Iran’s biggest crypto exchange, Nobitex, has been hacked for over $48 million in a cyberattack believed to be carried out by the Israeli-linked group Gonjeshke Darande. The attack happened early on June 18 and was confirmed by Nobitex in a public post.
The hackers took funds from one of Nobitex’s hot wallets, which is a type of crypto wallet connected to the internet. Nobitex quickly shut down its website and app after spotting the breach at 06:24 UTC. The platform said most of the funds were safe in cold storage wallets that are kept offline.
In their X post, Nobitex said, “We would like to remind you that users’ assets are completely secure according to cold storage standards.” The company promised to cover all damages using its insurance fund and internal resources.
The hackers, also known as Predatory Sparrow, warned that they would release Nobitex’s source code and internal data within 24 hours. They claimed the exchange is helping Iran’s regime dodge international sanctions and fund terrorism.
The stolen funds included USDT on Tron, as well as Bitcoin, Dogecoin, and tokens on EVM chains, with $48.65M stolen in USDT. Blockchain trackers flagged several addresses used by the hackers, including ones with offensive messages aimed at Nobitex and Iranian authorities.
Blockchain analyst ZachXBT confirmed the suspicious outflows in a Telegram post, saying the total stolen could reach up to $81.7 million. He traced the assets across different blockchains using wallet trackers.
Onchain Labs, a blockchain security firm, said this hack fits the pattern of previous attacks by Gonjeshke Darande. The same group had recently taken credit for disabling 70% of Iran’s gas stations and targeting Bank Sepah, a major bank tied to Iran’s military.
At the time of reporting, Nobitex has not confirmed the total stolen amount and is offline as its team works to assess the full damage. The attack adds more fuel to rising cyber tensions between Iran and Israel.
Also Read: Eyenovia Invests $50M in HYPE, Rebrands to Hyperion DeFi
