Iran’s leading cryptocurrency exchange Nobitex has confirmed a major security breach involving its hot wallets, resulting in the loss of tens of millions of dollars in digital assets. The attack, which appears to be politically motivated, comes as cyberwarfare escalates in tandem with intensifying military conflict between Iran and Israel.
Nobitex Confirms Breach, Promises Compensation
In a statement posted on X (formerly Twitter), Nobitex said that unauthorized access was detected early on June 18 within its hot wallet and reporting infrastructure. While the exact amount lost was not disclosed by the company, Nobitex pledged to fully compensate impacted users using its insurance fund and internal reserves, reassuring customers that its cold storage funds remain untouched and secure.
Blockchain Investigators Estimate $81.7M Lost
Independent blockchain analyst ZachXBT reported suspicious outflows from Nobitex wallets across multiple blockchains, including Bitcoin (BTC), Dogecoin (DOGE), Tron (TRX), and other EVM-compatible chains. The estimated total loss stands at $81.7 million.
Among the most alarming details: the attacker used vanity wallet addresses with anti-Iran slogans such as “FuckIRGCTerroristsNoBiTEX”, strongly suggesting a politically driven motive.
Pro-Israel Hacker Group Claims Responsibility
Shortly after the breach, a pro-Israeli cyber group called Gonjeshke Darande also known as Predatory Sparrow took credit for the attack. In a separate post on X, the group accused Nobitex of facilitating sanctions evasion and financing terrorism on behalf of the Iranian regime. It also threatened to release the exchange’s internal data and source code within 24 hours.
A New Cyber Front in the Iran-Israel Conflict
The hack comes just days after a flare-up in hostilities, with Iran launching missile attacks in response to Israeli airstrikes targeting key military and nuclear installations around Tehran on June 13. The Nobitex breach appears to be a calculated cyber retaliatory strike, aligning with real-world battlefield dynamics.
Gonjeshke Darande is no stranger to headline-making hacks. The group has previously targeted critical Iranian infrastructure, including fuel distribution systems and Bank Sepah, often aligning its attacks with sensitive geopolitical developments. While the Israeli government has never publicly acknowledged ties, cyber analysts believe the group operates with backing from Israel’s elite Unit 8200 cyber intelligence unit.
Nobitex’s Controversial Track Record
Nobitex has been under scrutiny in recent years for its alleged role in circumventing international sanctions. A 2022 Reuters investigation revealed that $8 billion in crypto transactions flowed between Nobitex and Binance from 2018 to 2022 raising red flags among global regulators.
As Iran’s top crypto platform, Nobitex plays a critical role in providing digital asset access to Iranian citizens, especially amid strict international sanctions and limited traditional financial channels.
The Nobitex cyberattack marks one of the most significant politically motivated crypto exchange hacks to date, blending cyberwarfare, financial sabotage, and geopolitical messaging. With regional tensions escalating and cyber capabilities evolving, the incident could be a harbinger of more targeted attacks on crypto infrastructure amid global conflicts.
As the investigation continues, all eyes will be on Nobitex’s recovery efforts and whether the promised compensation will be enough to restore trust in Iran’s embattled digital asset ecosystem.
