Nobitex

Iran has ordered a curfew on domestic cryptocurrency exchanges after a politically motivated attack on the country’s largest trading platform, Nobitex.The funds, which included assets like Bitcoin, Ethereum, Dogecoin, Ripple, Solana, Tron, and Ton, were drained from Nobitex’s hot wallets and subsequently burned, making them permanently inaccessible.
In response to the incident, the Central Bank of Iran restricted the operating hours of all local crypto exchanges, limiting them to between 10 am and 8 pm.
“This operational curfew could signal increasing pressure on exchanges operating within Iran, as the regime attempts to manage systemic risk in a market that plays an outsized role in navigating around global sanctions,” the analytics firm wrote in a recent report.
Pro-Israel hacker group Gonjeshke Darande, also known as Predatory Sparrow, has claimed responsibility and stated that the operation was intended to disrupt Iran’s sanctioned financial infrastructure. The stolen assets were sent to burner wallets without private key access, indicating a deliberate act of destruction.Chainalysis’s findings confirmed that none of the funds were sent to mixers or exchanges, and a significant portion was transferred to addresses labeled with anti-IRGC slogans.Some were sent to blockchain burn addresses, including Ethereum’s “0x…dead” wallet, while a portion of Bitcoin was directed to a provably unspendable address with an invalid checksum.

Nobitex is widely considered a central pillar of Iran’s crypto economy. According to Chainalysis, it has processed over $11 billion in total inflows, more than the combined inflows of Iran’s ten next-largest crypto exchanges.

It acts as the backbone for the majority of on-chain activity in the country and serves as a gateway to global markets for users cut off from traditional finance due to international sanctions.

Beyond its domestic role, Chainalysis linked Nobitex to wallets associated with a range of sanctioned and illicit actors. These include ransomware operators affiliated with Iran’s Islamic Revolutionary Guard Corps, pro-Hamas media channels such as Gaza Now, and sanctioned Russian crypto exchanges including Garantex and Bitpapa.
The Nobitex hack followed a series of Israeli airstrikes inside Iran, part of ongoing military and cyber tensions between the two countries. The attackers published inflammatory wallet labels and threatened to release internal source code and infrastructure data unless Nobitex users withdrew funds.
In its official response, Nobitex said user assets remain secure in cold storage and that all hot wallets have been emptied. It also confirmed that its reserve fund would fully cover the losses and that it has taken steps to bolster platform security, including migrating funds to new offline#altcoins #BinanceSquareFamily ##BTC☀️ #TON #Nobitex

Iran’s largest crypto exchange, Nobitex, was hit by a major breach on June 18, resulting in the theft of approximately $48 million, primarily in $USDT via the Tron network.

The pro-Israel hacktivist group Gonjeshke Darande—aka "Predatory Sparrow"—claimed responsibility, saying the attack targeted Nobitex’s hot wallets and threatening to release the exchange’s source code and internal documents within 24 hours.

Blockchain investigator ZachXBT spotted suspicious outflows from wallets with vanity addresses containing anti-Iran messaging, totaling roughly $48.65 million.
In response, Nobitex confirmed the breach, stating that only a portion of its hot wallet infrastructure was affected, while cold wallets remain secure. The exchange has halted operations and promised full compensation via its insurance fund.

#IsraelIranConflict #Cyberattack #Nobitex

Nobitex hacked for $81M by Israel-linked group Predatory Sparrow.
Attack used vanity addresses to drain Tron, EVM wallets.Nobitex vows to compensate users via insurance fund.Hack tied to Israel-Iran tensions, targeting sanctions evasion.Stolen funds unmoved, signaling political motive.
Nobitex Hacked: Massive Crypto Theft Shakes Iran
Iran’s largest cryptocurrency exchange, Nobitex, suffered a security breach, losing over $81 million in digital assets. The attack targeted hot wallets across Tron and Ethereum Virtual Machine (EVM)-compatible blockchains. Unauthorized access drained funds, including Bitcoin, Dogecoin, and Tether’s USDT.
The breach occurred on June 18, 2025, with attackers exploiting vulnerabilities in access controls. Nobitex confirmed the incident, stating that cold storage funds remain secure. The exchange suspended its website and app for a full investigation.
Israel-Linked Hackers Claim Responsibility
The pro-Israel hacking group Gonjeshke Darande, or Predatory Sparrow, claimed responsibility for the attack. They accused Nobitex of facilitating Iran’s sanctions evasion and financing terrorism. The group used vanity addresses, including one labeled “TKFu ckiRGCTerroristsNoBiTEXy2r7mNX,” to transfer stolen funds.
The hackers threatened to release Nobitex’s source code and internal data within 24 hours. They warned users to withdraw assets, claiming any remaining funds could be at risk. The attack follows a similar cyberstrike on Iran’s state-owned Bank Sepah, also attributed to the group.
The stolen funds, valued at over $81 million, remain unmoved in burner addresses. Security experts noted the use of politically charged wallet names, suggesting the hack was a deliberate political statement rather than a financial theft.
Nobitex Vows to Compensate Users
Nobitex accepted full responsibility for the breach and pledged to cover losses through its insurance fund and reserves. The exchange emphasized that only a portion of hot wallet assets was affected. User funds in cold storage are reportedly safe.
The platform is working with Iran’s Cyber Police (FATA) to recover the stolen assets. Nobitex has not disclosed specific details about the attack’s scope or the assets lost. The investigation continues as the exchange aims to restore operations.
The hack adds to a string of crypto breaches in 2025, with over $2.1 billion stolen industry-wide, according to blockchain security firm CertiK. Wallet compromises and key mismanagement remain leading causes of such losses. CertiK Report on 2025 Crypto Hacks
Geopolitical Tensions Fuel Cyber Warfare
The attack coincides with heightened Israel-Iran tensions, marked by missile strikes and cyberattacks. On June 13, Israel launched airstrikes on Iranian targets, prompting retaliatory missile fire. The Nobitex hack reflects a broader digital conflict targeting Iran’s financial infrastructure

