The sons of a powerful family with close ties to Iran’s new supreme leader control the country’s largest cryptocurrency exchange, transforming it from a startup into a conduit to the global economy used by both blacklisted state institutions and ordinary citizens. Since Nobitex was founded by the two brothers under an alternative family name, it has processed between tens and hundreds of millions of dollars in transactions linked to sanctioned groups including Iran’s central bank and the powerful Islamic Revolutionary Guard Corps, a Reuters investigation has found.

The two are members of the Kharrazi family, one of the most influential dynasties in the Islamic Republic. Corporate records show that when the exchange started, the brothers were listed under a surname rarely used by members of the family. The company rapidly became embedded in Iran’s economy. Nobitex claims 11 million users, more than 10% of Iran’s population. Locked out of international banking and facing a devalued rial and rampant inflation, ordinary Iranians use the exchange to buy and hold cryptocurrency. While Iran is subject to blanket Western economic sanctions, the exchange has avoided being designated by the United States and its allies. Reuters could find no indications that anyone in the Kharrazi family has been sanctioned by Western governments, and was unable to determine why Nobitex has been spared the kind of penalties placed on other major Iranian economic players. The revelation of the elite origins of the Nobitex founders by Reuters comes at a critical moment for Iran and especially the Revolutionary Guards, known as the IRGC. The IRGC has further cemented its control of Iran’s economy and security apparatus since the killing of Supreme Leader Ali Khamenei in a February airstrike at the outset of the U.S. and Israeli war in Iran. The brothers are the third Kharrazi generation at the heart of Iran’s ruling establishment. Kharrazis have advised supreme leaders and occupied key political, diplomatic and religious posts. The clan is related by marriage to all three supreme leaders of the Islamic Republic: the revolutionary founder Ayatollah Ruhollah Khomeini, the late Khamenei, and Khamenei’s son, Mojtaba. Brothers Ali and Mohammad Kharrazi – using the family surname Aghamir – built Nobitex into the country’s dominant cryptocurrency provider. It handles an estimated 70% of Iran’s crypto transactions. It’s not unheard of for some Iranians to have and use alternative family names. But the brothers appear to be the only ones in their immediate family to routinely distance themselves from their famous bloodline. Nobitex serves as a bridge to global crypto markets and a central node in a parallel financial system used to move funds beyond the reach of Western sanctions, Reuters found. It’s used by the Iranian state to route money to allies outside the conventional banking system, according to an analysis of blockchain records by crypto analytic firm Crystal Intelligence and interviews with four private financial investigators. Reuters also spoke with nine Iranians who have worked for or with Nobitex, including six who said they were aware of state funds subject to Western sanctions passing through the exchange.

'A flashing red light'

In statements emailed to Reuters, Nobitex denied having direct government connections or assisting the state, and said that any illicit funds moving through the exchange did so without management approval or awareness. The company said the brothers had not changed their identity or used an alternative identity.

The company also said any transactions involving state entities were far below the estimates investigators shared with Reuters.

“Nobitex is a private and independent business. It has never been an arm of the government and has never had any relationship, arrangement, agreement, or contract with the Central Bank of Iran, the IRGC, or any other governmental body,” Nobitex said.

Iran’s government did not respond to requests for comment via the country’s delegations to the United Nations in New York and Geneva.

“Under President Trump’s strong leadership, the United States is moving aggressively with Economic Fury, utilizing all available tools to maintain maximum pressure on Iran and systematically degrade Tehran’s ability to generate, move, and repatriate funds,” a Trump administration official wrote in response to detailed questions about the findings by Reuters. The official made no reference to Nobitex.

Throughout the war, Nobitex has continued processing transactions, even during a government-imposed nationwide internet shutdown and widespread power outages in Tehran, according to three blockchain analysis firms, which track activity involving Nobitex and other exchanges.

During that time Nobitex has processed more than $100 million in transactions, about 20% of its usual activity, according to Crystal Intelligence, which has been investigating Iranian cryptocurrency flows for more than four years.

“The concern with Nobitex is that since it has so much activity that belongs to normal Iranians, it is hard to separate the regime from the people using the platform,” said Nick Smart, chief intelligence officer at Crystal Intelligence.

U.S. Democratic Senator Elizabeth ‌Warren said the revelations about Nobitex were cause for alarm.

“This latest reporting is a flashing red light: Adversaries are using digital assets as an alternative to the U.S.-led global financial system – moving billions easily because too many services across the crypto ecosystem lack basic controls to prevent money laundering and sanctions evasion,” Warren, the ranking Democrat on the Senate Banking Committee, said in a statement to Reuters.

Founding brothers

The original board of directors for Nobitex consisted of brothers Ali and Mohammad along with Amir Hosein Rad. All three studied at the elite Sharif University of Technology, Tehran’s equivalent to the Massachusetts Institute of Technology.

