Review of the Credibility and Security of Nobitex Exchange

Nobitex was founded in 1396 by «Amirhossein Rad» together with two of his university classmates. The company started out by providing a platform for buying and selling cryptocurrency in Iran, and Rial and Tether markets and other trading services were gradually added. Today, according to Nobitex's official guide, users can carry out spot and margin trading on the platform or use «Easy Buy».

Nobitex is registered under the legal name «Rahkar Fanavari Nouyan», and an image of its membership certificate in the Computer Trade Organization has been published; however, the published certificate has expired and its renewal status needs to be verified. This certificate on its own also does not mean that a dedicated license for crypto trading has been obtained from the Central Bank.

On the security side, Nobitex offers tools such as two-factor authentication and restricting withdrawals to whitelisted addresses, and has run a program for receiving vulnerability reports from security researchers. On its reports page, it also refers to a proof-of-reserves certificate prepared in cooperation with official court-appointed experts. These measures are part of the company's security record, but they should be assessed alongside the Khordad 1404 security incident and how its consequences were handled.

Blockchain analytics firm TRM Labs estimated that, during the period it reviewed in 2025, Nobitex processed more than 87 percent of the crypto transaction volume linked to Iranian entities. This figure shows the scale of Nobitex's activity in the data TRM examined and, on its own, is not a measure of asset security or service quality. 

After buying crypto, one important question remains: while the assets are on Nobitex, where are they actually held? The answer comes down to the difference between two types of wallets. Hot wallets are connected to the internet and make withdrawals possible; cold wallets are used to hold assets without a permanent internet connection.

Nobitex says it keeps the bulk of users' assets in cold wallets and that transfers from these wallets require approval from several people. A review of documents published after the 1404 cyberattack also shows that the exchange's asset custody structure is made up of several different layers. However, Nobitex has not publicly disclosed, in a verifiable way, the exact share of assets held in each layer.

Cold storage makes internet access to the assets held in it more difficult, but on its own it is not a sufficient criterion for considering an exchange secure. The security of withdrawal systems, control over staff access and the exchange's ability to handle an incident also matter; a topic we will return to when reviewing the history of the attack on Nobitex.

Yes. On 28 Khordad 1404, during the 12-day war, Nobitex was the target of a cyberattack. This was not a rumor or a routine withdrawal disruption; Nobitex itself refers to the «Khordad 1404 security incident» in its biannual report, and blockchain analytics firms have also recorded asset transfers from its wallets.

Estimates of the amount involved vary: in its report on the day of the incident, TRM Labs reported the transfer of nearly 90 million dollars in crypto, and Elliptic put the assets identified in the attackers' addresses at more than 90 million dollars. These assets were moved across several networks, including Tron, Ethereum and Bitcoin. The group «Predatory Sparrow» claimed responsibility for the attack. According to Elliptic, the way many of the destination addresses were created indicates that the transferred assets have effectively been put out of reach; however, without further information, the amount transferred should not be taken as equal to users' final losses.

A fair analysis cannot focus only on strengths. By monitoring social networks and specialist forums, you can see what users say about Nobitex, the online exchange for buying and selling crypto .

 Strengths according to users:

• Access via web and app: Nobitex offers both routes for trading. How smooth they feel depends partly on the user's own needs and experience; before transferring a large amount, it is best to test the order placement and withdrawal process with a small amount.
• Market depth: In terms of activity volume, Nobitex is a major player in the Iranian market; however, this does not mean all large orders will be executed without price slippage. For each cryptocurrency, you should check the bid-ask spread and the orders in the order book at that moment.
• Choosing the transfer network: Crypto deposit and withdrawal options depend on the cryptocurrency and the status of each network. Before transferring, check on that cryptocurrency's page that the network is active, what the fee is, and that the source and destination networks match. 

On the other hand, several issues draw criticism from users:

• Support and withdrawals during busy or crisis conditions: Published experiences of response speed vary, and no specific response time for all users can be concluded from them. If immediate access to your assets matters to you, check the withdrawal status and support channels before trading.
• Identity verification and account limits: Upgrading your account level requires submitting information and, for level two, image-based identity verification. These steps may be time-consuming for some users. Identity verification is one of the tools for preventing abuse, but it does not guarantee the security of assets or the absence of misconduct on the platform.

Account security doesn't depend only on the exchange's infrastructure; how users handle their accounts also plays an important role in protecting their assets. To help reduce human error and unauthorized access, Nobitex provides users with the following tools:

• Two-factor authentication (2FA): Using Google Authenticator, an extra layer of security is added when logging in to the account and withdrawing funds.
• Anti-Phishing Code: A personal code shown in Nobitex emails that helps users tell genuine emails apart from fake messages.
• Active Sessions management: Users can see the devices connected to their account and manage sessions they don't recognize or no longer need.
• Address whitelist (Whitelist): By registering approved addresses, crypto withdrawals are restricted to those addresses only.

Nobitex is one of the best-known crypto trading platforms in Iran. With its range of markets and visibility, Nobitex has managed to define the «gold standard» for domestic exchanges. Technically, platform stability gets a passing grade during sharp market pumps and dumps. While many smaller exchanges go offline under heavy traffic, Nobitex's infrastructure has shown strong resilience. Also, market depth and liquidity on this exchange are such that the spread is kept to a minimum, an undeniable advantage for large traders.

But for an impartial view, a few points deserve sharp criticism:

• Monopolistic behavior and gaps in accountability: Because of its huge market share, Nobitex sometimes finds itself in a position of absolute power. As a result, when system problems occur or users make deposit mistakes, the support handling and response process (ticketing) can be very slow and sometimes has a «top-down» tone.
• Unquestioning compliance with non-transparent orders: Although complying with domestic laws is essential for the company's survival, users seriously criticize the exchange for not standing up to arbitrary account freezes by various authorities. Transparency about «when and why» a user's account gets frozen is still shrouded in ambiguity.
• Relatively high fees: Compared with emerging domestic competitors and international exchanges, Nobitex's fee rates (especially at lower user tiers) are high. The exchange uses its «reputation» as leverage to keep fees high, which is a major downside for day traders.
• Delays in listing trending cryptocurrencies: Nobitex is usually very conservative and slow to add new and trending coins (such as new meme coins or new layer 2 projects), which drives users' capital to foreign exchanges or bolder domestic competitors.

As one of the well-known crypto trading platforms in Iran, Nobitex is an option worth considering for many users; however, an exchange's credibility cannot be judged solely by its track record or the scale of its operations. Users' experience with service stability, transparency in handling account restrictions, quality of support and the real cost of trading also play a role in this assessment. Ultimately, whether Nobitex is suitable depends on each user's needs and the market conditions they have in mind; so it is best to check the fees, order book depth and withdrawal terms before trading.