$90 Million Black Hole: War, Power, and the Crypto-Tragedy of the Middle East

Original Title: "Middle East Crypto Chronicles"

Original Author: Hazel, Zhi Wu Bu Yan

In the early hours of June 18, 2025, while tens of millions of Chinese stayed up late to snatch discounted goods, Iran's largest cryptocurrency exchange, Nobitex, was also "liquidated."

A hacker group named Gonjeshke Darande, Persian for "Plundering Sparrow," posted on X claiming to have breached Nobitex's hot wallet and siphoned over $90 million. Just the day before, this same group had attacked one of Iran's largest state-owned banks, Bank Sepah.

Then, they did something rarely seen in hacking history.

They transferred this entire $90 million to 8 "black hole addresses" for destruction. These wallets, without private keys, render the funds permanently irretrievable once sent. Ironically, these addresses were all embedded with phrases like "FuckIRGCTerrorists," with IRGC being the acronym for the Islamic Revolutionary Guard Corps.

Not taking a penny of the $90 million and staging such an ironic act, the hackers were clearly not driven by economic motives.

12 hours later, Nobitex's source code and internal files were all made public.

Independent investigator Nariman Gharib analyzed these files and discovered that the $90 million destroyed matched almost perfectly with IRGC-linked funds that had flowed into Nobitex through specific wallets in the preceding months.

Therefore, rather than calling this a theft, it is more aptly described as a targeted on-chain political cleansing operation.

When it comes to crypto in the Middle East, what often comes to mind are Dubai's licenses, Token 2049's venue, and After Parties on the Palm Island. However, there is a more secretive, intricate world that those not living there completely fail to grasp.

Few can clearly explain: What trading platforms do Iranians use? Why are Turks all in on crypto? Why is Kuwait the Middle East's most anti-mining country?

The story of Nobitex may be the key to unlocking this world.

From Chemical Engineer to Iran's "Zhao Changpeng"

After the U.S. waged war on Iran, a piece of news brought Nobitex into the spotlight: within minutes of the airstrike beginning, this exchange platform's withdrawal volume surged by 873%.

The founder of Nobitex is named Amir Rad. He did not come from a financial background but rather graduated as a chemical engineer from Sharif University of Technology and worked in process safety and risk assessment in the petrochemical industry before starting his own ventures.

Last year, he appeared on a popular Iranian business podcast, Karnakon Podcast. Interestingly, the name of this show can be roughly translated into Chinese as "Don't Be an Employee!" This was his first in-depth interview following the hacking incident.

According to Rad, in 2017, he and three friends, as crypto retail investors, founded Nobitex. The idea at the time was simple: allow Iranian users to recharge in rials and trade digital assets through their own orders. That was it.

But the outcome exceeded their expectations by far. A few months after its launch in 2018, Nobitex faced a year-long total blockade due to Iranian regulatory hostility towards crypto. However, it was so popular that even when blocked, the platform still maintained a 20% monthly organic growth.

Today, Nobitex has 11 million registered users, with a total inflow exceeding $11 billion, surpassing the sum of the next ten Iranian exchanges.

What does 11 million mean? Iran's total population is 89 million, so one out of eight people has registered on Nobitex. Excluding minors and the elderly, the actual penetration rate is even higher. This number is roughly equivalent to that of Kraken, a long-established U.S. compliant exchange platform.

A chemical engineer, in eight years, has created a nationwide exchange platform covering one-eighth of the population. If the story stopped here, it would be quite a remarkable entrepreneurial legend.

A Drifting Financial Phantom

But the story doesn't stop here.

Starting in 2024, open-source intelligence revealed that among Nobitex's primary shareholders were close relatives of the Supreme Leader Khamenei and business associates of IRGC founder Mohsen Rezaee.

Elliptic's on-chain analysis indicated that Nobitex had financial dealings with sanctioned Russian exchange Garantex, Hamas, and Houthi-affiliated wallets.

How did a private company transform into a puppet of the highest authority? The intricacies of this arrangement remain unknown. Yet, in Iran, such a plot is not unfamiliar.

After Digikala (Iran's Amazon equivalent) and Snapp (Iran's Uber equivalent) grew in stature, they both received "strategic investments" from IRGC-affiliated shell companies or the state telecom conglomerate. In this country, once private enterprises reach a certain scale, someone will come to "assist" you.

However, what Nobitex carried was far more sensitive than e-commerce and ride-hailing.

"The Sparrow's Plunder" leaked internal documents, leading Gary to trace a particular account. This account was responsible for coordinating tens of millions of dollars flowing from the IRGC's financial network into Nobitex. Unlike the other 11 million users on the platform, this account was completely exempt from KYC verification.

Everyone else had to undergo identity verification, except the account transferring IRGC funds.

