Is Sarrafex Exchange Legit? A Review of Its Security Record

The Iranian exchange Sarrafex began operating in 1401, and according to our research, the legal name of its parent company is «Fanavari Danesh Hooshmand Donya-ye Majazi» (Smart Knowledge Technology of the Virtual World). The founding notice of this limited liability company was published in 1401 with national ID 14011548212. A notable point regarding the legal nature of this exchange is its company type, namely «limited liability». In this type of company, the partners' liability is limited to the amount of their contribution.



 

Its declared address in the Official Gazette change notice is as follows:

Tehran, Amaniyeh, Giti Blvd., Golestan Blvd., No. 17, 2nd Floor, West Unit

The exchange has also become a member of the Iran Fintech Association. Importantly, the image of the fintech certificate shows that the exchange's membership expired on 4 Esfand 1404. Membership in a trade association should not be considered equivalent to a license guaranteeing the exchange's operations or a backing for repaying users' assets. Below you can see an image of its certificate.

As of the time of reviewing this article, no documented report confirming a successful breach of Sarrafex itself and theft of user assets was found, but the absence of reports does not prove that the infrastructure of a crypto exchange has never faced a security issue.

The more important issue for users is the status of access to their assets. There are reports in 1405 of disruptions to Rial and crypto withdrawals and ongoing disruptions to deposits and withdrawals. We do not independently confirm or deny these reports. However, the same source, in another report, referred to a response from Sarrafex support stating that access to part of the assets held in one of the wallets had run into problems for reasons beyond the exchange's control, and that Sarrafex is securing alternative funds to settle some obligations. Note that this explanation is not a confirmation of a Sarrafex hack; at the same time, the access and settlement problems cannot be ignored when assessing its credibility.

 

Does Sarrafex have a history of fraud?

In the sources reviewed, no document proving fraud by Sarrafex can be found. However, as mentioned, there are reports of withdrawal disruptions and user complaints about not having access to their assets. Therefore, Sarrafex exchange can be considered legitimate if we base this on the absence of a fraud history and its legal registration.

Sarrafex's technical documentation shows verification options via SMS, email and an authenticator app, last-login information, and a status for withdrawal addresses. This documentation indicates that such features are defined in the account structure. However, it should be noted that the presence of an option in the documentation is not an independent assessment of the quality of its implementation or the security of the exchange's entire infrastructure. Below, we take a closer look at how Sarrafex secures its users.

 

Account security tools at Sarrafex: two-factor authentication (2FA)

Sarrafex has documented the option of using two-factor authentication (2FA) with in its documentation. An authenticator generates a code separate from the password, and enabling it can reduce the risk of someone logging in with a leaked password. Users should also keep its setup code and recovery information confidential.

 

How can you increase the security of your trading on the Sarrafex exchange?

First, type the address sarrafex.com into your browser yourself, and set strong, unique passwords and two-factor authentication for your exchange account and the email linked to it. Before transferring crypto, carefully check the asset name and network. Below is Section 8 of the Sarrafex exchange's terms and conditions, which covers ways to increase security:

«Despite all the safety procedures Sarrafex has adopted in accordance with the law when providing its services, security measures unfortunately cannot be 100% guaranteed; therefore, you should:

8-1 Protect your account information and do not share it with third parties.

8-2 Be sure to enable two-step login for your Sarrafex account.

8-3 Choose a password that is as hard as possible for others to guess.

8-4 If your mobile phone is stolen, and also before giving up the email address and phone number you used to create your account, notify Sarrafex immediately so that your account can be suspended. Otherwise, and in cases where third parties gain access to your password, full responsibility for any use or misuse of your account lies with you, and Sarrafex bears no responsibility in this regard.»