Skip to content
All about technology. — All about cybersecurity.

Pro-Israel hackers perpetrate an $81 million cyber attack on Nobitex.

Cyber attack on Iran's leading cryptocurrency exchange, Nobitex, results in a staggering loss of $81.7 million. The perpetrators behind the attack, a pro-Israel group called Gonjeshke Darande, announce their responsibility for the attack on the digital platform.

,   and  Administrator
3 min read
Pro-Israeli Cyberattack Causes $81 Million Loss in Nobitex Data Heist
Pro-Israeli Cyberattack Causes $81 Million Loss in Nobitex Data Heist

Pro-Israel hackers perpetrate an $81 million cyber attack on Nobitex.

In a significant turn of events, the Iranian cryptocurrency exchange, Nobitex, has fallen victim to a major security breach. The pro-Israel hacker group Gonjeshke Darande, also known as Predatory Sparrow, has claimed responsibility for the attack.

On June 2025, Gonjeshke Darande launched an attack on Nobitex, one of Iran's leading cryptocurrency exchanges. The hackers managed to steal around $81-90 million in cryptocurrencies, primarily linked to the Islamic Revolutionary Guard Corps (IRGC). In an unusual move, the hackers then "burned" these assets by transferring stablecoins to inaccessible blockchain addresses, effectively removing them permanently from circulation.

The impact of this attack on the crypto industry and sanctions evasion is significant. Nobitex handles nearly 90% of Iran’s crypto transactions, including operational funds for the IRGC. By extracting and destroying approximately $90 million in assets tied to IRGC wallets, the hack disrupted key financial flows used for military and sanctioned activities.

Moreover, the attack impeded Iran’s ability to use cryptocurrencies to bypass international sanctions. Iran has been known to use cryptocurrencies to circumvent financial restrictions, and this operation highlights the growing trend where cryptocurrency platforms become battlegrounds in international conflicts.

The attack also raises concerns about security risks and regulatory scrutiny in emerging markets, potentially influencing user trust and investment flows in the crypto ecosystem related to sanctioned countries.

In a statement, Nobitex acknowledged the hack and assured users that all losses will be fully covered using its insurance reserves and internal resources. The incident was limited to a subset of funds held in hot wallets at Nobitex, and user assets remain "completely secure" in accordance with cold storage protocols.

Interestingly, this is not the first time Gonjeshke Darande has targeted Iran's financial institutions. The group has previously claimed responsibility for a cyberattack on Bank Sepah, one of Iran's oldest and largest state-owned banks. The group accused Bank Sepah of evading international sanctions and using Iranian citizens' funds to support the regime's terrorist affiliates, ballistic missile development, and military nuclear ambitions.

The escalating tensions between Israel and Iran coincide with the hack and the subsequent claim of responsibility by Gonjeshke Darande. This operation illustrates how state or state-aligned hacking groups use crypto theft and asset burning as a war tactic, aiming at economic degradation rather than pure financial gain. It reflects a growing trend where cryptocurrency platforms become battlegrounds in international conflicts, similar to other attacks witnessed during the Ukraine-Russia war and other geopolitical tensions.

The Nobitex hack and the subsequent claim of responsibility by Gonjeshke Darande come amidst concerns over Iran's activities in the cryptocurrency space by US lawmakers. The initial $49 million was drained through an address labeled "TKFuckiRGCTerroristsNoBiTEXy2r7mNX," and a second address used in the operation was "0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead."

As the dust settles, it is clear that the Gonjeshke Darande hack on Nobitex represents a strategic cyberattack that both disrupts Iran’s military funding via cryptocurrency and directly challenges the use of crypto as a tool for sanctions evasion, highlighting the intersection of cyber warfare and financial technology in geopolitical conflicts.

References:

  1. "Iranian Crypto Exchange Nobitex Hacked, $90 Million in Cryptocurrencies Stolen." Cointelegraph, 20 June 2025.
  2. "Gonjeshke Darande Hacks Bank Sepah, Iran's Oldest and Largest State-Owned Bank." The Hacker News, 15 June 2025.
  3. "Pro-Israel Hacker Group Gonjeshke Darande Targets Nobitex Due to Terror Financing and Sanctions Evasion." The Next Web, 21 June 2025.
  4. "Nobitex Hack Highlights Cryptocurrency as a Battleground in International Conflicts." Forbes, 22 June 2025.
  5. "Impact of Nobitex Hack on Sanctions Evasion and Crypto Market Confidence." The Wall Street Journal, 23 June 2025.
  6. The $90 million theft from Nobitex, one of Iran's leading cryptocurrency exchanges, by the pro-Israel hacker group Gonjeshke Darande, serves as a prime example of how cryptocurrencies can become battlegrounds in international conflicts.
  7. In the aftermath of the Nobitex hack, concerns about security risks and regulatory scrutiny in emerging markets, particularly those under sanctions, have intensified, potentially impacting user trust and investment flows in the crypto ecosystem.
  8. The attack on Nobitex, which disrupted key financial flows used for military and sanctioned activities, demonstrates the growing trend of state or state-aligned hacking groups using crypto theft and asset burning as a tactic in economic warfare.
  9. The US is paying close attention to Iran's activities in the cryptocurrency space following the Nobitex hack, as illustrated by the use of addresses such as "TKFuckiRGCTerroristsNoBiTEXy2r7mNX" and "0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead" in the operation.

Read also:

    Related

    Latest