Iranian Exchange Nobitex Loses $100M in Cyberattack, Funds Inaccessible

On Wednesday, the Iranian cryptocurrency exchange Nobitex fell victim to a cyberattack. According to Nobitex's fourth public statement, the estimated total value of the stolen assets is approximately 100 million dollars. However, the situation has been brought under control, and user assets are protected by a reserve fund, ensuring that users will not incur any financial losses.

A hacker group associated with Israel, known as Gonjeshke Darande, which translates to "predatory sparrows" in Persian, claimed responsibility for the theft of Nobitex's assets. The day before, the group also claimed to have destroyed data from the Iranian state-owned bank Sepah.

Consulting firm Elliptic reported that the hackers appear to have rendered the stolen funds from Nobitex inaccessible by storing them in vanity addresses that lack corresponding keys. This makes the funds impossible to access with current computing technology.

Elliptic's co-founder further explained that creating a matching cryptographic key pair for a vanity address would require tens of billions of years with current computational capabilities.

The predatory sparrows group also stated that they have targeted Nobitex and will release its source code and additional internal information. This action raises speculation, as the stolen funds have not been utilized by the hackers, suggesting that the underlying motive may be political rather than financial.

The predatory sparrows group has long been suspected of having ties to Israel, although this has not been officially confirmed. Elliptic noted that while there is no direct evidence, this hacking incident could be related to the recent escalation of tensions between Israel and Iran.

A senior intelligence officer from the cybersecurity firm Sophos pointed out that there is no concrete evidence linking the predatory sparrows group to any specific country. However, the group exhibits all the characteristics of a government-backed organization, focusing on destructive actions against targets in Iran's digital sector, logistics entities, transportation infrastructure, and other strategic departments.

While it is impossible to verify a close technical connection between Israel and the predatory sparrows group, the group's actions align closely with Israel's regional priorities. It is challenging to find another nation in the region capable of executing such an attack.

The day before, the predatory sparrows group posted on X that they destroyed Sepah Bank's data because the bank provided funding for the Iranian military.