Back Resecurity

Cyber Battlefield: Ariomex, Iran-Based Crypto Exchange, Suffers Data Leak

Resecurity • March 3, 2026

Cyber operations against Iran are used not only to disrupt military capabilities but also to pressure senior regime officials and their associates to defect, and to accelerate regime change from within. Current events affect multiple layers of the Iranian regime, including the financial system, where the Iranian government invests substantial efforts in building tools to evade sanctions and finance illegal activity, including via cryptocurrencies. In January 2026, the Central Bank of Iran (CBI) acquired more than half a billion dollars ( $507 million) worth of Tether’s USDT , with indications that the stablecoins were used to prop up the country’s fiat currency. Earlier, the U.S. Treasury Department sanctioned two crypto exchanges, Zedcex and Zedxion, for the first time under Iran-specific financial sanctions. The exchanges were accused of facilitating transactions for the Islamic Revolutionary Guard Corps (IRGC) .

Based on our assessment, there are multiple cryptocurrency projects in Iran designed to conduct money laundering by the state and proxies associated with the Iranian regime. Considering the current events, Resecurity expects to see state-affiliated actors move funds out of the country by converting them into cryptocurrencies through shadow intermediaries. Given the regulatory oversight and increasing attention to such operations, leveraging offshore exchanges will become more challenging for Iranian actors. This is why the role of domestic exchange platforms in Iran will increase substantially.

Resecurity acquired the Ariomex's database, one of the largest cryptocurrency exchange platforms in Iran. This report presents the findings of a structured analysis of the leaked database, which contains information end users, their transactions, and the context surrounding their operations, covering the period from 2022 to 2025 . Our analysis focused on sanctions exposure, financial crime risk indicators, cyber-enabled activity, cross-platform transaction flows and suspicious activity.

For example, in one of the acquired communications, Resecurity identified an individual named Seyyed Younes Shokori Bilankouhi requesting to deposit 3 million USD "with the help of the Iranian embassy." In another case, an individual named Ramin Lak wanted to exchange 5 million USD . Notably, some users were using Ariomex as a "bank"—purchasing crypto and parking it there like in a traditional banking account. For example, user Eyraj Jaafari purchased digital assets worth 100,000 USD several times but preferred to "cash it out later."

Resecurity interprets Ariomex as a shadow financial institution aligned with the Iranian regime. Our team outlines disrupting the financial flows linked to the Iranian regime and taking control of crypto-exchangers serving malign interests as one of the strategic priorities.

Exchange Name: Ariomex.com Country of Operation: Iran Date Established: 2022 Ownership Structure: Private

Core Services Offered:

Potential mechanisms observed:

These mechanisms may enable funding of supporters of Iran outside the country by providing 'transit,' which, in the context of current events in Iran, may be used for terrorism financing and other illegal activity.

There are approximately 11,826 total records , of which around 7,710 originate from Iran , based on IP address data and associated network intelligence.

The remaining records are distributed across the following countries:

During our investigation, we have noticed that 70% of cryptocurrencies purchased/exchanged were Tether and Tron ; the rest are primarily Bitcoin , Etherium , and other currencies.

90% of these transactions are small, as Iranians are likely trying to purchase crypto such as Tether (USDT) to hold the value of their assets when the local currency gets devalued. However, we were able to track conversations with customer support in the DB where some actors were asking to transfer large amounts, ranging from $50,000 to $100,000 USD daily.

Given the current economic problems and an average salary of $400–$500 USD per month in Iran, transferring these amounts in a day or a month is a red flag . It is an obvious sign of bypassing sanctions or money laundering .

Users reaching out to customer support were constantly comparing them to another exchange called Nobitex ; it appears Nobitex has fewer restrictions on cashing out, while this exchanger enforces more. Ariomex may be interpreted as a 'niche' player, supporting the Iranian shadow crypto economy.

During our investigation, we were able to extract the data from the database and compare it with the Office of Foreign Assets Control (OFAC) Sancions List . We were able to find 27 people who had matching records; however, we cannot verify them definitively due to a lack of information regarding National ID numbers, or missing National ID numbers within the local database records.

In fact, such tactics may be purposely used by Ariomex , where actors associated with the Iranian regime could receive additional privileges; hence, their profiles would contain a lack of information.

On June 18, 2025, Nobitex , Iran’s largest cryptocurrency exchange handling ~87% of the nation's transaction volume, was targeted in a similar major cyberattack by an Israel-linked group known as Predatory Sparrow (Gonjeshke Darande) . The attack resulted in a $90 million loss from the exchange's "hot wallets," with the funds being burned (rendered unrecoverable) rather than stolen, in a politically motivated effort to disrupt Iran's sanctions-evasion infrastructure. Following the breach, investigations revealed that Nobitex operated as a key tool for the Iranian regime, featuring a "dual-track" system that enabled warrantless state surveillance while providing special, unmonitored access to high-value (VIP) users and regime officials .

We have noticed similar situation at Ariomex - that some profiles did not have complete information or that it was purposely modified. Resecurity identified multiple suspicious transactions involving large amounts.

Asking to buy (exchange) $19 Million USD Email: [email protected] FirstName: Zahra Surname: Khazaei IP: 5.126.48.39 OS: Android 8.0.0 Browser: Chrome 106.0.0.0 Country: Iran

Furthermore, we were able to discover at least 35 actors who were attempting to bring $1,000,000 to $5,000,000 into Iran, or cash out $50,000 to $100,000 USD (daily) using this exchanger. For more information, please refer to Appendix A.

Accounts Flagged for Further Review: (full data can be found in Appendix B )

Cyber Battlefield: Ariomex, Iran-Based Crypto Exchange, Suffers Data Leak

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Companies (2)

Countries (4)

Domains (2)

Industries (1)

Platforms (1)

Tools (1)