Gonjeshke Darande has a history of attacking Iranian systems, including steel mills and gas stations. The group’s actions align with escalating regional conflicts, raising concerns about the security of crypto exchanges in sanctioned nations. The breach has sparked discussions about the role of cryptocurrency in bypassing sanctions. Nobitex, with over 7 million users, has been linked to Iran’s efforts to acquire foreign currencies. The hack could disrupt these operations, dealing a strategic blow to the regime.
Security Flaws Exposed in Hack
The exploit stemmed from failures in Nobitex’s access controls, allowing hackers to infiltrate internal systems. Vanity addresses used in the attack were designed to send a message, with funds transferred to wallets lacking private keys. This suggests the hackers prioritized disruption over profit.
The breach reduced Nobitex’s wallet holdings by over 90%, from $1.8 billion to $96 million, according to blockchain analytics platform Arkham. The exchange faces a credibility crisis as users await updates on asset safety and platform restoration.
Nobitex’s response includes a commitment to enhance security measures. The exchange urged users to remain vigilant amid ongoing investigations. The incident underscores the vulnerabilities of hot wallets and the growing threat of politically motivated cyberattacks in the crypto space.
#Nobitex #CryptoHack #IranIsraelConflict #PredatorySparrow #CyberWarfare

Iran’s biggest crypto exchange has been hit hard.
But this wasn’t your usual exploit…
A pro-Israel hacker group called Predatory Sparrow claimed responsibility — saying it was political, not for profit.

And get this:
👉 A chunk of #Bitcoin was burned forever
Sent to wallets that nobody can access. Gone for good.
They’re now threatening to leak Nobitex’s full source code & internal data in the next 24 hours.
Remaining user funds? Still at high risk.
This attack follows another cyberstrike on Iran’s banks.
Markets aren’t ready for this kind of geopolitical cyberwarfare.
⚠️ If you use Nobitex — act fast.
What’s your take on this?
Could these types of hacks become the new normal?
Drop your thoughts 👇
Retweet to alert the crypto fam

#Nobitex #NobitexHack #GENIUSActPass #MyTradingStyle $BTC $ETH $XRP

Iran’s biggest #crypto exchange #Nobitex has been hacked, with over $80 million drained from its hot wallets.
Blockchain detective ZachXBT tracked the funds across several chains like #Bitcoin #Tron #Dogecoin and Ethereum.
The funds were moved to suspicious vanity wallet addresses like:
1️⃣ TKFuckiRGCTerroristsNoBiTEXy2r7mNX
2️⃣ 0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead
3️⃣ 1FuckiRGCTerroristsNoBiTEXXXaAovLX
4️⃣ DFuckiRGCTerroristsNoBiTEXXXWLW65t
A hacker group called Predatory Sparrow (linked to Israel) claimed responsibility. They say Nobitex is helping Iran bypass sanctions and promised to leak private data and source code within 24 hours.
Stolen assets include:
▪️ Bitcoin
▪️ Ethereum
▪️ USDT
▪️ $TRX
▪️ $DOGE
▪️ $BNB Chain tokens
Nobitex confirmed the attack:
“Only hot wallets were affected. Cold storage is safe. Users will be fully compensated.”
⚠️ This is one of the biggest crypto hacks of 2025 and could increase tensions between Iran and Israel.
What to do:
If you’ve used Nobitex, withdraw your funds (if possible) and stay alert for official updates.

#cryptohacks