Power, Warfare, and the Crypto Survival of Middle Eastern Civilians

Original Title: "Crypto Chronicles of the Middle East"

Original Author: Hazel

Original Source: Zhiwu Buyan

In the early hours of June 18, 2025, while tens of millions of Chinese were staying up late to snap up discounted goods, Iran's largest cryptocurrency exchange, Nobitex, was also "liquidated."

A hacker group called Gonjeshke Darande, which means "Predatory Sparrow" in Persian, posted on X, claiming they had breached Nobitex's hot wallets and taken over $90 million. Just the day before, this same group had attacked Bank Sepah, one of Iran's largest state-owned banks.

Then, they did something rarely seen in the history of hacking.

They transferred the entire $90 million into eight "black hole addresses" to be destroyed. These wallets have no private keys; once funds are sent in, they can never be retrieved. Ironically, these addresses all contained embedded phrases like "FuckIRGCTerrorists," with IRGC being the abbreviation for Iran's Islamic Revolutionary Guard Corps.

Taking none of the $90 million and staging such an ironic spectacle, hackers willing to go to such lengths were clearly not motivated by economics.

Twelve hours later, Nobitex's source code and internal files were made public.

Independent investigator Nariman Gharib analyzed these files and found that the destroyed $90 million almost perfectly matched IRGC-linked funds that had flowed into Nobitex via specific wallets over the preceding months.

Therefore, this was less a theft and more a targeted political action on-chain.

When we think of crypto in the Middle East, images that often come to mind are Dubai's licenses, the Token 2049 venue, and after-parties on the Palm Islands. But there is a more secretive, more intricate world that is completely unknown to those of us not living there.

Few can clearly explain: What platforms do Iranians use for trading? Why is crypto trading so pervasive in Turkey? Why is Kuwait the country with the strictest crackdown on mining in the Middle East?

The story of Nobitex might be a key to unlocking this world.

From Chemical Engineer to Iran's "Changpeng Zhao"

After the US and Israel went to war with Iran, a piece of news thrust Nobitex into the spotlight: within minutes of the airstrikes beginning, withdrawal volume on this exchange surged by 873%.

Nobitex's founder is Amir Rad. He doesn't come from a finance background but is an engineer who graduated with a degree in chemical engineering from Sharif University of Technology. Before starting his business, he worked in process safety and risk assessment in the petrochemical industry.

Last year, he appeared on a popular Iranian business podcast, Karnakon Podcast. Interestingly, the show's name roughly translates to "Don't Be a Wage Slave!" This was also his first in-depth public interview after the hacking incident.

According to Rad, in 2017, as a retail crypto trader, he co-founded Nobitex with three friends. The idea was simple: to allow Iranian users to deposit rials and place orders to buy and sell digital assets themselves. That was it.

But the results were far better than they expected. A few months after its launch in 2018, Iranian regulatory hostility towards crypto led to a comprehensive blockade of Nobitex that lasted a year. But it was so popular that even while blocked, the platform maintained 20% organic growth per month.

Today, Nobitex has 11 million registered users, with total inflows exceeding $11 billion, surpassing the combined total of the next ten Iranian exchanges.

What does 11 million mean? Iran's total population is 89 million, meaning roughly one in eight Iranians has registered on Nobitex. Excluding minors and the elderly, the actual penetration rate is even higher. This figure is roughly equivalent to that of the long-established, compliant US exchange Kraken.

A chemical engineer, in eight years, built an exchange covering one-eighth of the country's population. If the story stopped here, it would be a pretty good entrepreneurial legend.

The Wandering Financial Ghost

But the story didn't stop there.

Starting in 2024, open-source intelligence陆续 showed that relatives of Supreme Leader Khamenei and business partners of Mohsen Rezaee, a founder of the Revolutionary Guard Corps, had appeared among Nobitex's major shareholders.

Elliptic's on-chain analysis shows that Nobitex had fund flows with sanctioned Russian exchange Garantex, as well as wallets linked to Hamas and the Houthis.

How did a private company become a front for the highest echelons of power? The intricate details are unknown to us. But in Iran, this script is not unfamiliar.

