Iranian crypto exchange Nobitex suffers $81M exploit, pro-Israel hacker group takes credit

Iran’s largest crypto exchange, Nobitex, has confirmed a security breach that resulted in the loss of a significant amount of digital assets, as tensions between Iran and Israel spill over into cyberspace.

On June 18, Nobitex posted a statement on X acknowledging the incident, stating that unauthorized access had been detected in its hot wallet and reporting infrastructure earlier that morning. The platform promised to use its insurance fund and internal reserves to fully compensate impacted clients and reassured users that cold-stored funds would remain safe.

While the exchange hasn’t disclosed information regarding the amount lost,  blockchain investigator ZachXBT has provided an update on Telegram. ZachXBT flagged multiple suspicious outflows involving Bitcoin (BTC), Dogecoin (DOGE), Tron (TRX), and various EVM-compatible chains, estimating the loss to be around $81.7 million.

Vanity addresses used by the attacker included phrases like “FuckIRGCTerroristsNoBiTEX,” raising immediate suspicions of a politically motivated operation. 

A pro-Israel hacker group calling itself Gonjeshke Darande, or Predatory Sparrow, has already claimed responsibility for the exploit in a separate X post. The group accused Nobitex of facilitating Iran’s sanctions evasion and financing terrorism and warned that it would release the platform’s internal data and source code within 24 hours.

The hack follows a dramatic spike in Israeli-Iranian hostilities this month. Iranian missile fire retaliated against Israeli airstrikes that targeted military and nuclear facilities throughout Tehran on June 13. Days later, the Nobitex cyberattack seems to reflect those battlefield dynamics, pointing to a well-coordinated digital front in the ongoing war.

In the past, Gonjeshke Darande has attacked Iranian institutions like fuel distribution networks and Bank Sepah, often coordinating its attacks with geopolitical events.  Although Israel has never formally acknowledged ties, analysts believe the group is supported by Israeli cyber units such as Unit 8200.

Nobitex, a major player in Iran’s cryptocurrency market, has come under fire in recent years for allegedly facilitating transactions with sanctioned entities. Nearly $8 billion in transactions between Nobitex and Binance occurred between 2018 and 2022, according to a report by Reuters.

While the full extent of the damage is still being investigated, the timing and messaging of the attack point to a larger attempt to interrupt Iran’s digital financial infrastructure amid rising regional tensions.