TRM Labs' analysis of the leaked source code revealed that this account was not registered under a military officer's identity. It appeared more like a clandestine passageway within the system, affiliated with a shell import-export company under the IRGC's "Holy City Brigade," designed specifically for a VIP whitelist of politically exposed persons.

However, overseas, the individual connected to this ghost account was no longer a secret. His name was Babak Zanjani.

Cat-and-Mouse Game

Zanjani's resume reads like a spy novel: sanctioned by the OFAC in 2013, sentenced to death in Iran in 2016 (for embezzling billions of dollars from the national oil company), sentence commuted in 2024, released in 2025.

The U.S. Treasury Department alleges: he was released to continue laundering money for the regime.

In May 2021, a company named Zedxion Exchange Ltd was registered in the UK. Five months later, an individual named Babak Motaz was listed as a director and ultimate controlling person.

The U.S. Treasury Department later confirmed: this individual is indeed Babak Motaz Zanjani.

In July 2022, Zanjani disappeared from the company records. Shortly after, Zedcex Exchange Ltd was registered at the same London address under the name of a new director.

Both companies claim to be in a "dormant" state, with only nominal directors and a virtual office address on paper.

But data on the blockchain tells a completely different story. Analysis by TRM Labs shows that since its registration, Zedcex has facilitated over $940 billion in transactions. The two platforms combined processed around $1 billion for the Revolutionary Guard, peaking at 87% of the platform's total volume in 2024.

The funds circulated in USDT on the TRON blockchain, moving between Revolutionary Guard wallets, offshore nodes, and Nobitex.

An investigation by OCCRP (Organized Crime and Corruption Reporting Project) uncovered more details. The registered address of the two trading platforms, 71-75 Shelton Street in Covent Garden, London, is a bulk-registered virtual office address hosting a dozen companies, including at least six sanctioned entities.

Both trading platforms' official videos feature an "Executive Director" named "Elizabeth Newman." OCCRP found that this person does not exist. The female figure in the videos comes from a segment of stock footage on a photo website, labeled as "Pretty Black woman talking to camera."

Fictitious personas, ghost companies, astronomical on-chain flows. But OCCRP initially only had indirect clues. While Zanjani's name had appeared in Zedxion's director records and whitepaper metadata, he had long since disappeared from all public documents.

The real breakthrough came from a cat.

In May 2024, Zedxion's official Telegram channel posted a photo of a gray and white cat with a prominent purple bell around its neck. Months later, a cat with the exact fur color, pattern, and purple bell appeared on Zanjani's girlfriend Solmaz Bani's Facebook page.

Following this line of inquiry, the journalist discovered that she is the registrant of the Zedxion electronic newspaper domain name, and her name also appeared in the Zedcex email login information. In an official Zedxion YouTube tutorial video, two names briefly flashed in the autofill field: Solmaz and Babak.

In front of the cat, even the Revolutionary Guard's money laundering network has nowhere to hide.

"We endure darkness while they mine Bitcoin"

Do you remember the $90 million burning of Nobitex?

It was later proven that it was most likely the Revolutionary Guard's money. However, from an external perspective, it appeared as a $90 million hole in a top-tier exchange platform's account. If not dealt with promptly, a bank run could happen at any time.

Nobitex's choice was to cover the hole with its own funds.

TRM Labs discovered that after the hack, Nobitex swiftly integrated around $2.7 million from over 100 long-dormant wallets to alleviate the liquidity crisis. These wallets had accumulated mining rewards in 2021 and 2022, had never transferred funds before, and could be traced back upstream to two major global mining pools: EMCD and ViaBTC.

We cannot confirm whether this money was external funds or Nobitex's own mining treasury. Nevertheless, this incident allowed us to catch a glimpse of Iran's vast mining industry.

Iran's crypto mining was legalized in 2019. Licensed miners are permitted to mine Bitcoin using subsidized electricity, sell it all to the central bank, which then uses it to pay for imports, circumventing the US dollar system.

The government set the industrial electricity price at $0.005 per kWh, with a cost of around $1,320 to produce one Bitcoin. Even though the price has dropped back to the sixty to seventy thousand dollar range, the profit margin is still astonishing.

This profit margin explains everything that happened next.

In 2022, a law was passed allowing the military to build private power plants. The Revolutionary Guard directly obtained the electricity that was originally meant for the cities. The mining farms are located in military bases and economic zones. The large religious foundation Astan Quds Razavi, directly controlled by the Supreme Leader, is deeply involved, forming a de facto "mining cartel."

By 2023, out of approximately 180,000 mining machines in Iran, 100,000 are owned by state entities or Revolutionary Guard-affiliated companies.

However, Iran is a country known for power shortages, with rolling blackouts during extreme weather being common. This not only affects residents who endure scorching heat or freezing cold but also results in frequent factory closures, leading to industrial workers losing their jobs and small businesses struggling due to unstable power supply. This has sparked protests with slogans like "We endure darkness while they mine Bitcoin."

