NoBITEX

Iran has ordered a curfew on domestic cryptocurrency exchanges after a politically motivated attack on the country’s largest trading platform, Nobitex.The funds, which included assets like Bitcoin, Ethereum, Dogecoin, Ripple, Solana, Tron, and Ton, were drained from Nobitex’s hot wallets and subsequently burned, making them permanently inaccessible.
In response to the incident, the Central Bank of Iran restricted the operating hours of all local crypto exchanges, limiting them to between 10 am and 8 pm.
“This operational curfew could signal increasing pressure on exchanges operating within Iran, as the regime attempts to manage systemic risk in a market that plays an outsized role in navigating around global sanctions,” the analytics firm wrote in a recent report.
Pro-Israel hacker group Gonjeshke Darande, also known as Predatory Sparrow, has claimed responsibility and stated that the operation was intended to disrupt Iran’s sanctioned financial infrastructure. The stolen assets were sent to burner wallets without private key access, indicating a deliberate act of destruction.Chainalysis’s findings confirmed that none of the funds were sent to mixers or exchanges, and a significant portion was transferred to addresses labeled with anti-IRGC slogans.Some were sent to blockchain burn addresses, including Ethereum’s “0x…dead” wallet, while a portion of Bitcoin was directed to a provably unspendable address with an invalid checksum.

Nobitex is widely considered a central pillar of Iran’s crypto economy. According to Chainalysis, it has processed over $11 billion in total inflows, more than the combined inflows of Iran’s ten next-largest crypto exchanges.

It acts as the backbone for the majority of on-chain activity in the country and serves as a gateway to global markets for users cut off from traditional finance due to international sanctions.

Beyond its domestic role, Chainalysis linked Nobitex to wallets associated with a range of sanctioned and illicit actors. These include ransomware operators affiliated with Iran’s Islamic Revolutionary Guard Corps, pro-Hamas media channels such as Gaza Now, and sanctioned Russian crypto exchanges including Garantex and Bitpapa.
The Nobitex hack followed a series of Israeli airstrikes inside Iran, part of ongoing military and cyber tensions between the two countries. The attackers published inflammatory wallet labels and threatened to release internal source code and infrastructure data unless Nobitex users withdrew funds.
In its official response, Nobitex said user assets remain secure in cold storage and that all hot wallets have been emptied. It also confirmed that its reserve fund would fully cover the losses and that it has taken steps to bolster platform security, including migrating funds to new offline#altcoins #BinanceSquareFamily ##BTC☀️ #TON #Nobitex

18 червня 2025 року хакерська група Gonjeshke Darande, відома як Predatory Sparrow, оголосила про злам найбільшої іранської криптобіржі Nobitex, викравши активи на $81,7 млн. Наступного дня хакери виконали свою погрозу, опублікувавши вихідний код платформи та внутрішні дані. Це стало однією з наймасштабніших кібератак в історії Ірану, спрямованих проти фінансової інфраструктури країни.
Група, яку пов’язують з ізраїльською розвідкою, звинуватила Nobitex у сприянні обходу санкцій та фінансуванні тероризму через криптовалютні операції. Хакери використали провокаційні адреси-гаманці, зокрема з написами на кшталт «Fack IRGC Terrorists», для виведення коштів, частину яких, за даними Elliptic, було спалено, щоб надіслати політичний меседж.
Nobitex підтвердила атаку, заявивши, що холодні гаманці залишилися недоторканими, і пообіцяла компенсувати збитки через страховий фонд. Однак витік коду загрожує довірі до платформи та безпеці користувачів. Цей інцидент підкреслює вразливість криптобірж у кібервійнах.
Стежте за новинами криптосвіту та підпишіться на #MiningUpdates , щоб не пропустити важливі оновлення!
#CryptoHack #Nobitex #cyberattack #BlockchainSecurity #IranCrypto #CryptoNews