Rad, who is not related to the brothers, and Ali were the public faces of the company, with Rad as chief executive. Mohammad was the blockchain expert.

In an interview for a Nobitex marketing brochure, the brothers used the family name Aghamir. Mohammad described his older brother as “my advisor in life and I have always used his help in making decisions.” Ali was born in 1986 and Mohammad in 1992, according to government and banking records reviewed by Reuters.

Ali, describing his feelings toward the company in the same brochure, said the founders cared for Nobitex like “our own child” and that he believed the company had been particularly blessed: “I have always felt the presence of a kind of supernatural help in every situation.”

Inside the company, the brothers concealed the Kharrazi name even from those closest to them, according to seven of the former employees and professional acquaintances Reuters interviewed. Some of these sources said they have known the brothers since their university days. Then, as now, they did not use the Kharrazi name.

Reuters could not determine why the brothers chose to consistently obscure their origins.

Nobitex did not answer questions about the brothers’ links to the Kharrazi dynasty and made no mention of that family name in its response. A brief message signed by the elder brother, Ali, came from an email address containing the Kharrazi name.

“They are from the Aghamir Mohammad Ali family and have used that name in the ordinary course of their lives,” Nobitex said.

Of the nine former employees and professional acquaintances Reuters interviewed, only one learned of the brothers’ family ties directly from them. Another said he discovered it after researching them. Among those most surprised was a former coworker who counted Mohammad as a close friend of many years standing and expressed shock when Reuters disclosed the Kharrazi family connection to him.

“I was pretty open about my criticism for the regime, and my colleagues were, too,” said another former Nobitex employee. Discovering the brothers’ family name “made me afraid. I did a lot of hate speech against the regime and religion.”

Family tree

Their grandfather was a religious scholar and ayatollah who once taught Iran’s new supreme leader, Mojtaba Khamenei, according to Iranian news reports. The grandfather later served on the Assembly of Experts, the body responsible for choosing Iran’s supreme leader. Mojtaba succeeded his father after the elder Khamenei’s assassination.

A great-uncle served as foreign minister and as an advisor to successive supreme leaders, including Mojtaba.

Their father, Ayatollah Bagher Kharrazi, was the founder of Hezbollah in Iran, a political and religious organisation unaffiliated with the better-known Iranian proxy in Lebanon. Bagher, who ran for president in 2013, wrote on his website that he was also involved in staffing the IRGC after the 1979 Islamic revolution. The brothers’ aunt – their father’s sister – is married to the new supreme leader’s brother.

In Iran’s clerical establishment, “there is an inner circle and an outer circle,” said Fariborz Kalantari, a journalist who was sentenced to prison and 74 lashes in 2021 for writing about corruption in Iran. He now lives abroad. He said of the Kharrazi family, “these people were part of Ali Khamenei’s inner circle.”

Kalantari said others, especially those linked to the revolution, picked up the practice of using alternative surnames during the days before 1979, when many anti-Shah activists were jailed alongside guerrilla fighters opposed to the monarchy.

The Nobitex statement said neither the brothers “nor their father have ever held any governmental or military office or position.” The statement did not name their father.

Despite their prestigious background, the brothers lived modestly as students and young entrepreneurs, said four of the people who knew them. One said that when Mohammad bought his first car, it was a SAIPA Pride, one of the cheapest vehicles available in Iran.

Brother Ali went by the name Seyed Mohammad Ali Aghamir Mohammad Ali. Brother Mohammad was called Seyed Mohammad Aghamir Mohammad Ali. Friends teased them about their long and unusual names, but the brothers never offered an explanation for them, according to one of the people, who knew them outside work. Rumours about their identity emerged in 2024 when a Chinese blog reported that the brothers’ father was a principal stakeholder of the crypto exchange through his son Mohammad, who was using the Aghamir surname.

When Seyed Mohammad Ali Aghamir Mohammad Ali registered the Nobitex domain in 2017, he used an email containing the Kharrazi name. That is the same address that was used to register the website of a religious charity chaired by his father. Company filings show Ali, the elder brother, was listed as vice chairman of that charity. It is also the same email he used to send the message to Reuters.

Public registry notices from the same charitable foundation show the founders’ father has used two different surnames under the same national ID number. In most records he goes by Kharrazi. But in at least one, from 2011, he uses the same surname – Aghamir – that his sons would later use to found Nobitex.

Reuters traced Nobitex's links to the Kharrazi family through Iranian corporate, government and banking records. Artificial intelligence tools were used to extract the names and identification numbers of Nobitex board members and map their relationships. Leaked databases, cross-referenced with the national identity numbers, identified the men as father and sons.

Other members of the family, including the brothers’ aunt, uncles and cousins, routinely use the Kharrazi name in public. The brothers’ grandfather also occasionally used the name Aghamir.