Where are the mining machines hidden? One widely circulated theory points to mosques. In Iran, mosques are entitled to free electricity by law. The 2025 budget law exempted all Revolutionary Guard bases, Basij centers, and mosques from electricity bills, while the electricity prices for ordinary citizens increased by 38% that year.

In 2019, an Iranian researcher captured images of approximately 100 mining machines spread across different rooms in a mosque, fueling this theory.

However, some industry players hold the opposite view. Urban transformers have load limits, and large-scale mining can cause system overload or even explosions. If the government wanted to mine, they would certainly have more discreet locations.

Regardless of where the mining machines are located, one figure is unavoidable: the hashing power of illegal mining is approximately 400 times that of legal mining. The state-run power company Tavanir, under the Ministry of Energy, could only offer a public reward to catch miners, with an initial reward of 1 million toman, about $24, increasing later to 200 million toman, around $2,300, for each reported illegal mining machine.

While the grassroots report each other for $24, bearing the burden of rising electricity prices, mining farms under military protection flourish. When the Ministry of Energy attempted to shut down a mining farm in 2021, Revolutionary Guard armed personnel physically obstructed the raid.

This is the essence of crypto in Iran: one country, two sets of rules.

The Other Side of the Gulf

As mentioned earlier, the cost of producing one Bitcoin in Iran is approximately $1,320. Across the Persian Gulf in Kuwait, this number is $1,400. Under great pressure, there will always be risk-takers, except Kuwaitis opt to use their own bedrooms. To avoid arousing official suspicion, miners may even choose to turn off their home's air conditioning to conceal the mining machine's power consumption.

In 2023, Kuwait implemented a blanket ban on crypto activities, but the prohibition did not stop the pursuit of profits. In April 2025, the Ministry of Interior conducted raids and seized over 100 illegal mining farms, causing a 55% drop in electricity consumption in the southern Wafra region within a week.

The story of mining has different versions in different countries, as does the story of currency devaluation. Why did Nobitex grow so fast in those years? Because it was precisely when the rial plummeted the most. In 2018, $92,000 exchanged for 1 USD on the black market, but now it has fallen below 1.5 million.

The Turkish lira is also following a similar path, with inflation persistently above 30%. The annual trading volume of USDT/lira on Binance exceeds $22 billion, larger than any Bitcoin trading pair. Between 2024 and 2025, Turkey received nearly $200 billion in crypto assets, with over half of adults holding crypto assets. They do not trust the local currency and can only trust the on-chain dollar, even though many of them do not like the U.S. This scenario is unfolding daily in Tehran and Istanbul.

Just as some people are struggling to preserve their purchasing power, more Gulf countries are already discussing the next era. The UAE has incorporated crypto into the blueprint of its national financial infrastructure. Dubai and Abu Dhabi have each established regulatory bodies for virtual assets, and the dirham stablecoin has been approved for launch, with annual crypto inflows of $53 billion. The same technology serves as a survival tool on one side of the Gulf and a business attraction card on the other.

Interestingly, the crypto brand activities in the Middle East, including Token2049 Dubai, originally scheduled for late April, have been postponed until next year due to the Iran conflict.

The archenemy that has launched strikes against Iran, Israel, plays a more subdued role in the crypto world. This country does not have cheap electricity and does not need to use crypto to bypass sanctions, but it boasts the highest density of blockchain startups globally. Several core projects in the zero-knowledge proof field come from Israeli teams, with StarkWare reaching a valuation of $8 billion in 2025. Despite its token STRK losing 90% of its value after listing and becoming a representative of failed projects, the ecosystem still has few users.

Same Gulf, different worlds, but now they are all embroiled in the same war. By the time this article is finished, some of the names mentioned have already disappeared. Hamanei was killed in an airstrike at the end of February 2026. Several high-ranking members of the Revolutionary Guards were eliminated in a joint U.S.-Israeli strike. The funds that flowed through Nobitex via ghost accounts still have on-chain records, but the owners behind the addresses may have changed hands multiple times. Nine hundred years ago, the Persian poet Hāfez wrote in the "Divan-e Hafez":

In the palace where Jamshid held his cup-bearer revels

Now the deer give birth, and the lion dwells there

That Bahram who hunted the wild ass all his days

Now the grave has caught him, and he sleeps in the dust

Crypto in the Middle East was never just one thing. It was many things. It was the compliance license in a Dubai skyscraper, the life raft on the streets of Ankara after the lira’s collapse, the whirring fan noises rumored to emanate from the basement of a mosque in Isfahan, the $94 billion behind a virtual address in Covent Garden, a cat with a purple bell.

Years from now, when people look back at the crypto chronicles of the Middle East, they may be struck by how it contained both the most cutting-edge tech of the era and the oldest of conflicts. But for the everyday Middle Easterners still stashing their meager salaries on Nobitex as a store of value, this isn’t history; this is their today.

Original Article Link