The Cryptographic Past of the Middle East

Author: Zhi Wubuyian

In the early hours of June 18, 2025, while tens of millions of Chinese were staying up late to snatch discounted goods, Iran's largest cryptocurrency exchange, Nobitex, was also "liquidated."

A hacker organization called Gonjeshke Darande, which means "Plundering Sparrow" in Persian, posted on X, claiming to have breached Nobitex's hot wallet and taken over $90 million. Just the day before, this organization had attacked one of Iran's largest state-owned banks, Bank Sepah. Then, they did something rarely seen in the history of hacking.

They transferred the entire $90 million into eight "black hole addresses" for destruction. These wallets, which have no private keys, once funds are sent, the money can never be retrieved. Ironically, these addresses were all embedded with phrases like "FuckIRGCTerrorists," with IRGC being the abbreviation for the Islamic Revolutionary Guard Corps of Iran.

Blockchain intelligence firm Elliptic later pointed out that to generate such a string of addresses, hackers would need to brute-force a large number of cryptographic key pairs until they found one containing the desired text. A hacker going to such lengths is clearly not motivated by financial gain. Twelve hours later, Nobitex's source code and internal documents were fully disclosed.

Independent investigator Nariman Gharib analyzed these documents and found that the destroyed $90 million almost perfectly matched the IRGC-associated funds that had flowed into Nobitex through specific wallets in the previous months.

Therefore, rather than calling it theft, it would be more accurate to describe it as a targeted political action on the blockchain.

When we think of cryptocurrency in the Middle East, we often picture Dubai's licenses, the Token 2049 venue, and after-parties on Palm Island, but there exists a more hidden and intricate world that we are completely unaware of.

Few can clearly explain: What exchanges do Iranians use? Why do Turks trade cryptocurrencies en masse? Why is Kuwait the country with the strictest crackdown on mining in the Middle East?

The story of Nobitex may be a key to unlocking this world.

From Chemical Engineer to Iran's "Zhao Changpeng"

After the U.S. declared war on Iran, a piece of news brought Nobitex into the public eye: within minutes of the airstrikes beginning, the withdrawal volume from this exchange surged by 873%. The founder of Nobitex is Amir Rad. He does not come from a financial background; he graduated as a chemical engineer from Sharif University of Technology and worked in process safety and risk assessment in the petrochemical industry before starting his business.

Last year, he appeared on a popular Iranian business podcast called Karnakon Podcast. Interestingly, the name of this show can be translated into Chinese as "Don't Be a Wage Slave!" This was also his first in-depth interview after the hacking incident. According to Rad, in 2017, as a retail investor in cryptocurrency, he and three friends founded Nobitex. The idea was simple: allow Iranian users to deposit in rials and place orders to buy and sell digital assets. And so it began.

But the results exceeded their expectations. A few months after its launch in 2018, hostility from Iranian regulators towards cryptocurrency led to a year-long comprehensive blockade of Nobitex. Yet it was so popular that even during the blockade, the platform maintained an organic growth rate of 20% per month.

Today, Nobitex has 11 million registered users, with total inflows exceeding $11 billion, surpassing the combined total of the next ten Iranian exchanges.

What does 11 million mean? Iran has a total population of 89 million, meaning one in every eight people has registered on Nobitex. Excluding minors and the elderly, the actual penetration rate is even higher. This number is roughly equivalent to that of Kraken, a compliant exchange in the U.S. that has been established for many years. A chemical engineer, in eight years, created an exchange that covers one-eighth of the country's population. If the story ended here, it would be a pretty good entrepreneurial legend.

The Wandering Financial Ghost

But the story did not stop there.

Starting in 2024, open-source intelligence began to show that among the main shareholders of Nobitex were relatives of Supreme Leader Khamenei and business partners of Mohsen Rezaee, the founder of the Revolutionary Guard.

Elliptic's on-chain analysis revealed that Nobitex had financial transactions with sanctioned Russian exchange Garantex, as well as wallets associated with Hamas and the Houthis.

How did a private company become the white glove of the highest authorities? The details remain unclear. But in Iran, this script is not unfamiliar.

After Digikala (the Iranian version of Amazon) and Snapp (the Iranian version of Didi) grew large, they both accepted "strategic investments" from shell companies linked to the Revolutionary Guard or the national telecommunications group. In this country, once a private enterprise reaches a certain size, someone will come to "help" you. However, what Nobitex carries is far more sensitive than e-commerce or ride-hailing.

In the internal documents released by "Plundering Sparrow," Gharib tracked down a special account. This account was responsible for coordinating tens of millions of dollars flowing from the Revolutionary Guard's financial network into Nobitex. But unlike the other 11 million users on the platform, it was completely exempt from KYC verification.

Everyone must undergo identity verification, except for the account handling funds for the Revolutionary Guard. Analysis of the leaked source code by TRM Labs showed that this account was not registered under the name of a specific officer. It resembled an invisible channel within the system, registered under a shell import-export company affiliated with the Revolutionary Guard's Quds Force, specifically serving a VIP whitelist for politically exposed persons.

