• Nobitex hacked for $81M by Israel-linked group Predatory Sparrow.

  • Attack used vanity addresses to drain Tron, EVM wallets.

  • Nobitex vows to compensate users via insurance fund.

  • Hack tied to Israel-Iran tensions, targeting sanctions evasion.

  • Stolen funds unmoved, signaling political motive.

Nobitex Hacked: Massive Crypto Theft Shakes Iran

Iran’s largest cryptocurrency exchange, Nobitex, suffered a security breach, losing over $81 million in digital assets. The attack targeted hot wallets across Tron and Ethereum Virtual Machine (EVM)-compatible blockchains. Unauthorized access drained funds, including Bitcoin, Dogecoin, and Tether’s USDT.

The breach occurred on June 18, 2025, with attackers exploiting vulnerabilities in access controls. Nobitex confirmed the incident, stating that cold storage funds remain secure. The exchange suspended its website and app for a full investigation.

Israel-Linked Hackers Claim Responsibility

The pro-Israel hacking group Gonjeshke Darande, or Predatory Sparrow, claimed responsibility for the attack. They accused Nobitex of facilitating Iran’s sanctions evasion and financing terrorism. The group used vanity addresses, including one labeled “TKFu ckiRGCTerroristsNoBiTEXy2r7mNX,” to transfer stolen funds.

The hackers threatened to release Nobitex’s source code and internal data within 24 hours. They warned users to withdraw assets, claiming any remaining funds could be at risk. The attack follows a similar cyberstrike on Iran’s state-owned Bank Sepah, also attributed to the group.

The stolen funds, valued at over $81 million, remain unmoved in burner addresses. Security experts noted the use of politically charged wallet names, suggesting the hack was a deliberate political statement rather than a financial theft.

Nobitex Vows to Compensate Users

Nobitex accepted full responsibility for the breach and pledged to cover losses through its insurance fund and reserves. The exchange emphasized that only a portion of hot wallet assets was affected. User funds in cold storage are reportedly safe.

The platform is working with Iran’s Cyber Police (FATA) to recover the stolen assets. Nobitex has not disclosed specific details about the attack’s scope or the assets lost. The investigation continues as the exchange aims to restore operations.

The hack adds to a string of crypto breaches in 2025, with over $2.1 billion stolen industry-wide, according to blockchain security firm CertiK. Wallet compromises and key mismanagement remain leading causes of such losses. CertiK Report on 2025 Crypto Hacks

Geopolitical Tensions Fuel Cyber Warfare

The attack coincides with heightened Israel-Iran tensions, marked by missile strikes and cyberattacks. On June 13, Israel launched airstrikes on Iranian targets, prompting retaliatory missile fire. The Nobitex hack reflects a broader digital conflict targeting Iran’s financial infrastructure

Gonjeshke Darande has a history of attacking Iranian systems, including steel mills and gas stations. The group’s actions align with escalating regional conflicts, raising concerns about the security of crypto exchanges in sanctioned nations. The breach has sparked discussions about the role of cryptocurrency in bypassing sanctions. Nobitex, with over 7 million users, has been linked to Iran’s efforts to acquire foreign currencies. The hack could disrupt these operations, dealing a strategic blow to the regime.

Security Flaws Exposed in Hack

The exploit stemmed from failures in Nobitex’s access controls, allowing hackers to infiltrate internal systems. Vanity addresses used in the attack were designed to send a message, with funds transferred to wallets lacking private keys. This suggests the hackers prioritized disruption over profit.

The breach reduced Nobitex’s wallet holdings by over 90%, from $1.8 billion to $96 million, according to blockchain analytics platform Arkham. The exchange faces a credibility crisis as users await updates on asset safety and platform restoration.

Nobitex’s response includes a commitment to enhance security measures. The exchange urged users to remain vigilant amid ongoing investigations. The incident underscores the vulnerabilities of hot wallets and the growing threat of politically motivated cyberattacks in the crypto space.

#Nobitex #CryptoHack #IranIsraelConflict #PredatorySparrow #CyberWarfare