LONDON (Reuters) — The sons of a powerful family with close ties to Iran’s new supreme leader control the country’s largest cryptocurrency exchange, transforming it from a startup into a conduit to the global economy used by both blacklisted state institutions and ordinary citizens.
Nobitex was founded in 2018 by brothers Ali and Mohammad Kharrazi under an alternative family name. It claims 11 million users, more than 10% of Iran’s population. While Iran is subject to blanket Western economic sanctions, the exchange has avoided being designated by the United States and its allies.
Locked out of international banking and facing a devalued rial and rampant inflation, ordinary Iranians use the exchange to buy and hold cryptocurrency.
But Nobitex has also processed between tens and hundreds of millions of dollars in transactions linked to sanctioned groups including Iran’s central bank and powerful Islamic Revolutionary Guard Corps (IRGC), a Reuters investigation has found.
Nobitex is used by the Iranian state to route money to allies outside the conventional banking system, according to an analysis of blockchain records by crypto analytic firm Crystal Intelligence and interviews with four private financial investigators.
Get The Times of Israel’s Daily Edition
by email and never miss our top stories
By signing up, you agree to the terms
Reuters also spoke with nine Iranians who have worked for or with Nobitex. Six of the former employees interviewed by Reuters said they were aware that Nobitex was used by Iran’s government and its security agencies to bypass stringent Western financial sanctions.
Nobitex told Reuters there had never been any agreement with any Iranian government agency, and none of the employees interviewed by Reuters knew of one.
“We have faced significant operational restrictions from the Iranian government, including office raids, domain blocking, and banking gateway closures,” Nobitex said. “These actions are entirely inconsistent with the notion that we are receiving any form of governmental support.”
Nobitex has publicly stated its aim is to enable Iranians to invest in crypto despite “the shadow of sanctions” and advises its clients on how best to avoid their transactions being monitored or intercepted by Western governments.
To hide its tracks, Nobitex changes the wallet addresses it uses for fund transfers, and has also developed cryptographic tools to further obfuscate the links between related wallets because of “increasing restrictions related to international sanctions,” according to a 2021 annual report.
Additionally, Nobitex advises clients to layer transactions using multiple wallet addresses to make them harder for Western investigators to track.
Illustrative: A woman uses an ATM machine at a branch of Bank Melli Iran, at the Grand Bazaar of Tehran, Iran, on June 10, 2020. (AP Photo/Vahid Salemi)
During a 2025 hack of Nobitex by the group Predatory Sparrow, about $90 million worth of cryptocurrency was sent to inaccessible wallets labelled with profane anti-IRGC names. In an indication of Nobitex’s vast resources, the company and its shareholders – including the brothers – directly reimbursed customers whose money had been taken.
The firm has continued processing transactions throughout the war with the US and Israel that began on February 28, even during a government-imposed nationwide internet shutdown and widespread power outages in Tehran, according to three blockchain analysis firms that track activity involving Nobitex and other exchanges.
During that time Nobitex has processed more than $100 million in transactions, about 20% of its usual activity, according to Crystal Intelligence, which has been investigating Iranian cryptocurrency flows for more than four years.
Brothers concealed illustrious ties
Ali and Mohammad Kharrazi are the third generation of their family at the heart of Iran’s ruling establishment since the 1979 Islamic Revolution. Kharrazis have advised supreme leaders and occupied key political, diplomatic and religious posts.
The clan is related by marriage to all three supreme leaders of the Islamic Republic: the revolutionary founder Ayatollah Ruhollah Khomeini, the late Ali Khamenei, and Khamenei’s son Mojtaba.
The brothers – using the family surname Aghamir – built Nobitex into the country’s dominant cryptocurrency provider. It handles an estimated 70% of Iran’s crypto transactions.
It’s not unheard of for some Iranians to have and use alternative family names. But the brothers appear to be the only ones in their immediate family to routinely distance themselves from their famous bloodline.
Iran’s then-Foreign Minister Kamal Kharrazi, addresses the 59th session of the United Nations General Assembly at UN headquarters in New York on September 24, 2004. (AP Photo/Richard Drew)
Inside the company, the brothers concealed the Kharrazi name even from those closest to them, according to seven of the former employees and professional acquaintances Reuters interviewed. Some of these sources said they have known the brothers since their university days. Then, as now, they did not use the Kharrazi name.
Rumors about the brothers’ identity emerged in 2024 when a Chinese blog reported that their father was a principal stakeholder of the crypto exchange through his son Mohammad, who was using the Aghamir surname.
