Iran’s Nobitex Crypto Exchange Suffers $100 Million Hack, Promises Refund

• Hackers destroy $100 million worth of cryptocurrencies from Nobitex Exchange
• Nobitex guarantees refunds to users after cyber attack
• Iranian brokerage attacked by Israeli-linked group

Iran's largest cryptocurrency exchange Nobitex has confirmed the loss of nearly $100 million in a cyberattack attributed to the hacktivist group Gonjeshke Darande, which is allegedly linked to Israel. The incident occurred on July 18 and had a strong impact on the local crypto community, leading the Iranian government to impose new restrictions on the operation of trading platforms.

BREAKING 🔴🔴🔴

Israeli-linked hacker group “Predatory Sparrow” wiped out 95% of assets on Iran's Nobitex crypto exchange.

Nobitex was reportedly used by Tehran to evade sanctions through crypto. Wallet balances plunged from $1.8 billion to just $100 million. pic.twitter.com/vaKoRwHHRV

— Open Source Intel (@Osint613) June 18, 2025

Second release From Nobitex, hackers transferred the stolen funds to specially created wallet addresses to destroy the assets, preventing any attempt at recovery. The wallets involved had addresses composed of random characters, deviating from the usual patterns of attacks on cryptocurrency exchanges.

The hacker group justified the action with political motivations, accusing Nobitex of collaborating with Iran's military activities and facilitating the evasion of international sanctions. In an escalation of the offensive, the hackers also claimed to have leaked parts of the exchange's source code on the X platform.

Tom Robinson, co-founder of a blockchain analytics firm, explained that the attackers deliberately burned the funds to convey a symbolic message. According to him, the assets were sent to crypto addresses without accessible private keys, making any recovery impossible.

Nobitex, in turn, assured that user funds are safe, thanks to the existence of a reserve fund. The company reinforced its commitment to its 11 million customers and stated that all balances will be fully covered.

“Nobitex Security Incident Follow-up – June 19, 2025
One day after the security incident, we would like to share the latest technical updates and decisions with our valued users. Our investigations indicate that the scope and impact of the attack are more complex than initially estimated. However, there has been no change in the financial losses reported in our previous statement. Unfortunately, the ongoing disruptions to the country’s internet infrastructure, coupled with limited on-site access due to the ongoing national crisis, have significantly slowed our response efforts. However, our technical and security teams continue to work tirelessly to conduct thorough analysis and rebuild our systems safely. To ensure a fully safe and stable recovery, we estimate that restoring access to Nobitex services will require additional time. At this stage, we anticipate a gradual and safe restoration of services within the next 4 to 5 days. We remain firmly committed to transparent communication and the protection of our users’ assets. In line with this commitment, Nobitex’s CEO will soon directly address our users via a video message shared on our official social media channels. We kindly ask that you remain calm and only refer to Nobitex’s official channels for accurate information and updates. We sincerely appreciate your patience and continued trust. — Nobitex Communication Team,” the brokerage said in an official statement.

Follow-up on Nobitex Security Incident – ​​June 19, 2025

One day after the security incident, we would like to share the latest updates and technical decisions with our valued users.
Our investigations indicate that the scope and impact of the attack are more complex than…

— Nobitex | نوبیتکس (@nobitexmarket) June 19, 2025

As a result of the attack, the Central Bank of Iran has imposed a curfew on cryptocurrency transactions, limiting the operation of local exchanges, including Nobitex, to between 10 am and 20 pm. In addition, temporary internet outages have affected users' access to the platform, causing slow service and making it difficult to carry out transactions.