Iran's largest cryptocurrency exchange, Nobitex, has started restoring services after a devastating hack earlier in June 2025, which resulted in losses exceeding $90 million. The attack, claimed by the pro-Israel hacker group Gonjeshke Darande (also known as Predatory Sparrow), saw the draining and burning of significant digital assets and the release of Nobitex's full source code.
Service Restoration and Security Measures: Nobitex is prioritizing wallet access for users who have completed identity verification, initially unlocking spot wallets with phased rollout planned for other wallet types. The exchange has cautioned users against depositing cryptocurrency to old wallet addresses due to a migration to a new wallet system, warning that deposits to obsolete addresses could cause irretrievable losses.
Details of the Attack: The June 18 hack utilized compromised employee credentials obtained through infostealer malware, breaching Nobitex’s internal systems and exposing critical proprietary data. Approximately $90–100 million in assets was stolen, involving digital currencies from Ethereum (ETH), Tron (TRX), Bitcoin (BTC), and Dogecoin (DOGE) hot wallets.
Geopolitical Context and Aftermath: The hack is widely interpreted as a politically motivated act amid escalating tensions between Iran and Israel. Chainalysis reports illustrate Nobitex's critical role in Iran’s crypto infrastructure, processing over $11 billion in inflows, with connections to sanctioned entities and groups affiliated with Iran’s Islamic Revolutionary Guard Corps. In response, Iran has imposed operational restrictions on domestic exchanges, limiting activities to daytime hours.
Broader Security Landscape: The incident aligns with a trend of increasing state-sponsored cyberattacks in 2025, with North Korean hackers notably responsible for a large share of exchange exploits. These threat actors have also been reported utilizing AI tools to advance cryptocurrency thefts.