Of the nine former employees and professional acquaintances interviewed by Reuters, only one learned of the brothers’ family ties directly from them. Another said he discovered it after researching them.
Among those most surprised was a former coworker who counted Mohammad as a close friend of many years standing and expressed shock when Reuters disclosed the Kharrazi family connection to him.
“I was pretty open about my criticism for the regime, and my colleagues were, too,” said another former Nobitex employee. Discovering the brothers’ family name “made me afraid. I did a lot of hate speech against the regime and religion.”
Concerns among staffers about their employer’s links to the government deepened after a company connected to one of Nobitex’s main investors, Mohammad Bagher Nahvi, was sanctioned by the US for supplying drones to Russia, according to three former employees.
Illustrative: A Shahed-161 drone is displayed during an exhibition showcasing missiles and drones in Tehran, Iran, November 12, 2025. (ATTA KENARE / AFP)
The company, Safiran Airport Services, coordinated “flights between Iran and Russia, including those associated with transporting Iranian UAVs, personnel, and related equipment,” the US Treasury Department said in September 2022, seven months after Russia invaded Ukraine.
Safiran is listed as a private company whose vice chairman is Nahvi, Nobitex’s former chairman. He was one of the exchange’s first and largest investors.
Company faced regime pressure
The original board of directors for Nobitex consisted of brothers Ali and Mohammad along with Amir Hosein Rad. All three studied at the elite Sharif University of Technology, Tehran’s equivalent to the Massachusetts Institute of Technology.
Rad, who is not related to the brothers, and Ali were the public faces of the company, with Rad as chief executive. Mohammad was the blockchain expert.
The founding brothers’ elite connections did not spare the company from having to balance competing demands of various powerful arms of the Iranian state, said former employees interviewed by Reuters.
Iran’s central bank periodically barred exchanges including Nobitex from accessing the domestic banking system.
Shortly after Nobitex opened for business in 2018, the IRGC visited the firm’s Tehran offices and questioned Rad, who was then CEO, three former employees said. A few years later, they swooped in again, arrested Rad, confiscated staff laptops, and sealed the office, two of the people said. There is no indication he was ever charged.
Explanations swirled around the office about the reason for the various IRGC visits. One of the people said they were payback for Nobitex’s refusal to process IRGC funds linked to sanctioned oil sales. Two others said a jealous competitor had falsely claimed Nobitex was ripping people off.
In a December 2025 interview with an Iranian podcaster, Rad said his arrest in 2021 involved a misunderstanding about the relationship between Nobitex and another company with questionable business practices. Rad, who did not name the other company, described that arrest as “one of the side effects of working in Iran. I think there are very few entrepreneurs in Iran who haven’t experienced something like this.”
Iran’s then-Supreme Leader Ayatollah Ali Khamenei, center, accompanied by the armed forces commanders, visits an exhibition of the Revolutionary Guard’s aerospace achievements, in Iran, November 19, 2023. (Office of the Iranian Supreme Leader via AP)
The IRGC is involved in every significant facet of Iran’s economy and would take a keen interest in a company as critical to the economy as Nobitex, according to a former senior US Treasury official who helped design America’s Iran sanctions policy.
“As soon as a business becomes meaningfully profitable you will see the government coming in and taking its slice,” said Miad Maleki, who worked in the US Treasury Department from 2017 to 2025 and was former associate director of the Office of Foreign Assets Control. He is now a senior fellow at Foundation for Defense of Democracies.
“You can’t have a successful business in Iran without it being controlled by the regime,” said Maleki.
Despite the pressure from the regime, Nobitex flourished – and with it the fortunes of the Kharrazi brothers.
The company moved to a flashy new office in 2021 with chill-out areas where staff could play video games, watch movies or gaze at the panoramic views of the Alborz Mountains, five of the former employees said. Their accounts matched photos posted by the company on LinkedIn. Female employees weren’t required to wear headscarves, and the offices stayed open on religious holidays.
A home address linked to Mohammad’s national ID number is in one of Tehran’s wealthiest neighborhoods.
By the end of 2022, the exchange said it had 4.3 million users and 268 employees. Sanctions that had locked Iranians out of the global financial system turbocharged Nobitex’s appeal to its Iranian clientele. Essentially, Iranians could not legally create accounts at exchanges like Binance, but they could with Nobitex, which gave them access to global crypto markets that are subject to patchy international regulation.
The atmosphere changed somewhat in 2022, following nationwide protests triggered by the death of a young woman, Mahsa Amini, in police custody. Amini was arrested for allegedly violating hijab laws.