Obscured addresses

Nobitex has publicly stated its aim is to enable Iranians to invest in crypto despite “the shadow of sanctions” and advises its clients on how best to avoid their transactions being monitored or intercepted by Western governments. Nobitex has done business with some of the biggest names in global crypto. Reuters reported in 2022 that Binance, the world’s biggest crypto exchange, moved $7.8 billion for Nobitex, skirting U.S. sanctions against Iran. Binance’s founder, Changpeng Zhao, was sentenced to prison in 2024 for violating U.S. money laundering laws and was pardoned in 2025 by President Donald Trump.

Binance did not respond to questions about its efforts to prevent sanctioned Iranian entities from accessing the exchange.

To hide its tracks, Nobitex changes the wallet addresses it uses for fund transfers. It has also developed cryptographic tools to further obfuscate the links between related wallets because of “increasing restrictions related to international sanctions,” the younger Kharrazi brother wrote in Nobitex's 2021 annual report. Additionally, Nobitex advises clients to layer transactions using multiple wallet addresses to make them harder for Western investigators to track.

Nobitex’s founders have elite connections, but from the outset, the firm had to balance competing demands of various powerful arms of the Iranian state, the former employees said.

Iran’s central bank periodically barred exchanges including Nobitex from accessing the domestic banking system.

Shortly after Nobitex opened for business in 2018, the IRGC visited the firm’s Tehran offices and questioned Rad, who was then CEO, three former employees said. A few years later, they swooped in again, arrested Rad, confiscated staff laptops, and sealed the office, two of the people said. There is no indication he was ever charged.

Explanations swirled around the office about the reason for the various IRGC visits. One of the people said they were payback for Nobitex’s refusal to process IRGC funds linked to sanctioned oil sales. Two others said a jealous competitor had falsely claimed Nobitex was ripping people off.

In a December 2025 interview with an Iranian podcaster, Rad said his arrest in 2021 involved a misunderstanding about the relationship between Nobitex and another company with questionable business practices. Rad, who did not name the other company, described that arrest as “one of the side effects of working in Iran. I think there are very few entrepreneurs in Iran who haven’t experienced something like this.”

Six of the former employees interviewed by Reuters said they were aware that Nobitex was used by Iran’s government and its security agencies to bypass stringent Western financial sanctions. Nobitex said there had never been any agreement with any government agency, and none of the employees interviewed by Reuters knew of one.

“We have faced significant operational restrictions from the Iranian government, including office raids, domain blocking, and banking gateway closures,” Nobitex said. “These actions are entirely inconsistent with the notion that we are receiving any form of governmental support.”

Despite the pressure, Nobitex flourished – and with it the fortunes of the Kharrazi brothers.

The company moved to a flashy new office in 2021 with chill-out areas where staff could play video games, watch movies or gaze at the panoramic views of the Alborz Mountains, five of the former employees said. Their accounts matched photos posted by the company on LinkedIn. Female employees weren’t required to wear headscarves, and the offices stayed open on religious holidays.

A home address linked to Mohammad’s national ID number is in one of Tehran’s wealthiest neighborhoods.

By the end of 2022, the exchange said it had 4.3 million users and 268 employees. Sanctions that had locked Iranians out of the global financial system turbocharged Nobitex’s appeal to its Iranian clientele. Essentially, Iranians could not legally create accounts at exchanges like Binance, but they could with Nobitex, which gave them access to global crypto markets that are subject to patchy international regulation.

The atmosphere changed somewhat in 2022, following nationwide protests triggered by the death of a young woman, Mahsa Amini, in police custody. Amini was arrested for allegedly violating hijab laws.

“The building’s security and the morality police started controlling the hijab of female employees and threatened to seal the office,” said one former employee.

Office dress codes were enforced more firmly after that, according to two former employees.

“Management became stricter about headscarves and security protocols,” said one person who regularly visited Nobitex’s offices and knew the founders well. “Up until then the company looked like a tech start-up.”

Concerns among staffers about their employer’s links to the government deepened after a company connected to one of Nobitex’s main investors, Mohammad Bagher Nahvi, was sanctioned by the U.S. for supplying drones to Russia, according to three former employees. The company, Safiran Airport Services, coordinated “flights between Iran and Russia, including those associated with transporting Iranian UAVs, personnel, and related equipment,” the U.S. Treasury Department said in September 2022. Safiran is listed as a private company whose vice chairman is Nahvi, Nobitex’s former chairman. He was one of the exchange’s first and largest investors.

In the 2022 marketing brochure, Ali Kharrazi described Nahvi as an eager participant “in the very first meeting.” Nahvi did not respond to a request for comment on his role in Nobitex.

During a 2025 hack of Nobitex by the group Predatory Sparrow, about $90 million worth of cryptocurrency was sent to inaccessible wallets labelled with profane anti-IRGC names. In an indication of Nobitex’s vast resources, the company and its shareholders – including the brothers – directly reimbursed customers whose money had been taken.