However, overseas, the person connected to this ghost account was no longer a secret. His name is Babak Zanjani.

Cat and Mouse Game

Zanjani's resume reads like a spy novel: sanctioned by OFAC in 2013, sentenced to death in Iran in 2016 (for embezzling billions of dollars from the national oil company), had his sentence reduced in 2024, and was released in 2025.

According to the U.S. Treasury, he was released to continue laundering money for the regime. In May 2021, a company called Zedxion Exchange Ltd was registered in the UK. Five months later, a person named Babak Motaz was listed as a director and actual controller.

The U.S. Treasury later confirmed that this person was indeed Babak Motaz Zanjani.

In July 2022, Zanjani disappeared from the company records. A few days later, Zedcex Exchange Ltd was registered at the same London address under the same successor director.

Both companies claimed to be in a "dormant" state. On paper, there were only nominal directors and virtual office addresses. But the on-chain data tells a completely different story. TRM Labs' analysis showed that Zedcex had processed over $94 billion in transactions since its registration. Together, the two exchanges handled about $1 billion for the Revolutionary Guard, peaking at 87% of the total volume on the platform in 2024.

Funds flowed in USDT on the TRON chain, shuttling between Revolutionary Guard wallets, offshore nodes, and Nobitex.

Investigations by OCCRP (Organized Crime and Corruption Reporting Project) uncovered more details. The registered address of the two exchanges, 71-75 Shelton Street, Covent Garden, London, is a virtual office address that has been registered in bulk, with dozens of other companies registered at the same address, including at least six sanctioned entities.

In the official videos of both exchanges, there is a so-called "executive director" named "Elizabeth Newman." OCCRP found that this person does not exist. The female figure in the video comes from a stock image website, labeled "Pretty Black woman talking to camera."

Fictitious characters, ghost companies, astronomical amounts of on-chain flow. But OCCRP initially had only indirect clues. Although Zanjani's name had appeared in Zedxion's director records and white paper metadata, he had long since distanced himself from all public documents.

The real breakthrough came from a cat.

In May 2024, Zedxion's official Telegram channel posted a photo of a gray and white cat with a conspicuous purple bell around its neck. A few months later, a cat with the same color, pattern, and purple bell appeared on the Facebook page of Zanjani's girlfriend, Solmaz Bani. Following this lead, reporters discovered that she was the registrant of the Zedxion newsletter domain and her name also appeared in the login information for Zedcex's email. In the official tutorial video of Zedxion on YouTube, two names briefly flashed in the autofill fields: Solmaz and Babak.

In front of the cat, even the Revolutionary Guard's money laundering network had nowhere to hide.

"We Endure Darkness, While They Mine Bitcoin"

Do you remember the $90 million that Nobitex was burned through?

It later turned out that it was likely the Revolutionary Guard's money. But from the outside, it appeared as a $90 million hole on the balance sheet of a leading exchange. If not addressed promptly, a bank run could happen at any time.

Nobitex's choice was to cover the loss with its own funds.

TRM Labs found that after the hacking incident, Nobitex quickly consolidated about $2.7 million from over 100 long-dormant wallets to alleviate the liquidity crisis. These wallets had accumulated mining rewards in 2021 and 2022 and had never transferred funds before, traceable upstream to two major global mining pools: EMCD and ViaBTC.

We cannot confirm whether this money was an external bailout or from Nobitex's own mining treasury. But this incident gives us a glimpse into Iran's massive mining industry.

Cryptocurrency mining in Iran was legalized in 2019. Licensed miners are allowed to mine Bitcoin using subsidized electricity, selling everything to the central bank, which then uses it to pay for imports, bypassing the dollar system.

The government set the industrial electricity price at 0.5 cents per kilowatt-hour, with the cost of producing one Bitcoin at about $1,320. Even if the price of Bitcoin has fallen to $60,000 or $70,000, the profit margin remains astonishing. This profit margin explains everything that followed.

In 2022, parliament passed a bill allowing the military to build private power plants. The Revolutionary Guard directly acquired electricity originally supplied to cities. Mining sites were established in military bases and economic special zones. The large religious foundation Astan Quds Razavi, directly controlled by the Supreme Leader, was deeply involved, forming a de facto "mining cartel."

As of 2023, among Iran's approximately 180,000 mining machines, 100,000 belong to state or Revolutionary Guard-affiliated enterprises.

But Iran is also a country with a severe electricity shortage, and rolling blackouts during extreme weather are not uncommon. Not only are residents' lives affected, enduring extreme heat or cold, but frequent factory shutdowns also lead to unemployment among industrial workers, and small businesses struggle due to unstable power supply. This has sparked protests with slogans like "We endure darkness, while they mine Bitcoin."

