Iranian Crypto Exchange Nobitex Hacked for Nearly $82M by Suspected Israeli Group
Iranian cryptocurrency exchange Nobitex suffered a significant cyberattack resulting in the theft of approximately $82 million. The responsible party, a hacking activist group known as Gonjeshke Darande, claimed responsibility via an X post, linking the attack to their previous cyberattack on Iran’s Bank Sepah. They asserted that Nobitex facilitates Iran’s evasion of international sanctions through crypto-based payments, labeling it a “core part of the regime’s terror financing network.”
The group’s X post warned of an impending release of Nobitex’s internal data and source code, further threatening that any remaining assets on the exchange would be at risk. On-chain analyst ZachXBT quickly identified suspicious outflows totaling over $81.7 million, subsequently updated to over $82 million, across various cryptocurrencies including Tron’s TRX, Bitcoin (BTC), Dogecoin (DOGE), and other tokens. These funds were traced to wallets employing provocative vanity addresses such as “TKFuckiRGCTerroristsNoBiTEXy2r7mNX,” “0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead,” “1FuckiRGCTerroristsNoBiTEXXXaAovLX,” and “DFuckiRGCTerroristsNoBiTEXXXWLW65t.”
Nobitex, Iran’s largest cryptocurrency exchange, acknowledged the attack in their own X post, but notably avoided confirming the amount of stolen funds. The exact method of the attack remains unclear. The incident is part of a larger pattern of escalating cyber and physical attacks between Iran and Israel. Gonjeshke Darande, widely believed to have connections to Israeli intelligence, has previously claimed responsibility for attacks targeting Iranian infrastructure, including steel factories and gas stations.
The consequences for Nobitex extend beyond the substantial financial losses. The threat of a source code leak presents a serious credibility crisis, potentially jeopardizing the remaining funds of users who have not yet withdrawn their assets. The situation underscores the growing risks associated with cryptocurrency exchanges operating in politically volatile regions and highlights the vulnerability of even major players to sophisticated cyberattacks. The ongoing situation warrants close monitoring as the full extent of the damage and the implications for the Iranian cryptocurrency market unfold.
