In a dramatic escalation of cyber-financial warfare, Iran has ordered an operational curfew on all domestic cryptocurrency exchanges following a devastating attack on Nobitex, the country’s largest crypto trading platform. The incident, which occurred on June 18, has resulted in over $90 million in losses, according to blockchain analytics firm Chainalysis.
The attack has been claimed by Gonjeshke Darande (Predatory Sparrow), a pro-Israel hacker group, in what is being described as a politically motivated strike targeting Iran’s crypto-based financial infrastructure.
Assets Burned, Not Stolen: An Attack Designed to Destroy
Chainalysis confirmed that the stolen funds including Bitcoin (BTC), Ethereum (ETH), Dogecoin (DOGE), Ripple (XRP), Solana (SOL), Tron (TRX), and Toncoin (TON) were drained from Nobitex’s hot wallets and sent to unspendable burn addresses.
“This was not a typical exploit driven by profit. The assets were destroyed deliberately,” Chainalysis wrote. “No funds were laundered via mixers or sent to exchanges.”
Significant portions of ETH were sent to Ethereum’s notorious “0x…dead” address, while Bitcoin was routed to a provably unspendable wallet with an invalid checksum. Some addresses included anti-IRGC (Islamic Revolutionary Guard Corps) slogans, further confirming the political nature of the operation.
Iranian Authorities Respond with Exchange Curfew
In the wake of the attack, the Central Bank of Iran has imposed a curfew on all crypto exchanges, limiting operations to between 10:00 AM and 8:00 PM local time.
“This operational curfew could signal increasing pressure on exchanges operating within Iran, as the regime attempts to manage systemic risk in a market that plays an outsized role in navigating around global sanctions,” Chainalysis noted.
The move underscores growing regulatory anxiety in Tehran, where crypto has long served as a tool to circumvent international sanctions.
Why Nobitex Matters to Iran’s Crypto Economy
Nobitex is not just another exchange it is central to Iran’s on-chain economy. With over $11 billion in total inflows, Nobitex handles more volume than Iran’s next ten largest exchanges combined.
It serves as a primary gateway for Iranians locked out of global finance and has reportedly been linked to sanctioned wallets, including those tied to:
- Ransomware operators affiliated with the IRGC
- Pro-Hamas media outlets like Gaza Now
- Sanctioned Russian platforms like Garantex and Bitpapa
Chainalysis’s report indicates that Nobitex has long operated in gray regulatory areas, enabling illicit cross-border financial activity.
Hack Linked to Regional Conflict
The timing of the hack coincided with recent Israeli airstrikes inside Iran, part of an intensifying military and cyber standoff between the two nations. Inflammatory wallet labels and public threats by the attackers suggest the hack was both symbolic and strategic.
Gonjeshke Darande issued a chilling ultimatum: either users withdraw funds, or they would publish internal source code and infrastructure blueprints.
Nobitex Responds: Cold Wallets Safe, Losses Covered
In an official statement, Nobitex reassured users that:
- All user funds in cold storage remain secure
- All hot wallets have been emptied and decommissioned
- Losses will be fully covered from the platform’s reserve fund
- Security has been enhanced with migration to new offline wallets
“We are strengthening all areas of our infrastructure and encourage users to stay cautious,” the Nobitex team stated.
Crypto Becomes a Frontline in Geopolitical Conflict
The Nobitex hack signals a new era where cyberattacks on decentralized infrastructure are being weaponized in geopolitical conflicts. With Iran tightening control over crypto platforms and adversarial actors turning to irreversible asset destruction, the stakes for DeFi and centralized exchanges alike have never been higher.
This incident also raises urgent questions about cyber resilience, compliance, and the political risks of blockchain-based finance in authoritarian regimes and conflict zones.
