Nobitex hack
On June 18, 2025, Iran's largest crypto exchange, Nobitex, had ~$90M drained from its hot wallets during the Israel–Iran conflict. The pro-Israel hacktivist group Gonjeshke Darande ('Predatory Sparrow') claimed responsibility and deliberately 'burned' the funds to vanity addresses bearing anti-IRGC messages.
Also known as: Nobitex, Nobitex hack
On attribution: Gonjeshke Darande / Predatory Sparrow publicly claimed responsibility; media reports suggest links to Israeli intelligence, which Israel has not officially confirmed. This was a politically motivated, destructive attack rather than theft for profit.
Summary
On June 18, 2025, Nobitex — described as Iran's largest cryptocurrency exchange (claiming 7M+ users) — detected unauthorized access to its infrastructure and hot wallets. Blockchain analysts (Elliptic) identified more than $90 million moved out. The attack came amid an escalation of the Israel–Iran conflict, a day after a similar operation against Iran's state-owned Bank Sepah. [1][2]
The funds were burned, not stolen
Rather than profit, the attackers sent nearly all the assets to "vanity" addresses containing anti-IRGC slogans (e.g. variations of "F*ckIRGCterrorists"). Generating such long custom strings is computationally infeasible, so the group does not hold the private keys — the funds are effectively destroyed, sending a political message. The group also published Nobitex's source code. [1][2]
Context
Elliptic and others have linked Nobitex to IRGC-related financial activity and sanctions evasion; Nobitex's CEO denied ties to the Iranian state or IRGC. [1][2]
Bracketed numbers refer to the numbered sources listed below.
People & entities involved
Sources (2)
See also
- CluCoin (CLU)TokensA Miami-based crypto token (CLU) that ran a 2021 ICO and pivoted to NFTs and a metaverse game. Founder Austin Michael Taylor ('DNPthree') secretly siphoned ~$1.14M of investor funds into online casinos; he pleaded guilty to wire fraud and was sentenced in 2025 to 27 months.
- Gotbit (crypto market manipulation)OtherA prominent crypto 'market maker' that the U.S. DOJ says ran wash-trading/market-manipulation services (2018–2024) to fake trading volume for token clients (including Saitama and Robo Inu) and win exchange listings. Charged in the FBI's 'Operation Token Mirrors'; founder Aleksei Andriunin pleaded guilty in 2025 and Gotbit forfeited $23M.
- Wolf (WOLF) memecoin
This page was last updated on Jun 8, 2026. View revision history.