Iranian Exchange Nobitex Loses $48 Million in Cyberattack

An Iranian cryptocurrency exchange, Nobitex, has confirmed a significant security breach resulting in the theft of over $48 million in assets, primarily in Tether (USDT) on the Tron network. The exchange disclosed the incident in a statement posted on X on June 18, 2025. The breach targeted Nobitex's hot wallets and parts of its reporting infrastructure, prompting the company to immediately suspend all access and launch an internal investigation. Nobitex assured users that all damages would be compensated through the insurance fund and Nobitex resources. While hot wallets were compromised, the exchange emphasized that cold wallet funds remain secure. The platform also took its website and mobile app offline while the investigation continues.

A group calling itself Gonjeshke Darande, or “Predatory Sparrow,” claimed responsibility for the attack. The group labeled Nobitex as a key financial tool for the Iranian regime, accusing the platform of aiding Iran’s military and facilitating sanctions evasion. In a statement posted to X, the group warned, “We conducted cyberattacks against Nobitex. It is at the heart of the regime’s efforts to finance terror worldwide.” The group also claimed that Nobitex employment constitutes military service, implying the exchange is embedded within Iran’s defense and intelligence ecosystem. Predatory Sparrow threatened to release Nobitex’s source code and internal documents within 24 hours, warning users that assets left on the exchange could be in jeopardy.

While no formal links to the Israeli government have been confirmed, the group has a history of attacking Iranian infrastructure, leading to speculation about potential connections. The situation marks one of the largest crypto breaches in the Middle East this year, raising serious concerns about the growing intersection of cyberwarfare with the global crypto economy. The incident highlights the vulnerabilities within the cryptocurrency exchange ecosystem and the potential for geopolitical tensions to spill over into the digital financial landscape.

This breach underscores the critical need for enhanced security measures within the cryptocurrency industry. The compromise of hot wallets, which are more susceptible to cyberattacks due to their online nature, emphasizes the importance of robust security protocols and continuous monitoring. The fact that cold wallet funds remain secure suggests that Nobitex had implemented some effective security measures, but the breach of hot wallets indicates that further improvements are necessary. The exchange's decision to take its website and mobile app offline during the investigation is a prudent step to prevent further damage and protect user assets.

The claim of responsibility by Gonjeshke Darande adds a layer of complexity to the incident. The group's accusations against Nobitex, including aiding Iran’s military and facilitating sanctions evasion, suggest a geopolitical motive behind the attack. The threat to release Nobitex’s source code and internal documents within 24 hours raises concerns about the potential exposure of sensitive information, which could have far-reaching implications for the exchange and its users. The group's history of attacking Iranian infrastructure further complicates the situation, as it raises questions about the potential involvement of external actors in the cyberattack.

The incident serves as a stark reminder of the vulnerabilities within the cryptocurrency exchange ecosystem and the potential for geopolitical tensions to spill over into the digital financial landscape. The growing intersection of cyberwarfare with the global crypto economy highlights the need for increased vigilance and cooperation among cryptocurrency exchanges, regulatory bodies, and cybersecurity experts. The breach of Nobitex underscores the importance of implementing comprehensive security measures to protect user assets and maintain the integrity of the cryptocurrency market. As the investigation continues, it will be crucial for Nobitex to address the vulnerabilities that led to the breach and take steps to prevent similar incidents in the future. The exchange's assurance to compensate users for their losses through the insurance fund and Nobitex resources is a positive step towards rebuilding trust and confidence in the platform. However, the long-term impact of the breach on Nobitex's reputation and the broader cryptocurrency market remains to be seen.