Iran’s largest crypto exchange, Nobitex, suffered a devastating breach—hackers drained roughly $90–100 million in assets, including Bitcoin, Ethereum, Dogecoin, XRP, Solana, Tron, and TON. The group responsible, calling itself Gonjeshke Darande or “Predatory Sparrow,” is believed to have ties to Israel, though no official confirmation has emerged.
After the IRGC’s “Bank Sepah” comes the turn of Nobitex
WARNING!In 24 hours, we will release Nobitex's source code and internal information from their internal network.
Any assets that remain there after that point will be at risk!The Nobitex exchange is at the heart of the… pic.twitter.com/GFyBCPCFIE
— Gonjeshke Darande (@GonjeshkeDarand) June 18, 2025
What makes this incident unprecedented is that, rather than cashing out the funds, the hackers sent them to “burner” or vanity addresses—permanently locking them away—with inflammatory labels like “FuckIRGCterrorists.” Analysts say the move was clearly politically motivated, aimed at undermining Iran’s financial capabilities.
In response to the breach and escalating geopolitical tensions—marked by Israeli strikes inside Iran—the Central Bank of Iran imposed an “operating curfew” on local crypto exchanges, restricting trading to between 10 a.m. and 8 p.m. Chainalysis notes this move likely intends to prevent further overnight attacks and curb capital flight.
Nobitex has taken swift action: shutting off external server access, moving funds from hot wallets into cold storage, and tapping its reserve fund to reimburse customers. They say the situation is “under control,” but restoring access may be delayed due to disruptions and security reviews.
Nobitex Announcement No. 4 – Regarding the Security Incident
As part of Nobitex’s ongoing response to the recent security incident, we would like to inform our users that the situation is now under control. All external access to our servers has been completely severed.
