Executive Summary
On Friday 30th January, NOMINIS identified that Nobitex, Iran’s largest exchange, staked over $10 million worth of Ethereum (ETH) within a 6 hour window, through a leading Ethereum Staking protocol.
The activity was detected through NOMINIS’ wallet attribution and staking flow analysis, linking funds to exchange-associated infrastructure, rather than retail, or smaller actors.
Based on the scale, coordination and wallet behaviour, NOMINIS assesses the staking activity is most likely performed by Nobitex itself, rather than dispersed individual actors. The capital concentration and execution pattern are consistent with institutional treasury management or omnibus-level deployment, indicating a deliberate financial strategy rather than speculative retail behaviour.
This is not a routine on-chain event. As tensions heighten between the US and Iran, this is a strategically significant move, occurring at a moment of heightened political pressure.
Concerns Surrounding National Security
It may offer a glimpse into how sanctioned entities like Iran are adapting themselves, to tightening global financial constraints, by embedding themselves deeper into decentralised blockchain infrastructure, in an attempt to catch a financial lifeline,
Ethereum staking is often described as a passive yield strategy, but in reality, it places capital directly into the network’s security and validation layer of the network, embedding the staker, in this case Nobitex, within the operational backbone of one of the world’s most critical ecosystems.
Since Nobitex is Iran’s largest exchange, this case study raises concerns that extend beyond compliance - ie, how this staking was validated without due diligence - into national security, sanctions enforcement, and infrastructure layer financial risk.
Concerns surround how easily capital of sanctioned regions can enter Ethereum's staking infrastructure, without being identified as such. Most staking protocols and validator operations do not perform counterparty due diligence or sanctions screening on staking deposits. In practice, as seen yesterday, this means a sanctioned entity can route funds, obscure provenance, and stake capital while appearing no different to compliant users.
The need for Due Diligence at the Infrastructure Layer
With the growing blind spot at the blockchain infrastructure layer, where staking protocols are failing to perform counterparty due diligence, legitimate users can become indistinguishable with illicit actors, or even worse, become conduits for terror activity. The identity verification is not only a regulatory benefit, but ensures the legitimacy of regular users is maintained and permitted, and preserves large banks’ abilities to continue to accept funds from this particular pool.
This case study demonstrates how a sanctioned financial institution can leverage decentralized infrastructure to bypass traditional compliance checkpoints, preserve capital, and sustain financial resilience; for those who care about the prevention of illicit activity, and preservation of safe use of the crypto ecosystem, this raises not only regulatory concerns but broader national security risks, as blockchain infrastructure can clearly be utilised as a vector for sanctions evasion.
This remains a developing situation and NOMINIS continues to monitor related wallets, additional staking activity, and downstream exposure tied to sanctioned-region capital operating at both the infrastructure and financial layers of blockchain networks.
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.
