Nobitex hack

On attribution: Gonjeshke Darande / Predatory Sparrow publicly claimed responsibility; media reports suggest links to Israeli intelligence, which Israel has not officially confirmed. This was a politically motivated, destructive attack rather than theft for profit.

Summary

On June 18, 2025, Nobitex — described as Iran's largest cryptocurrency exchange (claiming 7M+ users) — detected unauthorized access to its infrastructure and hot wallets. Blockchain analysts (Elliptic) identified more than $90 million moved out. The attack came amid an escalation of the Israel–Iran conflict, a day after a similar operation against Iran's state-owned Bank Sepah. ^[1][2]

The funds were burned, not stolen

Rather than profit, the attackers sent nearly all the assets to "vanity" addresses containing anti-IRGC slogans (e.g. variations of "F*ckIRGCterrorists"). Generating such long custom strings is computationally infeasible, so the group does not hold the private keys — the funds are effectively destroyed, sending a political message. The group also published Nobitex's source code. ^[1][2]

Context

Elliptic and others have linked Nobitex to IRGC-related financial activity and sanctions evasion; Nobitex's CEO denied ties to the Iranian state or IRGC. ^[1][2]

Bracketed numbers refer to the numbered sources listed below.