Iran Imposes Curfew on Crypto Exchanges After $100 Million Hack

Iran’s central bank has implemented strict operating hours for domestic cryptocurrency exchanges following a significant cyberattack on Nobitex, the country’s largest digital asset platform. The attack, which resulted in the loss of approximately $100 million, was reportedly carried out by a pro-Israel hacker group known as Gonjeshke Darande. The hackers infiltrated Nobitex’s systems and drained its hot wallets of major cryptocurrencies, including Bitcoin, Ethereum, Dogecoin, XRP, and Solana. In a surprising move, the stolen funds were sent to burner wallets—addresses with no private key access—effectively removing the assets from circulation. This action suggests that the attack was politically motivated rather than financially driven, aimed at depriving the Iranian regime of access to funds.

The new curfew limits exchanges to functioning only between 10 a.m. and 8 p.m. local time. This move is likely aimed at containing the potential damage of future incidents, as incidents are easier to triage if they’re not happening in the middle of the night. The Nobitex hack occurred early Wednesday morning, during off-peak hours. The Iranian government may also be using the curfew to tighten control over citizen transactions, especially in a time of high geopolitical tension and the risk of capital flight. This is not the first time Iran has restricted crypto activity—last December, authorities shut down all exchanges temporarily to stabilize the rial.

Nobitex, which facilitates more than $11 billion in inflows—far surpassing any other Iranian exchange—has acknowledged the breach. In a statement, the platform said it has severed all external access to its servers and moved remaining funds from hot wallets to secure cold storage. Although Nobitex claims the situation is under control, user access remains suspended. The exchange confirmed that its Reserve Fund will cover all losses incurred in the breach. However, it warned that ongoing internet disruptions and additional security protocols may delay the restoration of full services.

As a key player in Iran’s crypto space, Nobitex’s compromise could have ripple effects throughout the region. The exchange highlighted its role in facilitating global crypto access for Iranian users—many of whom are otherwise cut off from international financial systems. The Nobitex attack and the subsequent curfew represent a significant shift in Iran's cryptocurrency policies. Earlier this year, Iranian Finance Minister Abdolnaser Hemmati announced plans to regulate cryptocurrencies rather than impose restrictions, emphasizing the potential benefits of digital currencies in boosting youth employment and countering U.S. sanctions. However, the current security crisis may complicate these broader digitization efforts as authorities balance innovation with cybersecurity concerns in an increasingly hostile geopolitical environment.

Iran's Central Bank has been developing its own national cryptocurrency called the "Nat'l" or "crypto-rial," built on a private blockchain for small cashless transactions. This centralized digital currency, which cannot be mined or traded like traditional cryptocurrencies, was expected to enter pilot testing following approval from the Money and Credit Council. The recent security crisis may delay these plans as authorities focus on enhancing the security of existing cryptocurrency infrastructure. The incident highlights the intersection of geopolitical conflict and cryptocurrency infrastructure, demonstrating how digital assets have become both tools of financial sovereignty and targets in international disputes. As Iran continues to navigate the complexities of cryptocurrency regulation and security, the recent hack serves as a stark reminder of the vulnerabilities within the digital asset ecosystem. The curfew on crypto exchanges is a temporary measure aimed at curbing potential risks while authorities work to strengthen the security framework for cryptocurrency transactions in the region.