Edit: Nobitex hack — CryptoScamsWiki

Title / name *

Summary *

Category *

Scam type *

Severity *

Chain

Token

Amount lost (USD)

Image

Upload

Paste a link or upload a file (max 5 MB).

Details (Markdown supported)

> **On attribution:** Gonjeshke Darande / Predatory Sparrow publicly claimed responsibility; media reports suggest links to Israeli intelligence, which Israel has not officially confirmed. This was a politically motivated, destructive attack rather than theft for profit.

## Summary

On June 18, 2025, Nobitex — described as Iran's largest cryptocurrency exchange (claiming 7M+ users) — detected unauthorized access to its infrastructure and hot wallets. Blockchain analysts (Elliptic) identified more than $90 million moved out. The attack came amid an escalation of the Israel–Iran conflict, a day after a similar operation against Iran's state-owned Bank Sepah. [1][2]

## The funds were burned, not stolen

Rather than profit, the attackers sent nearly all the assets to "vanity" addresses containing anti-IRGC slogans (e.g. variations of "F*ckIRGCterrorists"). Generating such long custom strings is computationally infeasible, so the group does not hold the private keys — the funds are effectively destroyed, sending a political message. The group also published Nobitex's source code. [1][2]

## Context

Elliptic and others have linked Nobitex to IRGC-related financial activity and sanctions evasion; Nobitex's CEO denied ties to the Iranian state or IRGC. [1][2]

_Bracketed numbers refer to the numbered sources listed below._

Aliases (one per line)

Wallets (chain:address per line)

Propose an edit