Elliptic's blockchain analysis highlights a distinct shift in how the CBI managed its USDT over time. Until June 2025, the vast majority was sent to Nobitex, Iran's largest cryptocurrency exchange. Nobitex allows its customers to store USDT, exchange it for other cryptoassets or sell it for rials.

This operational pivot coincided with a significant security breach at Nobitex. On June 18, 2025, $90 million in cryptoassets were stolen from the exchange in a hack perpetrated by the pro-Israel group Gonjeshke Darande ("Predatory Sparrow").

The group claimed that Nobitex ”...is at the heart of the regime's efforts to finance terror worldwide, as well as being the regime's favorite sanctions violation tool.” Rather than being sold, the group destroyed the stolen cryptoassets by sending them to a wallet with no known private keys.

should have just bought bitcoin and self-custodied.