian authorities likely orchestrated this campaign to stabilize the market and prevent panic that could drive purchases of alternative hedges such as gold or cash, thereby pressuring the rial’s exchange rate.

A Wider Cryptocurrency Market Crisis

Beyond the direct financial losses from the Nobitex attack, Iran’s crypto market poses another major challenge to the regime: the electricity crisis, which peaked during the summer months.

Iran suffers from rampant illegal crypto mining, which strains the national power grid and significantly contributes to the country’s acute energy shortage. In Hormozgan Province in southern Iran, for example, estimates suggest that between 3.5 and 4.4 percent of electricity consumption is tied to illicit mining of cryptocurrencies.[27] Authorities are engaged in an ongoing crackdown on these illegal “farms.”[28]

At the same time, Iran has an active black market in cryptocurrencies, where trading occurs outside government-approved exchanges. This market is likely intertwined with illegal mining efforts. On August 20, the Central Bank of Iran declared all off-exchange cryptocurrency trading strictly prohibited and reaffirmed that it alone has the authority to authorize financial activity in this sphere.[29]

The key advantage of the black market, however, is the unrestricted freedom it gives citizens to move digital assets as they wish—unlike funds in regulated exchanges, which can be frozen by government order. In other words, Iran’s crypto black market offers citizens far greater independence than the supervised system.

Are Iranians Losing Faith in Regulated Cryptocurrency Exchanges After the Hack?

It is too early to say whether the Nobitex cyberattack has fundamentally eroded public confidence in regulated cryptocurrency trading. Available data only indicates shifts relative to 2024—a year already rife with destabilizing events—and no comprehensive report has yet been published on trends following the Nobitex hack.

Moreover, the decline in Nobitex trading volume after the war may stem from multiple factors beyond the hack itself. During the fighting, Iranians faced widespread service disruptions, including unstable internet, restricted banking, and chronic power shortages—conditions they live with on a regular basis.

More broadly, the average Iranian endures constant financial hardship and daily pressures, including rising prices, shortages of basic goods, and persistent deficits in energy and water. The Nobitex hack highlighted the risks of holding crypto on regulated platforms, but Iranians have few better alternatives. Gold and foreign currency are options, but they are rationed, difficult to obtain, and cumbersome to store. Cryptocurrencies, however, are relatively easy to steal and vulnerable to politically motivated interference, as the Nobitex case demonstrated.

Thus, given current circumstances, Iranians are likely to continue using cryptocurrencies as a primary store of value, while relying on local exchanges to convert it back into rials when necessary. At the same time, private traders will probably hedge their risks by diversifying their holdings, keeping more assets in personal wallets, and avoiding the concentration of all funds in one place.

In any event, the developments in Iran’s crypto sector underscore its growing importance for the Iranian economy—both for those seeking to evade the international sanctions regime, including regime actors such as the IRGC and oil traders, and for ordinary citizens trying to preserve the value of their savings. At the same time, they highlight the vulnerabilities and problems inherent in reliance on cryptocurrencies, as well as the importance of U.S. and Israeli efforts to regulate and target this system in order to prevent its illicit use and to weaken the regime.

---

[1] https://nbctf.mod.gov.il/he/Announcements/Documents/%d7%a6%d7%aa%2043-25.pdf

[2] https://www.elliptic.co/blog/israel-links-crypto-wallets-handling-billions-to-irans-revolutionary-guard

[3] Treasury Targets Financial Network Supporting Iran’s Military (https://home.treasury.gov/news/press-releases/sb0248)

[4] https://www.ft.com/content/b6b80ce7-6baa-4a72-837c-a0fd1db6128e

[5] According to the company’s official website, SDRA Co. was established in Iran in 2001 and is engaged in consulting, design, production, and the supply of advanced technological solutions. Its main areas of expertise include data collection and online monitoring systems, instrumentation systems, and motion-tracking and navigation systems—through which it provides innovative and reliable services tailored to a wide range of industrial and operational needs.

[6] https://www.justice.gov/usao-ma/pr/united-states-seeks-civil-forfeiture-cryptocurrency-associated-iranian-national-mohammad

[7] https://www.iranintl.com/202509122953

[8] https://nbctf.mod.gov.il/he/Announcements/Documents/%d7%a6%d7%aa%2043-25.pdf

[9] https://www.elliptic.co/blog/israel-links-crypto-wallets-handling-billions-to-irans-revolutionary-guard

[10] Treasury Targets Financial Network Supporting Iran’s Military (https://home.treasury.gov/news/press-releases/sb0248)

[11] https://www.bbc.com/news/articles/c2kgndwwd7lo

[12] https://www.iranintl.com/fa/202508279154

[13] https://www.trmlabs.com/resources/blog/irans-crypto-economy-in-2025-declining-volumes-rising-tensions-and-shifting-trust

[14] https://www.trmlabs.com/resources/blog/nobidex-is-first-decentralized-exchange-built-and-launched-in-iran

[15] https://www.chainalysis.com/blog/ofac-sanctions-iran-september-2022/

[16] https://www.trmlabs.com/resources/blog/new-drones-old- tactics-how-iran-uses-crypto-to-fund-conflict-and-evade-sanctions  

[17] https://www.trmlabs.com/resources/blog/irans-crypto-economy-in-2025-declining-volumes-rising-tensions-and-shifting-trust

[18] https://www.reuters.com/world/middle-east/iran-crypto-exchange-hit-by-hackers-90-million-destroyed-2025-06-18/

[19] https://www.trmlabs.com/resources/blog/inside-the-nobitex-breach-what-the-leaked-source-code-reveals-about-irans-crypto-infrastructure

[20] https://www.iranintl.com/en/202507192001

[21] https://www.trmlabs.com/resources/blog/irans-crypto-economy-in-2025-declining-volumes-rising-tensions-and-shifting-trust

[22] https://nobitex.ir/mag/nobitex-hack/

[23] https://x.com/nobitexmarket/status/1948417425025716269

[24] https://www.trmlabs.com/resources/blog/inside-the-nobitex-hack-how-the-iran-israel-conflict-exposed-tehrans-grip-on-its-crypto-services

[25] https://www.trmlabs.com/resources/blog/irans-crypto-economy-in-2025-declining-volumes-rising-tensions-and-shifting-trust 

[26] https://www.trmlabs.com/resources/blog/irans-crypto-economy-in-2025-declining-volumes-rising-tensions-and-shifting-trust 

[27] https://www.irna.ir/news/85913703

[28] https://www.isna.ir/news/1404061206990

[29] https://www.mehrnews.com/news/6566071

---

JISS Policy Papers are published through the generosity of the Greg Rosshandler Family.

---