The IRGC is involved in every significant facet of Iran’s economy and would take a keen interest in a company as critical to the economy as Nobitex, according to a former senior U.S. Treasury official who helped design America’s Iran sanctions policy.

“As soon as a business becomes meaningfully profitable you will see the government coming in and taking its slice,” said Miad Maleki, who worked in the U.S. Treasury Department from 2017 to 2025 and was former associate director of the Office of Foreign Assets Control. He is now a senior fellow at Foundation for Defense of Democracies. “You can’t have a successful business in Iran without it being controlled by the regime.”

Embezzler's complaint

Evidence of how Nobitex fits into Iran’s sanctions-evasion machinery surfaced through an unlikely source: Babak Zanjani, an Iranian billionaire convicted of fraud.

Zanjani has long been a key figure in Iran’s sanctions-evasion networks. He was sentenced to death by Iranian authorities in 2016 for embezzlement. His sentence was commuted in 2024. But Zanjani remains locked in a public spat with Iran’s central bank, which accused him of failing to repay the stolen billions. In a December tirade against the central bank, Zanjani published wallet addresses on social media that enabled outside crypto analysts to uncover a complex sanctions-evasion scheme, with Nobitex at the core.

Part of the scheme involved moving at least $20 million in sanctioned central bank funds to wallet addresses controlled by Nobitex, according to Smart, of Crystal Intelligence, and another crypto analyst.

Zanjani didn’t respond to requests for comment. The transactions were a fraction of a larger network of wallets controlled by Iran’s central bank that bought more than $500 million of cryptocurrencies between November 2024 and June 2025, according to the blockchain analysis firm Elliptic.

About $347 million of that was sent by the central bank, which is sanctioned by the United States, to Nobitex in the first six months of 2025, Elliptic said.

Routing the money through Nobitex after a series of transactions can have the effect of blurring the source of the funds.

Nobitex said any allegedly illicit money that passes through the exchange represents “a very small fraction of overall volume” and happened without the company’s knowledge.

“Where suspicious or non-compliant conduct is identified,” it said, “Nobitex’s approach is firm, including permanent account closure.” The statement did not define “non-compliant conduct.”

Estimates of Nobitex’s total illicit transactions range widely. They are mostly derived from wallet addresses identified and sanctioned by governments including Israel and the United States.

Elliptic has identified an estimated $366 million that was processed through the exchange. Chainalysis puts the figure closer to $68 million; Crystal Intelligence estimates $22 million in direct transfers from sanctioned wallets. Even the upper estimate is only 3% of the total $11 billion in cryptocurrency processed by Nobitex.

All firms cautioned the true figure is likely significantly higher. Among Iran’s allies, at least two of the firms found Nobitex transactions involving accounts linked to Yemen’s Houthis, a movement backed by Iran that is also under Western sanctions. The Houthi media agency did not respond to a request for comment about transactions involving Nobitex.

American and Israeli government sanctions have listed scores of crypto wallets linked to the Central Bank of Iran and the IRGC. Crystal Intelligence and the other private investigators tracked how those wallets moved money through Nobitex and shared their conclusions and methodology with Reuters. Iran’s sanctioned entities also use other means to shift money, such as the informal hawala fund-transfer system and complex off-shore banking networks. On April 28, the United States issued new sanctions targeting what it said was Iran’s “shadow banking architecture.” Nobitex was not included.

On the whitelist

But Nobitex’s key role in Iran’s financial system was laid bare during this year’s war with the United States and Israel.

Since February 28, most ordinary Iranians have been unable to access the internet due to a government-imposed blackout meant to suppress dissent. Yet Nobitex has continued to operate. Nobitex did not respond to questions about how it kept access to the internet during the blackout.

Internet monitoring firm Netblocks says only those on a “state-approved whitelist” – between 1% and 2% of the population – have had access to the internet during that time, as the state cracks down on satellite links and VPNs.

Crystal Intelligence has found that some in that tiny elite have withdrawn at least $54 million from the exchange during the war, much of it vanishing abroad to brokers who turn crypto into cash with few questions asked.

On April 1, Nobitex posted a message intended to reassure customers that “despite instability in infrastructure and service systems,” their money was safe and accessible.

The statement made no direct reference to the war. But the conflict struck close to the Kharrazi brothers that day, when an airstrike targeted the apartment of their great-uncle, Kamal, the former foreign minister who advised the current supreme leader and his assassinated father.

His wife was killed instantly, while Kamal succumbed to his injuries days later, according to state news.

Iran’s new supreme leader, who lost his own wife and father in an airstrike on the war’s first day, extended his condolences on state media and asked for divine exaltation of “the distinguished Kharrazi family.”