Nobitex hack — June 2025

Nobitex, Iran's largest cryptocurrency exchange, said on 18 June 2025 that it had identified unauthorised access to parts of its infrastructure, affecting its internal communication systems and a portion of its hot wallets. The website and app went offline the same day.

The group Gonjeshke Darande, known in English as Predatory Sparrow, claimed responsibility, saying Nobitex sat at the centre of the Iranian government's terror financing and sanctions evasion. The claim came a day after the same group said it had attacked the state-owned Bank Sepah, causing widespread ATM outages, and days after Israeli strikes on Iran began. The group also pledged to publish Nobitex's source code and internal technical documentation. Israel has not officially confirmed involvement.

Elliptic traced over $90 million out of Nobitex wallets, a figure broadly matched by TRM Labs and Chainalysis and by on-chain records reviewed by reporters. The independent analyst ZachXBT counted at least $81.7 million across Ethereum and Tron-compatible networks alone. Assets moved included bitcoin, ether, dogecoin, tron, XRP, solana, TON and tether.

The funds were not taken for profit. They were sent to vanity addresses spelling out anti-IRGC slogans on Tron and Ethereum. Producing addresses with text strings that long by brute force is computationally infeasible, so the attackers cannot hold the corresponding private keys, and Elliptic concluded the funds were effectively burned to send a political message. Nothing is recoverable. Nobitex restored access in stages from 29 June 2025, beginning with spot wallets for verified users. On 2 June 2026 the US Treasury sanctioned Nobitex itself, along with Wallex, Bitpin and Ramzinex and four Nobitex-linked individuals, under a counterterrorism designation citing IRGC and ransomware links.