Iran’s Nobitex hacked; USD 90 million in crypto burned in cyberattack
text_fields
Dubai: Hackers allegedly linked to Israel have stolen over USD 90 million from Nobitex, Iran’s largest cryptocurrency exchange, in a politically charged cyberattack, according to leading blockchain analytics firms.
The group claiming responsibility for the breach released what it said was Nobitex’s full source code on Thursday, declaring on its Telegram channel, “ASSETS LEFT IN NOBITEX ARE NOW ENTIRELY OUT IN THE OPEN.” Blockchain analytics firm Elliptic reported that the stolen funds were transferred to cryptocurrency addresses containing messages criticising Iran’s Islamic Revolutionary Guard Corps (IRGC). The firm noted that the attack was likely not financially motivated, as the hackers “effectively burned the funds in order to send Nobitex a political message.”
The hacker group, Gonjeshke Darande — Farsi for “Predatory Sparrow” — accused Nobitex of aiding the Iranian government in evading Western sanctions related to its nuclear programme and in transferring funds to militant groups. In a statement posted on X, the group alleged that the exchange facilitated money flows to support sanctioned entities.
Nobitex appeared to confirm the breach, announcing on X that it was investigating “unauthorised access” to its systems. Both its mobile application and official website were offline as part of the ongoing assessment.
Andrew Fierman, head of national security intelligence at Chainalysis, said the attack affected a broad range of digital assets, including Bitcoin, Ethereum, Dogecoin and others. He noted that the breach was “particularly significant given the comparatively modest size of Iran’s cryptocurrency market.”
The incident follows a sharp escalation in Israel-Iran tensions, triggered last week by Israeli strikes on Iranian nuclear sites and military personnel, which drew missile retaliation from Tehran. Earlier this week, Gonjeshke Darande also claimed responsibility for a cyberattack on Iran’s state-owned Bank Sepah, claiming to have destroyed sensitive data.
Elliptic said it had found connections between Nobitex and relatives of Iran’s Supreme Leader Ayatollah Ali Khamenei, as well as evidence that sanctioned members of the Revolutionary Guard had used the platform. The firm also alleged that the exchange had conducted transactions with wallets controlled by groups allied with Iran, including Yemen’s Houthi rebels and the Palestinian militant group Hamas.
Gonjeshke Darande has previously carried out several high-profile cyberattacks in Iran. In 2021, the group paralysed the country’s gas stations in a nationwide disruption, and in 2022, it claimed responsibility for an attack on a steel plant that caused a large industrial fire.
While Israeli media has widely reported suspected ties between the group and Israeli intelligence, the Israeli government has never officially confirmed any connection.
The incident also reignites international concerns over Iran’s use of cryptocurrency to bypass economic sanctions. Last year, United States Senators Elizabeth Warren and Angus King voiced alarm over the potential for Iran to exploit digital currencies to circumvent global financial restrictions.
With PTI inputs
