Nobitex Resumes Services After $90 Million Crypto Heist

Iranian crypto exchange Nobitex is gradually resuming its services following a significant cyber attack that resulted in the theft of approximately $90 million in digital assets. The attack, which occurred in mid-June, was carried out by a pro-Israel hacking group known as Gonjeshke Darande, translating to "Predatory Sparrow" in Persian. The group claimed that their target was the Islamic Revolutionary Guard Corps (IRGC), a branch of the Iranian armed forces, rather than the general public. However, the impact on civilians was severe, with many reporting that they had no access to their funds following the attack.

On Sunday, Nobitex announced via a post on X that verified users would soon regain access to their accounts and be able to view their wallet balances. The exchange also stated that it would gradually restore withdrawal, deposit, and trading services for these users. The stolen funds included $49.3 million in Tron, $24.3 million across Ethereum-linked chains, $6.7 million in Dogecoin, and $2 million in Bitcoin. The attackers used wallet addresses that sent political messages, including one address named “TKFuckiRGCTerroristsNoBiTEXy2r7mNX,” which referenced the IRGC.

Rajat Ahlawat, APAC research lead at compliance firm Crystal Intelligence, noted that while it is likely that the IRGC has been using the exchange, it is also probable that the group has access to cryptocurrency through other means. Nobitex is considered the largest centralized exchange in Iran and is a well-known name among crypto users in the country, similar to how Binance or Coinbase are recognized in other regions. Despite the attackers' claims, many ordinary people were affected by the action, highlighting the widespread use of cryptocurrency in Iran as a hedge against inflation and global sanctions.

The attack on Nobitex came just a day after Bank Sepah, one of the country’s largest banks, was also targeted by the same hacking group. This prevented a large number of Iranian civilians from receiving their salaries on payday. Gonjeshke Darande is believed to have state-like capabilities, although there has been no official confirmation of a link to the Israeli government. The dual attacks left many Iranians without access to their funds, exacerbating the economic hardships faced by the population.

Iran has a high level of crypto literacy, with both the government and the general population turning to cryptocurrencies as a means to circumvent global sanctions and mitigate the effects of severe inflation. Nobitex claims to have more than seven million users, which is approximately 7.6% of the entire Iranian population. The hack on Nobitex was seen as an attempt to sow discontent among the population. However, it appears to have had the opposite effect, with many Iranians expressing pro-nationalism sentiments in response to the attack.

Despite the challenges, the gradual resumption of Nobitex's operations is crucial for many civilians who rely on cryptocurrency to navigate the country's economic difficulties. The exchange's recovery is a significant step towards restoring financial stability for its users, who have been severely impacted by the recent cyber attacks.