After Digikala (Iran's version of Amazon) and Snapp (Iran's version of Didi) grew large, they both accepted "strategic investments" from shell companies linked to the Revolutionary Guard Corps or the state telecom group. In this country, when a private enterprise reaches a certain size, someone comes to "help" you.

It's just that what Nobitex carries is far more sensitive than e-commerce or ride-hailing.

In the internal files released by "Predatory Sparrow," Gharib traced a special account. This account was responsible for coordinating the flow of tens of millions of dollars from the IRGC's financial network into Nobitex. But unlike the other 11 million users on the platform, it was completely exempt from KYC verification.

Everyone had to undergo identity verification, except the account moving IRGC funds.

TRM Labs' analysis of the leaked source code shows this account wasn't registered under the identity of some officer. It was more like an invisible channel within the system, attached to a shell import-export company under the IRGC's Quds Force, a VIP whitelist specifically serving politically exposed persons.

But overseas, the person interfacing with this ghost account is no secret. His name is Babak Zanjani.

Cat and Mouse Game

Zanjani's resume reads like a spy novel: sanctioned by OFAC in 2013, sentenced to death in Iran in 2016 (for embezzling billions from the state oil company), sentence commuted in 2024, released from prison in 2025.

The US Treasury Department's take is: he was released to continue laundering money for the regime.

In May 2021, a company called Zedxion Exchange Ltd was registered in the UK. Five months later, a person named Babak Morteza was listed as director and person with significant control.

The US Treasury later confirmed: this person was indeed Babak Morteza Zanjani.

In July 2022, Zanjani disappeared from the company records. Days later, Zedcex Exchange Ltd was registered at the same London address, under the same successor director.

Both companies claimed to be "dormant." On paper, there were only nominal directors and virtual office addresses.

But the on-chain data tells a completely different story. TRM Labs' analysis shows that Zedcex has processed over $94 billion in transactions since registration. The two exchanges combined have processed about $1 billion for the Revolutionary Guard Corps, peaking at 87% of the platforms' total volume in 2024.

Funds flowed as USDT on the TRON network, shuttling between IRGC wallets, offshore nodes, and Nobitex.

An investigation by OCCRP (Organized Crime and Corruption Reporting Project) dug up more details. The registered address for both exchanges, 71-75 Shelton Street, Covent Garden, London, is a virtual office address used for bulk registrations. Over a dozen companies are registered at the same address, including at least six sanctioned entities.

Official videos for both exchanges featured an "Executive Director" named "Elizabeth Newman." OCCRP found this person does not exist. The female image in the video came from a stock footage website, tagged as "Pretty Black woman talking to camera."

Fictional characters, ghost companies, astronomical on-chain flows. But OCCRP initially only had indirect clues. Although Zanjani's name had appeared in Zedxion's director records and whitepaper metadata, he had long since removed himself from all public documents.

The real breakthrough was a cat.

In May 2024, Zedxion's official Telegram channel posted a photo of a grey-and-white cat with a prominent purple bell around its neck. Months later, a cat with identical fur color, pattern, and purple bell appeared on the Facebook page of Zanjani's girlfriend, Solmaz Bani.

Following the Bani lead, journalists discovered she was the registrant for the domain of Zedxion's newsletter, and her name also appeared in Zedcex's email login information. And in Zedxion's official YouTube tutorial videos, auto-fill fields briefly flashed two names: Solmaz, and Babak.

In the face of a cat, even the IRGC's money laundering network couldn't hide.

"We Endure Darkness, While They Mine Bitcoin"

Remember the $90 million burned from Nobitex?

It later proved to likely be IRGC money. But from the outside, it looked like a $90 million hole had appeared on the books of a leading exchange. If not handled promptly, a bank run could happen at any moment.

Nobitex chose to cover the loss with its own funds.

TRM Labs found that after the hack, Nobitex quickly consolidated about $2.7 million from over 100 long-dormant wallets to alleviate the liquidity crisis. These wallets had accumulated mining rewards in 2021 and 2022 and had never moved funds before, with their upstream traceable to two major global mining pools: EMCD and ViaBTC.

We cannot confirm if this money was an external injection or Nobitex's own mining slush fund. But this incident gave us a glimpse into Iran's massive mining industry.