Nobitex hacked for $81M by Israel-linked group Predatory Sparrow.
Attack used vanity addresses to drain Tron, EVM wallets.Nobitex vows to compensate users via insurance fund.Hack tied to Israel-Iran tensions, targeting sanctions evasion.Stolen funds unmoved, signaling political motive.
Nobitex Hacked: Massive Crypto Theft Shakes Iran
Iran’s largest cryptocurrency exchange, Nobitex, suffered a security breach, losing over $81 million in digital assets. The attack targeted hot wallets across Tron and Ethereum Virtual Machine (EVM)-compatible blockchains. Unauthorized access drained funds, including Bitcoin, Dogecoin, and Tether’s USDT.
The breach occurred on June 18, 2025, with attackers exploiting vulnerabilities in access controls. Nobitex confirmed the incident, stating that cold storage funds remain secure. The exchange suspended its website and app for a full investigation.
Israel-Linked Hackers Claim Responsibility
The pro-Israel hacking group Gonjeshke Darande, or Predatory Sparrow, claimed responsibility for the attack. They accused Nobitex of facilitating Iran’s sanctions evasion and financing terrorism. The group used vanity addresses, including one labeled “TKFu ckiRGCTerroristsNoBiTEXy2r7mNX,” to transfer stolen funds.
The hackers threatened to release Nobitex’s source code and internal data within 24 hours. They warned users to withdraw assets, claiming any remaining funds could be at risk. The attack follows a similar cyberstrike on Iran’s state-owned Bank Sepah, also attributed to the group.
The stolen funds, valued at over $81 million, remain unmoved in burner addresses. Security experts noted the use of politically charged wallet names, suggesting the hack was a deliberate political statement rather than a financial theft.
Nobitex Vows to Compensate Users
Nobitex accepted full responsibility for the breach and pledged to cover losses through its insurance fund and reserves. The exchange emphasized that only a portion of hot wallet assets was affected. User funds in cold storage are reportedly safe.
The platform is working with Iran’s Cyber Police (FATA) to recover the stolen assets. Nobitex has not disclosed specific details about the attack’s scope or the assets lost. The investigation continues as the exchange aims to restore operations.
The hack adds to a string of crypto breaches in 2025, with over $2.1 billion stolen industry-wide, according to blockchain security firm CertiK. Wallet compromises and key mismanagement remain leading causes of such losses. CertiK Report on 2025 Crypto Hacks
Geopolitical Tensions Fuel Cyber Warfare
The attack coincides with heightened Israel-Iran tensions, marked by missile strikes and cyberattacks. On June 13, Israel launched airstrikes on Iranian targets, prompting retaliatory missile fire. The Nobitex hack reflects a broader digital conflict targeting Iran’s financial infrastructure

Gonjeshke Darande has a history of attacking Iranian systems, including steel mills and gas stations. The group’s actions align with escalating regional conflicts, raising concerns about the security of crypto exchanges in sanctioned nations. The breach has sparked discussions about the role of cryptocurrency in bypassing sanctions. Nobitex, with over 7 million users, has been linked to Iran’s efforts to acquire foreign currencies. The hack could disrupt these operations, dealing a strategic blow to the regime.
Security Flaws Exposed in Hack
The exploit stemmed from failures in Nobitex’s access controls, allowing hackers to infiltrate internal systems. Vanity addresses used in the attack were designed to send a message, with funds transferred to wallets lacking private keys. This suggests the hackers prioritized disruption over profit.
The breach reduced Nobitex’s wallet holdings by over 90%, from $1.8 billion to $96 million, according to blockchain analytics platform Arkham. The exchange faces a credibility crisis as users await updates on asset safety and platform restoration.
Nobitex’s response includes a commitment to enhance security measures. The exchange urged users to remain vigilant amid ongoing investigations. The incident underscores the vulnerabilities of hot wallets and the growing threat of politically motivated cyberattacks in the crypto space.
#Nobitex #CryptoHack #IranIsraelConflict #PredatorySparrow #CyberWarfare