Scratching the Surface: Toobit’s Iran Footprint

Editor's Note: The underlying research and blockchain analysis in this article were originally published by Applied Technology Solutions (ATS), a Meridian3 joint venture partner, on September 8, 2026. (Link)

What the Blockchain Does Not Show

On-chain, Toobit’s exposure to Iran looks limited. Wallets attributed to the offshore cryptocurrency exchange show relatively little direct interaction with known Iranian exchanges. Viewed through blockchain analytics alone, an investigator could reasonably conclude that Toobit’s Iran footprint is modest.

Off-chain, however, and a different picture emerges.

Toobit operates a Persian-language customer ecosystem, has recruited for Persian business development, accepts Iranian identity documents in its onboarding process, and has reportedly told Persian-language reviewers that it serves Iranian customers.

That disconnect is significant. On May 1, 2026, OFAC clarified that Iranian digital-asset exchanges meet the regulatory definition of Iranian financial institutions and are blocked under U.S. sanctions whether or not they appear on the SDN List. On June 2, OFAC designated Nobitex, Wallex, Bitpin and Ramzinex; on August 7, it added Aban Tether. OFAC has also warned that foreign financial institutions and other non-U.S. persons transacting with designated Iranian exchanges may face sanctions exposure.

FATF continues to place Iran under its highest-level Call for Action, and in 2026 again urged jurisdictions to apply risk-based limits to business relationships and financial transactions involving Iran, including virtual-asset transactions. FinCEN likewise warned in May that Iran-based digital-asset service providers connect Iranian actors to the global crypto ecosystem, identifying foreign money services businesses and international digital-asset platforms as areas of concern.

Toobit falls within that category. It claimed 3.9 million users as of October 2025, while CoinMarketCap recently recorded daily spot volume of roughly $1.4 billion to $2 billion and derivatives volume many times higher. Exchange-reported figures are difficult to verify, but even a fraction of that activity would make Toobit a significant player. The broader record tells a considerably different story than its blockchain footprint alone.

A Public Footprint Built for Iranian Users

A Persian-language interface alone would establish little. Persian is spoken outside Iran, and multilingual support is common among global cryptocurrency platforms. Toobit, however, goes well beyond translating its website.

Its Persian operation includes trading functionality, customer support, KYC guidance, withdrawal instructions, compliance material, and detailed product education. Persian-language guides explain leveraged futures, copy trading. DEX+, yield products, and event-based contracts. They carry Toobit branding, link to dedicated Persian-language YouTube, X, Instagram, and Telegram channels, and show the mobile app in a Persian, right-to-left interface. At least one identifies its author as the “Toobit Persian Education Group.” Persian-speaking users can also reach Toobit support through live chat and a Telegram group staffed by dedicated admins.

The commercial effort extends to personnel. Toobit has advertised on LinkedIn for a Persian Business Development Manager, and at least two public LinkedIn profiles identify Toobit employees based in Tehran.

The onboarding evidence is more telling. A Persian-language review site tested Toobit’s registration and verification flow for Iranian users. According to the review, users could register with an email address or Iranian mobile number and begin spot and futures trading without identity verification. Unverified accounts could withdraw up to 5 BTC per day — close to $400,000 at September 2026 prices — while verified accounts could withdraw up to 50 BTC. Iranian users could complete verification, although “Iran” did not appear in the country selector, reviewers were instructed to choose “Persia,” then upload Iranian identity documents and complete facial recognition. When they asked Toobit support directly whether Iranian customers were permitted, support reportedly said yes.

Access was similarly direct. The reviewers reported that Toobit’s website and mobile app loaded from an Iranian IP address without a VPN, even as the platform blocked connections from the United States, Hong Kong, China, South Korea and Singapore. They also reported that during Iran’s mid-2025 internet shutdown, Toobit remained accessible through Iran’s domestic National Information Network using a secondary domain that Toobit’s main site identified as an official access route.

