Iranian cryptocurrency exchange Nobitex, the country’s largest digital asset trading platform, has begun a phased restoration of services following a June 18, 2025 exploit that resulted in the loss or destruction of over $90 million in crypto from its hot wallets. Blockchain analytics firms and security researchers attribute the incident to Gonjeshke Darande (also known as Predatory Sparrow), a pro‑Israel hacktivist group widely believed to be linked to Israeli state interests, which framed the operation as a politically motivated strike on Iran’s digital financial infrastructure rather than a profit‑seeking theft. On‑chain analysis indicates that the attackers sent the stolen assets to specially crafted “burner” or invalid addresses—many with messages targeting Iran’s Islamic Revolutionary Guard Corps (IRGC)—meaning the funds cannot be recovered and were effectively destroyed. In response, Nobitex suspended services, isolated affected infrastructure, and later announced a multi‑phase recovery plan to bring the exchange back online. The roadmap outlines staged reactivation: first, mandatory re‑authentication for all users via the web interface with most functions still disabled; second, restored account access for verified users; and finally, a gradual reopening of deposits, withdrawals, and trading, accompanied by a promised technical post‑mortem and additional security hardening, including expanded cold‑storage usage. The incident has had systemic implications inside Iran: Nobitex is a central venue for domestic crypto activity, and reports indicate that Iranian authorities, including the Central Bank of Iran, have tightened oversight of exchanges and in some cases restricted operating hours following the hack. The Nobitex exploit is now cited as a prominent example of geopolitically driven cyber operations in the crypto sector, illustrating how nation‑state and proxy actors can use on‑chain tools not only to steal funds but to erase them as a form of political and economic signaling.

AI-generated background, compiled from web sources — not editorial content.

More coverage

Explore the topic

More on Hacks

Ethereum loses $459M in 34 H1 incidents; one Drift Trade hack accounts for $295M of Solana's five-incident $328M total

Ethereum loses $459M in 34 H1 incidents; one Drift Trade hack accounts for $295M of Solana's five-incident $328M total

Quillaudits ·

Crypto hacks hit $75.9M across 40 June attacks as losses dip 7% from May

Crypto hacks hit $75.9M across 40 June attacks as losses dip 7% from May

𝕏/@TheBlockCo ·

Crypto hacks hit record 83 incidents in Q2 as bridges account for $351M of $755M stolen

Crypto hacks hit record 83 incidents in Q2 as bridges account for $351M of $755M stolen

CoinTelegraph ·

Humanity Protocol's 447M H token attack wasn't a hack—it was operational security FAIL: malware on a dev machine gave attackers full root access to 7 private keys, draining $31M+ because devs backed up keys to the wrong device during mainnet launch

Humanity Protocol's 447M H token attack wasn't a hack—it was operational security FAIL: malware on a dev machine gave attackers full root access to 7 private keys, draining $31M+ because devs backed up keys to the wrong device during mainnet launch

humanityprotocol.notion.site ·

a16z’s Eddy Lazzarin says crypto hacks appear worse because blockchain transparency exposes exact losses instantly, while TradFi breaches often bury the true scale of damage

a16z’s Eddy Lazzarin says crypto hacks appear worse because blockchain transparency exposes exact losses instantly, while TradFi breaches often bury the true scale of damage

𝕏/@a16zcrypto ·

New research argues modern DeFi lending markets are far safer than their reputation suggests, with exploit losses now heavily concentrated in isolated edge cases

New research argues modern DeFi lending markets are far safer than their reputation suggests, with exploit losses now heavily concentrated in isolated edge cases

𝕏/@flipdazed ·

Explore the full feed

Comments

Up nextForma shuts down its chain over unsustainable operations, moving NFTs to Ethereum