This UGC image posted on Twitter reportedly on October 26, 2022 shows an unveiled woman standing on top of a vehicle as thousands make their way towards Aichi cemetery in Saqez, Mahsa Amini’s hometown in the western Iranian province of Kurdistan, to mark 40 days since her death in morality police custody. (UGC / AFP)
“The building’s security and the morality police started controlling the hijab of female employees and threatened to seal the office,” said one former employee.
Office dress codes were enforced more firmly after that, according to two former employees.
“Management became stricter about headscarves and security protocols,” said one person who regularly visited Nobitex’s offices and knew the founders well. “Up until then the company looked like a tech start-up.”
Obscured addresses
Evidence of how Nobitex fits into Iran’s sanctions-evasion machinery surfaced through an unlikely source: Babak Zanjani, an Iranian billionaire convicted of fraud.
Zanjani has long been a key figure in Iran’s sanctions-evasion networks. He was sentenced to death by Iranian authorities in 2016 for embezzlement. His sentence was commuted in 2024. But Zanjani remains locked in a public spat with Iran’s central bank, which accused him of failing to repay the stolen billions.
In a December tirade against the central bank, Zanjani published wallet addresses on social media that enabled outside crypto analysts to uncover a complex sanctions-evasion scheme, with Nobitex at the core.
Part of the scheme involved moving at least $20 million in sanctioned central bank funds to wallet addresses controlled by Nobitex, according to Smart, of Crystal Intelligence, and another crypto analyst.
Zanjani didn’t respond to requests for comment.
The transactions were a fraction of a larger network of wallets controlled by Iran’s central bank that bought more than $500 million of cryptocurrencies between November 2024 and June 2025, according to the blockchain analysis firm Elliptic.
About $347 million of that was sent by the central bank, which is sanctioned by the United States, to Nobitex in the first six months of 2025, Elliptic said.
Routing the money through Nobitex after a series of transactions can have the effect of blurring the source of the funds.
Illustrative: An Iranian woman walks by a money exchange office in the capital Tehran on June 22, 2020. (ATTA KENARE / AFP)
Nobitex said any allegedly illicit money that passes through the exchange represents “a very small fraction of overall volume” and happened without the company’s knowledge.
“Where suspicious or non-compliant conduct is identified,” it said, “Nobitex’s approach is firm, including permanent account closure.” The statement did not define “non-compliant conduct.”
Estimates of Nobitex’s total illicit transactions range widely. They are mostly derived from wallet addresses identified and sanctioned by governments including Israel and the United States.
Elliptic has identified an estimated $366 million that was processed through the exchange. Chainalysis puts the figure closer to $68 million; Crystal Intelligence estimates $22 million in direct transfers from sanctioned wallets. Even the upper estimate is only 3% of the total $11 billion in cryptocurrency processed by Nobitex.
All firms cautioned the true figure is likely significantly higher.
Among Iran’s allies, at least two of the firms found Nobitex transactions involving accounts linked to Yemen’s Iran-backed Houthi rebels, who are also under Western sanctions.
Supporters of Yemen’s Houthis brandish weapons during a rally condemning Israel, in Sanaa on October 17, 2025. (Mohammed HUWAIS / AFP)
Nobitex’s key role in Iran’s financial system was laid bare during this year’s war with the United States and Israel.
Since February 28, most ordinary Iranians have been unable to access the internet due to a government-imposed blackout meant to suppress dissent. Yet Nobitex has continued to operate. Nobitex did not respond to questions about how it kept access to the internet during the blackout.
Internet monitoring firm Netblocks says only those on a “state-approved whitelist” – between 1% and 2% of the population – have had access to the internet during that time, as the state cracks down on satellite links and VPNs.
Crystal Intelligence has found that some in that tiny elite have withdrawn at least $54 million from the exchange during the war, much of it vanishing abroad to brokers who turn crypto into cash with few questions asked.
On April 1, Nobitex posted a message intended to reassure customers that “despite instability in infrastructure and service systems,” their money was safe and accessible.
The statement made no direct reference to the war. But the conflict struck close to the Kharrazi brothers that day, when an airstrike targeted the apartment of their great-uncle, Kamal, who served as Iran’s foreign minister and as adviser to both Ali and Mojtaba Khamenei.
Kamal’s wife was killed instantly, while he succumbed to his injuries days later, according to state news.
Mojtaba Khamenei, the new supreme leader who lost his own wife and father in an airstrike on the war’s first day, extended his condolences on state media and asked for divine exaltation of “the distinguished Kharrazi family.”