Iran's Central Bank Imposes Curfew on Crypto Exchanges After $100 Million Hack

Iran's central bank has implemented strict operating hours for domestic cryptocurrency exchanges following a significant cyberattack on Nobitex, the country's largest digital asset platform. The attack, which resulted in the loss of approximately $100 million, was reportedly carried out by a pro-Israel hacker group known as Gonjeshke Darande. The hackers infiltrated Nobitex's systems and drained its hot wallets of various cryptocurrencies, including Bitcoin, Ethereum, Dogecoin, XRP, and Solana. In an unusual move, the stolen funds were sent to burner wallets—addresses with no private key access—effectively removing the assets from circulation. This action suggests that the attack was politically motivated rather than financially driven, aimed at depriving the Iranian regime of access to funds.

The new curfew limits exchanges to functioning only between 10 a.m. and 8 p.m. local time. This measure is likely aimed at containing the potential damage of future incidents, as incidents are easier to triage if they’re not happening in the middle of the night. The attack on Nobitex occurred early Wednesday morning, during off-peak hours. The Iranian government may also be using the curfew to tighten control over citizen transactions, especially in a time of high geopolitical tension and the risk of capital flight. This is not the first time Iran has restricted crypto activity—last December, authorities shut down all exchanges temporarily to stabilize the rial.

Nobitex, which facilitates more than $11 billion in inflows, has acknowledged the breach. In a statement, the platform said it has severed all external access to its servers and moved remaining funds from hot wallets to secure cold storage. Although Nobitex claims the situation is under control, user access remains suspended. The exchange confirmed that its Reserve Fund will cover all losses incurred in the breach. However, it warned that ongoing internet disruptions and additional security protocols may delay the restoration of full services.

As a key player in Iran’s crypto space, Nobitex’s compromise could have ripple effects throughout the region. The platform plays a crucial role in facilitating global crypto access for Iranian users—many of whom are otherwise cut off from international financial systems. The Nobitex attack highlights the intersection of geopolitical conflict and cryptocurrency infrastructure. Iran's heavily sanctioned crypto ecosystem relies on platforms like Nobitex to access global crypto markets, making them strategic targets during heightened geopolitical tensions. The incident underscores how digital assets have become both tools of financial sovereignty and targets in international disputes.

Iran's evolving cryptocurrency strategy has been marked by a shift from regulation to restriction. Earlier this year, the government aimed to use digital currencies to boost youth employment, counter U.S. sanctions, and align Iran with the global economy. Additionally, Iran's Central Bank has been developing its own national cryptocurrency called the "Nat'l" or "crypto-rial," built on a private blockchain for small cashless transactions. However, the current security crisis may complicate these broader digitization efforts as authorities balance innovation with cybersecurity concerns in an increasingly hostile geopolitical environment.