Nobitex Used Money Laundering Techniques Months Before $90 Million Hack

On-chain analysis has revealed that Iran’s Nobitex exchange employed laundering-like techniques such as peelchains and chip-off wallets to move funds months before the $90 million hack. These techniques, which involve splitting large Bitcoin amounts into smaller, more manageable chunks and routing them through a series of short-lived wallets, are widely recognized for complicating traceability and are commonly linked to money laundering activities.

Detailed on-chain investigations have uncovered that Nobitex utilized peelchaining—a method where large Bitcoin amounts are split into smaller, more manageable chunks and routed through a series of short-lived wallets. This approach is widely recognized for complicating traceability and is commonly linked to money laundering activities. Additionally, Nobitex employed chip-off wallets, which are single-use deposit and withdrawal addresses designed to obfuscate the flow of funds by funneling BTC through multiple new wallets. These practices collectively created a complex web of transactions that masked the true origin and destination of user assets.

Contrary to Nobitex’s public statements that the “rescue wallet” was a new security measure post-hack, blockchain records trace its activity back to October 2024. This wallet had been systematically collecting smaller BTC transfers from internal wallets, following the same laundering-like transaction patterns observed throughout the exchange’s operations. The wallet’s long-term activity suggests it was part of an established liquidity management strategy rather than an emergency response. Multiple transfers of 20 to 30 BTC were funneled into this wallet well before the breach, indicating a deliberate and ongoing process of fund consolidation.

Following the June 18 hack, Nobitex executed a full-balance sweep of 1,801 BTC into the so-called “rescue wallet.” This movement was not an isolated incident but rather a continuation of pre-existing fund management practices. On June 19, an additional 1,783 BTC was transferred to a new wallet, aligning with Nobitex’s claims of securing assets. These transactions demonstrate that Nobitex retained operational control over its wallets and continued to manage liquidity using the same complex layering techniques. The hack did not disrupt these processes but instead exposed them to public scrutiny.

The pro-Israel hacking group Gonjeshke Darande’s leak of Nobitex’s internal wallet structure provided further context to the forensic findings. The exposed data confirmed the frequent use of peelchains and chip-off wallets, reinforcing the notion that Nobitex’s fund movements were methodical and systematic rather than chaotic or reactionary. Repeated transfers from old wallets to new ones, often broken down into smaller BTC chunks, are consistent with standard money laundering methodologies designed to obscure asset trails and complicate forensic analysis.

The blockchain evidence surrounding Nobitex’s $90 million hack reveals a deeper narrative of premeditated and ongoing fund obfuscation. Rather than a sudden response to a security breach, the laundering-like activities were embedded in the exchange’s operational framework for months prior. This case underscores the importance of rigorous on-chain analysis in uncovering hidden financial behaviors within crypto exchanges and highlights the need for enhanced transparency and regulatory oversight in the sector.