U.S. sanctions Nobitex crypto exchange used by Iranian ransomware actors

The U.S. Treasury's Office of Foreign Assets Control sanctioned Nobitex, Iran's largest cryptocurrency exchange, for enabling financial transactions linked to terrorist activities and ransomware operations.

Nobitex served as a critical infrastructure for converting ransom payments and other illicit funds into fiat currency. Iranian threat actors, including those operating ransomware campaigns against U.S. and international targets, relied on the platform to launder proceeds and move money across borders.

OFAC's action blocks all U.S.-based assets held by Nobitex and prohibits American individuals and entities from conducting business with the exchange. The designation follows patterns of sanctioning cryptocurrency platforms that process payments for hostile state actors and designated terrorist organizations.

Iranian ransomware groups have launched high-profile attacks against hospitals, critical infrastructure operators, and corporations. These operations generate millions in illicit revenue annually. Nobitex's role as the primary on-ramp for converting cryptocurrency back to usable currency made it a chokepoint in the financial chain connecting victims' ransom payments to Iranian state interests.

The sanctions reflect escalating U.S. enforcement against the cryptocurrency infrastructure enabling state-sponsored cybercrime. Previous actions targeted exchanges and wallet services in North Korea, Russia, and other jurisdictions hosting actors behind major ransomware campaigns.

Organizations that paid ransoms to Iranian groups risked unknowingly supporting designated terrorists under U.S. law. The Nobitex action effectively closes one major pathway for these actors to access funds, though alternatives exist through peer-to-peer exchanges and less-regulated platforms.

For organizations, the designation underscores the financial consequences of ransomware payments. Companies should strengthen backup and recovery systems to avoid ransom demands entirely, and report incidents to law enforcement including payment information. Cryptocurrency transaction monitoring has become a law enforcement priority, making ransom payments increasingly traceable.