The attack reignites concerns over Iran’s crypto use to evade sanctions and fund militant groups.
Hackers have breached Nobitex, Iran’s largest cryptocurrency exchange, stealing over $90 million in digital assets. The platform confirmed “unauthorized access” on its official X account and has since taken its website and mobile app offline for investigation.
The stolen funds included major cryptocurrencies such as Bitcoin, Ethereum, and Dogecoin. According to Chainalysis, the breach is notable given the relatively modest size of Iran’s crypto market.
Hackers identifying as Gonjeshke Darande (“Predatory Sparrow”) claimed responsibility for the cyberattack. The group posted on Telegram, stating, “ASSETS LEFT IN NOBITEX ARE NOW ENTIRELY OUT IN THE OPEN,” along with what it claimed was the full source code of Nobitex.
Blockchain analytics firm Elliptic said the attackers did not appear motivated by profit. Instead, they transferred the stolen assets to wallets designed to burn the funds. These wallets included messages targeting Iran’s Revolutionary Guard.
“The hackers had poured the money into wallets that effectively burned the funds in order to send Nobitex a political message,” Elliptic noted.
Hackers launched the attack amid rising conflict between Israel and Iran. Military exchanges earlier in the week preceded the breach. Gonjeshke Darande has a track record of high-profile cyberattacks in Iran, including the 2021 gas station outage and a 2022 steel factory incident.
The group accused Nobitex of helping Iran’s government evade Western sanctions and move funds to regional militants. Elliptic linked the exchange to individuals close to Supreme Leader Ali Khamenei and to wallets associated with groups such as Hamas and the Houthis.
Hackers targeting Iran’s crypto infrastructure have renewed scrutiny over digital assets used to bypass sanctions. U.S. Senators Elizabeth Warren and Angus King previously warned about Iran’s use of crypto in financial networks restricted by international regulations.
On-chain investigator ZachXBT has tracked fund movements across platforms following the Nobitex breach. While Israeli media have reported that Gonjeshke Darande may be linked to Israel, no official confirmation has been given.