Where are the mining machines hidden? A widely circulated theory is mosques. In Iran, mosques are legally entitled to free electricity. The 2025 budget bill exempted all Revolutionary Guard bases, Basij centers, and mosques from electricity fees, while ordinary citizens' electricity fees rose by 38% that same year.

In 2019, an Iranian researcher captured about 100 mining machines distributed across different rooms in a mosque, fueling this theory. However, some practitioners hold an opposing view. Urban transformers have load limits, and large-scale mining can lead to system overloads or even explosions. If the government wants to mine, they certainly have more discreet locations.

Regardless of where the mining machines are, one number is unavoidable: the scale of illegal mining is about 400 times that of legal mining. The state-owned Tavanir, under the Ministry of Energy, can only offer rewards for catching miners, initially rewarding 1 million toman (about $24) for reporting each illegal mining machine, later increasing to 200 million toman (about $2,300).

The grassroots population reports each other for $24, bearing the rising electricity costs, while mining sites protected by the military thrive. When the Ministry of Energy attempted to shut down a mining site in 2021, Revolutionary Guard armed personnel showed up to physically prevent the raid.

This is the underlying reality of cryptocurrency in Iran: one country, two sets of rules.

The Other Side of the Gulf

As mentioned earlier, the cost of producing one Bitcoin in Iran is about $1,320. Across the Persian Gulf in Kuwait, this number is $1,400. Under high interest rates, there will always be those willing to take risks, but Kuwaitis choose to do so in their own bedrooms. To avoid raising official suspicion, miners may even choose to turn off their air conditioning to mask the electricity consumption of the mining machines.

In 2023, Kuwait completely banned cryptocurrency activities, but the ban could not stop profits. In April 2025, the Ministry of Interior conducted surprise inspections, seizing over 100 illegal mining sites, with electricity consumption in the southern Wafra region dropping by 55% within a week. The story of mining varies from country to country, and so does the story of currency devaluation. Why did Nobitex grow so rapidly during those years? Because it was precisely when the rial was collapsing the hardest, with the black market rate reaching 92,000 to 1 dollar in 2018, now it has fallen below 1.5 million. Turkey's lira is also on a similar path, with inflation consistently exceeding 30%. The annual trading volume of USDT/lira on Binance exceeds $22 billion, larger than any Bitcoin trading pair. Between 2024 and 2025, Turkey received nearly $200 billion in cryptocurrency assets, with over half of adults holding cryptocurrency. Not believing in their own currency, they can only trust on-chain dollars, even though many do not particularly like the U.S. This is happening daily in Tehran and Istanbul. Meanwhile, while some struggle to preserve their purchasing power, more countries in the Gulf are already discussing the next era. The UAE has incorporated cryptocurrency into its national financial infrastructure blueprint, with Dubai and Abu Dhabi each establishing regulatory bodies for virtual assets, and a dirham stablecoin has been approved for launch, with annual cryptocurrency inflows of $53 billion. The same technology, on one side of the Gulf is a survival tool, while on the other side it is a business card for attracting investment.

But ironically, the cryptocurrency brand activities in the Middle East, originally scheduled to take place in late April at Token2049 Dubai, have been directly postponed to next year due to the conflict in Iran. Israel, the staunch adversary that launched the strike against Iran, plays a much cooler role in the cryptocurrency world. This country has no cheap electricity and does not need to use cryptocurrency to bypass sanctions, but it has the highest density of blockchain startups globally. Several core projects in the field of zero-knowledge proofs come from Israeli teams, with StarkWare reaching a valuation of $8 billion in 2025. Although its token STRK dropped by 90% after launch, becoming a representative of a failed project, its ecosystem still has very few users. The same Gulf, different worlds, yet they are all now caught up in the same war. As I finished writing this article, some of the names that appeared within it are no longer present. Khamenei died in an airstrike at the end of February 2026. Several senior officials of the Revolutionary Guard were eliminated in the joint strikes by the U.S. and Israel. The funds that flowed through Nobitex via ghost accounts are still recorded on-chain, but the owners behind the addresses may have changed time and again. Nine hundred years ago, the Persian poet Omar Khayyam wrote in the Rubaiyat:

In that palace where Jamshid raised his cup

Now the doe gives birth, and the lion rests there

That Bahram who hunted wild donkeys for life

Now captured by the grave, sleeps in the earth Cryptocurrency in the Middle East has never been a single thing. It is many things. It is the compliant licenses in Dubai's office buildings, the lifebuoy after the lira devaluation on the streets of Ankara, the suspected sound of fans from the basement of Isfahan's mosque, the $94 billion behind a virtual address in Covent Garden, and a cat wearing a purple bell.

Years later, when people look back at this chapter of cryptocurrency in the Middle East, they may be surprised that it simultaneously contains the most advanced technology of this era and the oldest conflicts. But for the ordinary people in the Middle East who are still depositing their meager salaries into Nobitex to preserve value, this is not a thing of the past; it is their present.