Iran Crypto Exchange Nobitex Loses $100 Million in Cyberattack

Iran-based Nobitex, a prominent crypto exchange, has confirmed a significant cyberattack resulting in the loss of nearly $100 million. The breach, which occurred on July 18, has sent shockwaves through the local crypto community and prompted a government-imposed curfew on crypto trading platforms nationwide. The attack was claimed by an Israel-linked hacking group known as Gonjeshke Darande, which translates to “Predatory Sparrow.” The group alleged that Nobitex supported Iran’s military activities and assisted users in bypassing international sanctions.

Initial reports estimated the losses at around $48 million, but Nobitex’s latest disclosure revealed that the figure is more than double the initial estimate. Following the breach, the attackers claimed to have sent the stolen crypto to several wallet addresses designed to destroy the funds. These addresses included slurs and references targeting Iran’s Islamic Revolutionary Guard Corps (IRGC), indicating that the goal was more about symbolism than theft. Tom Robinson, co-founder of a blockchain analytics firm, explained that the hackers sent the stolen funds to crypto addresses for which they did not have the private keys, effectively burning all the money to send a message. Nobitex confirmed that the assets were moved to wallets with arbitrary, non-standard addresses, making recovery almost impossible. The firm stated that the stolen assets were transferred to a wallet with a non-standard address composed of arbitrary characters, an approach that deviates significantly from conventional crypto exchange hacks. These wallets were used to burn and destroy user assets, clearly indicating that the intention behind this attack was to harm the peace of mind and assets of citizens under false pretenses. Adding to the turmoil, Gonjeshke Darande claimed to have leaked portions of Nobitex’s source code on a social media platform.

Despite the scale of the loss, Nobitex has assured its users that their funds remain safe thanks to its internal reserve fund. The crypto-trading platform emphasized that user assets are covered by the Nobitex Reserve Fund, and no user funds will be lost. Meanwhile, Nobitex decried the attack, emphasizing that it operates independently and has been financially isolated for months due to banking restrictions. The firm noted that for its 11 million users, it is evident that Nobitex has always operated as an independent private business. This is further supported by the fact that, for the past eight months, its banking gateway has been blocked without any means to resolve the issue—an unfortunate situation beyond its control.

In response to the breach, Iran’s central bank imposed a nationwide curfew on crypto exchange operations. As a result, local platforms, including Nobitex, are now restricted to operating between 10 A.M. and 8 P.M. The government also triggered temporary internet disruptions, affecting access to Nobitex and slowing user support response times. Nobitex stated that the internet disruptions and blocked access to external servers may result in a longer-than-usual timeline for restoring user access to the platform.