Iran’s Largest Crypto Exchange Nobitex hit by Israeli hackers as conflict rages

This was not about profit—it was a symbolic strike,” said a blockchain analyst at TRM Labs.

By DTD- Last updated Jun 19, 2025

TEHRAN — Nobitex, Iran’s largest cryptocurrency exchange, has suffered a major cyberattack resulting in the theft of nearly $90 million in digital assets. The sophisticated breach is being linked to the hacking group Gonjeshke Darande—translated as “Predatory Sparrow”—which has previously conducted politically motivated cyber operations against Iranian infrastructure.

The attack, which occurred in the early hours of the morning, targeted a range of blockchain networks including Bitcoin, Ethereum, and TRON. Initial estimates placed the loss at around $73 million, but updated figures from leading blockchain forensics firms Elliptic and TRM Labs now place the stolen assets at between $90 and $100 million.

In a highly unusual tactic, phrases such as “F\ckIRGCterrorists” were reportedly embedded in the public keys used by the attackers. Cybersecurity experts say this method required immense technical resources and likely served as a deliberate signal of political intent rather than an act of financial theft.

“This was not about profit—it was a symbolic strike,” said a blockchain analyst at TRM Labs. “There is credible speculation that the attackers do not even possess the private keys, meaning the stolen funds may be permanently inaccessible.”

Nobitex, which serves more than 7 million users, has previously faced scrutiny for allegedly enabling transactions linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), as well as Hamas, the Houthis, and Palestinian Islamic Jihad. These associations may have made it a prime target for adversarial state or non-state actors aiming to disrupt Iran’s financial operations and broader geopolitical ambitions.

Following the attack, Nobitex’s website went offline and trading services were temporarily suspended. Iranian authorities responded by tightening internet restrictions across parts of the country, describing the incident as “foreign-led digital aggression” and emphasizing the need to safeguard national cybersecurity.

The breach represents one of the largest and most politically charged cyberattacks on a cryptocurrency platform to date, raising serious questions about the vulnerabilities of state-affiliated financial technologies in conflict zones.