Pro-Israel Hackers Burn $90 Million in Cryptocurrency in Iran Exchange Attack

In a significant cybersecurity incident, a pro-Israel hacker group, Gonjeshke Darande, also known as Predatory Sparrow, breached Iran’s largest cryptocurrency exchange, Nobitex. The group claimed to have stolen over $90 million in digital assets, including Bitcoin, Ethereum, Dogecoin, and other tokens, from Nobitex’s hot wallets. The hackers then rendered these funds permanently inaccessible by transferring them to multiple blockchains using “vanity addresses” that contain no recoverable private keys, effectively burning the assets.

The hackers framed the breach as a direct response to Nobitex’s alleged role in helping the Iranian regime circumvent sanctions and fund terrorism. This incident follows heightened military and cyber tensions between Iran and Israel, which escalated after Israeli airstrikes on Tehran’s nuclear sites. The hackers’ actions were seen as a retaliation for these tensions, with the group using inflammatory labels on the burn addresses, such as “FuckIRGCTerroristsNoBiTEX,” targeting Iran’s Islamic Revolutionary Guard Corps. One Bitcoin wallet used in the attack was provably unspendable due to its invalid checksum, and on Ethereum, tokens were sent to the “0x…dead” burn address commonly used to retire supply permanently.

In response to the breach, Nobitex issued a statement acknowledging the burn and assuring users that their assets are safe in cold storage. The exchange clarified that as a precaution, its staff had also emptied hot wallets and that no customer funds would be lost, citing its reserve fund and insurance pool. However, the hackers have threatened to release the source code and internal infrastructure data of Nobitex, which could further compromise the security of Iran’s leading cryptocurrency platform, which has over 11 million users. Gonjeshke Darande warned that any assets left on the platform would be at risk if users did not withdraw immediately.

Despite having no financial motivation, the hack has far-reaching implications. The intentional destruction of more than $90 million worth of digital currency demonstrates how state-level conflicts have turned crypto infrastructure into a new battlefield. This incident highlights the growing use of cyber warfare in geopolitical conflicts, with hacker groups aligning with political agendas to disrupt and destabilize their adversaries. The hackers' actions also underscore the vulnerability of cryptocurrency exchanges to sophisticated cyber attacks, despite the decentralized nature of digital currencies. The incident serves as a reminder of the need for enhanced security measures in the cryptocurrency industry to protect against such politically motivated attacks.