No single fact establishes intent. Taken together, however, Persian- language customer infrastructure, Iran-compatible onboarding, business-development recruiting, Tehran-based personnel, Iranian IP access and a support desk reportedly confirming Iranian customers describe something more than Iranian users simply discovering that a global exchange happens to work inside the country.

Iran is Missing from Toobit’s Restrictions

Toobit’s own documents draw its Iran restrictions narrowly. Section 13.3 of the Terms of Use says the company is committed to FATF and OFAC standards and lists jurisdictions it does not serve. The list includes North Korea and Myanmar, which join Iran on FATF’s Call for Action blacklist, as well as Cuba, Syria and Russian-controlled regions of Ukraine, which, like Iran, are subject to broad U.S. sanctions. Iran is the notable omission. The Persian-language Terms reproduce the same clause and the same list. The English page was updated on June 16, 2026 — two weeks after OFAC designated four Iranian exchanges — without adding Iran.

Toobit has published one Iran-specific restriction. In February 2026, it listed Iran among the countries where customers cannot purchase cryptocurrency by credit or debit card. The same notice says the restriction applies only to card purchases and does not affect other Toobit services.

For an Iranian customer, that is a limited barrier. Toobit does not support rial deposits or withdrawals; customers fund accounts by sending cryptocurrency to a Toobit deposit address and withdraw the same way. An Iranian user therefore may be unable to buy crypto with a bank card while retaining access to crypto-funded trading and other platform services.

Gold Tokens Whose Issuers Exclude Iran

The issue extends to assets offered on the platform. Toobit Persian has promoted two gold-backed tokens: PAXG issued by Paxos, and XAUT, issued by Tether Gold. Its guide says XUAT is available on Toobit’s spot market and PAXG on both spot and perpetual futures, with leverage of up to 75x. It presents the products as a way to hold gold without physical storage and highlights Paxos’s New York regulatory oversight and Tether’s reserve reporting. A separate Persian-language review site describes PAXG as one of the trading symbols attractive to Iranian users.

Both issuers impose restrictions that reach Iran, although in different ways. Paxos says it will not approve accounts for customers residing in jurisdictions subject to U.S. Treasury sanctions or FATF restrictions, which include Iran.

Tether Gold is more explicit: its terms identify Iran as a prohibited jurisdiction and state that persons in Iran may not directly or indirectly hold XAUT, including through secondary-market purchases.

Inside a centralized exchange, however, the blockchain generally identifies exchange-controlled custody infrastructure rather than the customer behind an internal balance. An issuer therefore cannot determine from blockchain activity alone whether the beneficial customer behind a Toobit position is in Iran. For secondary-market trading within Toobit, enforcement of customer-level restrictions depends heavily on Toobit’s own controls.

Registered with FinCEN is not “Licensed by FinCEN”

Toobit also invokes U.S. registration as part of its compliance credentials. Its CoinMarketCap profile, in text supplied by the exchange, describes Toobit as Cayman Islands centralized exchange (CEX) “licensed under FinCEN.” Its Risk & Compliance Disclosure cites an MSB registration number.

FinCEN’s database shows what that registration is. Hopeful Technology Co., Ltd., Toobit’s contracting entity, appears at a Cayman Islands address under a filing dated December 17, 2025. The filing declares every category of MSB activity on the form — including check cashing and the issuance and sale of traveler’s checks and money orders — and claims money-services activity in all fifty states, the District of Columbia, and every U.S. territory, with zero branches. Toobit, meanwhile, blocks U.S. IP addresses.

FinCEN registration is not a license or government approval. The agency’s own registrant transcript states that FinCEN does not recommend, approve, or endorse businesses that register as MSBs. Registration is a Bank Secrecy Act filing requirement; FinCEN does not verify the information submitted, and state money-transmission licensing is a separate regime.

FinCEN has warned specifically warned about this type of claim. In a December 2024 alert, it reproduced a redacted example of a virtual-asset company announcing that it had obtained an “MSB license” as evidence of enhanced compliance. FinCEN explained that registration does not constitute government approval, does not establish the adequacy of a compliance program and does not authorize nationwide authorization. It identified claims of a FinCEN “license” or “approval” as a potential red flag.