Crypto mining was legalized in Iran starting in 2019. Licensed miners were allowed to mine Bitcoin using subsidized electricity and sell it all to the central bank, which then used it to pay for imports, bypassing the US dollar system.

The government set the industrial electricity price at $0.005 per kWh, making the cost to produce one Bitcoin about $1,320. Even with the coin price falling back to $60,000-$70,000, the profit margin remains staggering.

This profit margin explains everything that happened next.

In 2022, parliament passed a law allowing the military to build private power plants. The Revolutionary Guard Corps directly accessed electricity originally supplied to cities. Mining farms were set up in military bases and special economic zones. The large religious foundation Astan Quds Razavi, directly controlled by the Supreme Leader, was deeply involved, forming a de facto "mining cartel."

As of 2023, out of approximately 180,000 mining machines in Iran, 100,000 belonged to the state or IRGC-linked enterprises.

But Iran is precisely a country with severe power shortages, where rolling blackouts during extreme weather are not uncommon. Not only are residents' lives affected, enduring extreme heat or cold, but frequent factory shutdowns also lead to industrial worker unemployment, and small businesses struggle due to unstable power supply. This has sparked protest slogans like "We endure darkness, while they mine Bitcoin."

Where are the mining machines hidden? One widely circulated theory is mosques. In Iran, mosques legally enjoy free electricity. The 2025 budget bill exempted all IRGC bases, Basij centers, and mosques from electricity fees, while ordinary citizens' electricity bills rose 38% the same year.

In 2019, an Iranian researcher photographed about 100 mining machines distributed in different rooms inside a mosque, fueling this theory.

But some industry insiders hold the opposite view. Urban transformers have load limits; large-scale mining would cause system overload or even explosions. If the government wants to mine, they certainly have more隐蔽 locations.

Regardless of where the miners are, one number is unavoidable: the hash rate scale of illegal mining is about 400 times that of legal mining. Tavanir, the national power company under Iran's Energy Ministry, could only offer nationwide bounties to catch miners. The reward for reporting an illegal mining rig was initially 1 million toman, about $24, later raised to 200 million toman, about $2,300.

Ordinary people report on each other for $24, bearing rising electricity bills. Meanwhile, mining farms with military patronage operate openly. In 2021, when the Energy Ministry tried to shut down a mining farm, armed IRGC personnel arrived on-site and physically prevented the raid.

This is the底色 of crypto in Iran: one country, two sets of rules.

The Other Side of the Gulf

As mentioned earlier, the cost to produce one Bitcoin in Iran is about $1,320. On the other side of the Persian Gulf in Kuwait, this number is $1,400. Where there is great profit, there will be risk-takers, except Kuwaitis chose their own bedrooms. To avoid raising official suspicion, miners would even turn off their home air conditioning to mask the electricity consumption of their mining rigs.

Kuwait completely banned crypto activities in 2023, but the ban couldn't stop the profits. In April 2025, the Interior Ministry conducted raids, seizing over 100 illegal mining farms. Electricity consumption in the southern Al Wafra area dropped by 55% within a week.

The mining story has different versions in different countries, and so does the currency devaluation story. Why did Nobitex grow so rapidly in those years? Because it coincided precisely with the period when the rial collapsed the hardest. In 2018, the black market rate was 92,000 to 1 USD; now it has fallen below 1.5 million.

Turkey's lira is on a similar path, with long-term inflation exceeding 30%. The annual trading volume of USDT/TRY on Binance exceeds $22 billion, larger than any Bitcoin trading pair. Between 2024 and 2025, Turkey received nearly $200 billion in crypto assets. Over half of adults hold crypto assets. Not trusting the local currency, they can only trust on-chain dollars, even if many don't particularly like the US. This happens daily in Tehran and Istanbul.

And just as some struggle to preserve their purchasing power, more countries around the Persian Gulf are already talking about the next era. The UAE has written crypto into the blueprint of its national financial infrastructure. Dubai and Abu Dhabi have each established virtual asset regulatory authorities. A dirham stablecoin has been approved and launched. Annual crypto inflows reach $53 billion. The same technology is a survival tool on one side of the Gulf and a business card for investment attraction on the other.

But ironically enough, the major crypto brand event in the Middle East, Token2049 Dubai, originally scheduled for late April, was directly postponed to next year due to the Iran conflict.