Iran’s largest crypto exchange, Nobitex, has confirmed a security breach that resulted in the loss of a significant amount of digital assets, as tensions between Iran and Israel spill over into cyberspace. On June 18, Nobitex posted a statement on X acknowledging the incident, stating that unauthorized access had been detected in its hot wallet and reporting infrastructure earlier that morning. The platform promised to use its insurance fund and internal reserves to fully compensate impacted clients and reassured users that cold-stored funds would remain safe. اطلاعیه در خصوص حادثه امنیتی صبح امروز ۲۸ خرداد، تیم فنی ما نشانه‌هایی از دسترسی غیرمجاز به بخشی از زیرساخت‌های اطلاع‌رسانی و کیف پول گرم را شناسایی کرده است. بلافاصله پس از تشخیص، تمام دسترسی‌ها متوقف شد و تیم‌های امنیتی داخلی ما در حال بررسی دقیق ابعاد این حادثه هستند. یادآور… — Nobitex | نوبیتکس (@nobitexmarket) June 18, 2025 While the exchange hasn’t disclosed information regarding the amount lost, blockchain investigator ZachXBT has provided an update on Telegram. ZachXBT flagged multiple suspicious outflows involving Bitcoin ( BTC ), Dogecoin ( DOGE ), Tron ( TRX ), and various EVM-compatible chains, estimating the loss to be around $81.7 million. Vanity addresses used by the attacker included phrases like “FuckIRGCTerroristsNoBiTEX,” raising immediate suspicions of a politically motivated operation. You might also like: Is the crypto bull run still possible after Israel bombed Iran? A pro-Israel hacker group calling itself Gonjeshke Darande, or Predatory Sparrow, has already claimed responsibility for the exploit in a separate X post. The group accused Nobitex of facilitating Iran’s sanctions evasion and financing terrorism and warned that it would release the platform’s internal data and source code within 24 hours. After the IRGC’s “Bank Sepah” comes the turn of Nobitex WARNING! In 24 hours, we will release Nobitex's source code and internal information from their internal network. Any assets that remain there after that point will be at risk! The Nobitex exchange is at the heart of the… pic.twitter.com/GFyBCPCFIE — Gonjeshke Darande (@GonjeshkeDarand) June 18, 2025 The hack follows a dramatic spike in Israeli-Iranian hostilities this month. Iranian missile fire retaliated against Israeli airstrikes that targeted military and nuclear facilities throughout Tehran on June 13. Days later, the Nobitex cyberattack seems to reflect those battlefield dynamics, pointing to a well-coordinated digital front in the ongoing war. In the past, Gonjeshke Darande has attacked Iranian institutions like fuel distribution networks and Bank Sepah, often coordinating its attacks with geopolitical events. Although Israel has never formally acknowledged ties, analysts believe the group is supported by Israeli cyber units such as Unit 8200. Nobitex, a major player in Iran’s cryptocurrency market, has come under fire in recent years for allegedly facilitating transactions with sanctioned entities. Nearly $8 billion in transactions between Nobitex and Binance occurred between 2018 and 2022, according to a report by Reuters. While the full extent of the damage is still being investigated, the timing and messaging of the attack point to a larger attempt to interrupt Iran’s digital financial infrastructure amid rising regional tensions. Read more: Meta Pool exploited for $133k after attacker mints $27m worth of tokens