Toobit’s description of itself as ‘licensed under FinCEN’ closely resembles the type of claim FinCEN warned about. The underlying registration is a self-reported filing made a year after that alert, declaring nationwide U.S. money-services activity by an exchange that blocks U.S. customers while permitting Iranian ones.

What the Blockchain Does Not Show

Toobit is readily identifiable on-chain. It publishes addresses through its proof-of-reserves program, and blockchain analytics providers attribute its hot and cold wallets. Our review found relatively limited direct contact between attributed Toobit wallets and the Iranian exchanges OFAC designated in June and August. That pattern is consistent with Toobit’s stated counterparty controls: Persian-language reviewers were told that transfers involving exchanges such as Nobitex and Bitpin could trigger restrictions, additional scrutiny or documentation requests. In practical terms, a customer in Iran can use Toobit, but funding the account directly from a known Iranian exchange may create problems.

That distinction is critical for blockchain analysis. A platform can permit Iranian customers while screening their most obvious Iranian counterparties. The result may be relatively little direct Toobit-to-Nobitex activity even if Toobit has a meaningful customer base inside Iran. The customer remains; the clearest on-chain signal of the customer’s jurisdiction disappears.

DEX+ creates a second blind spot. Customers can use USDT  held in Toobit accounts to access on-chain tokens across multiple blockchains, including Solana and BNB Smart Chain, without connecting a personal Web3 wallet or controlling private keys. DEX+ tokens cannot currently be deposited from or withdrawn to an external wallet; they remain inside the Toobit account until sold, when the proceeds return in USDT.

The trade still occurs on-chain, but an analytics platform may see a Toobit-controlled wallet interacting with a decentralized exchange or smart contract rather than the customer who initiated the trade. An Iran-based user of DEX+ could therefore generate activity that appears simply as Toobit interacting with decentralized infrastructure.

Together, these features obscure the jurisdictional signal. Counterparty screening can reduce direct flows to known Iranian exchanges, while Iranian customers enter through onboarding that accepts Iranian documents and IP addresses, fund accounts from wallets with no obvious jurisdictional label, and use products executed through Toobit-controlled infrastructure. The blockchain can identify Toobit accurately while revealing very little about the Iranian customer behind the activity.

Scratching the Surface

None of this establishes that Toobit has violated U.S. sanctions or any other law. For users outside the European Economic Area, including users in Iran, Toobit’s Terms identify Hopeful Technology Co. Ltd. in the Cayman Islands as the contracting party; EEA users contract with Elyndret Sp. zo.o. in Poland. Whether a particular transaction creates exposure under U.S., EU or other authorities depends on the parties, assets, jurisdictional nexus and facts this review cannot see. That is a question for counsel and regulators.

The analytical point is separate. Iran-facing cryptocurrency activity does not have to pass through a company incorporated, licensed or branded as Iranian. It can move through an offshore platform whose corporate registration and blockchain attribution appear unremarkable while its customer-facing operation tells a different story. Toobit’s paperwork points to the Cayman Islands and Poland. Its FinCEN filing claims activity across all fifty states. Its blockchain footprint says little about Iran. Its Persian-language operation says Iranian customers can access the platform, verify with Iranian documents, and trade products that carry issuer-level Iran restrictions.

For sanctions and AML teams, that second layer is the point. Screening an exchange against the SDN List and checking attributed wallets for flows to Iranian exchanges are necessary, but neither answers the harder questions: Which markets is the platform actively cultivating? Which jurisdictions will it onboard? Which customer-level restrictions is it expected to enforce but cannot be seen enforcing on-chain? Answering those questions requires going beyond attribution — reading what the platform tells customers in their own language and examining the off-chain signals that blockchain data cannot capture.

Meridian3 works at the intersection of OSINT, FININT, sanctions, and cryptocurrency investigation. This is an area we continue to examine closely.