Following a $100 million hack on Nobitex by a pro-Israel hacker group, Iran’s central bank has reportedly enforced strict operating hours for domestic crypto exchanges.
According to a blog post by Chainalysis on Wednesday, crypto exchanges in Iran are now restricted to operating between 10 a.m. and 8 p.m.
Chainalysis’s head of national security intelligence, Andrew Fierman, told Cointelegraph that the curfew is likely aimed at improving incident response, explaining that “incidents are easier to triage if they’re not happening in the middle of the night.”
Nobitex confirmed the hack occurred on Wednesday morning.
Fierman added that, beyond security concerns, the Iranian government may also be seeking to exert greater control over cross-border crypto transactions, which many Iranians rely on: “The Iranian regime may want to assert more control over their citizens’ transactions.”
“This is especially the case during times where geopolitical tensions are high and capital flight from Iran is possible.”
Iran’s central bank has previously imposed restrictions on crypto exchanges. In December, it ordered a temporary shutdown of all platforms in an effort to curb the exchange of its national currency, the rial, and prevent further depreciation.
Tensions between Iran and Israel have been escalating, with Israel launching multiple strikes inside Iran on June 13. The two nations have continued to exchange attacks in the weeks since.
Nobitex Hackers Destroyed the Stolen Crypto by Burning It
Nobitex was exploited for an estimated $100 million in assets, spanning various cryptocurrencies such as Bitcoin, Ether, Dogecoin, XRP, and Solana.
The pro-Israel hacker group Gonjeshke Darande has claimed responsibility for the attack, alleging it gained access to Nobitex’s internal systems and drained funds from the exchange’s hot wallets.
In its report, the Chainalysis team noted that the wallets used by the attackers appeared to be burner addresses with no private key access, rendering the stolen funds “irretrievable.”
“While hacks have historically been driven by financial gain, this incident is notable for its apparent political motivation to deprive the regime of funds,” said Andrew Fierman, Chainalysis’s head of national security intelligence.
Burning tokens involves permanently removing them from circulation, typically by sending them to an inaccessible wallet address.
Nobitex Claims Situation Is “Under Control” After $100M Hack
In the wake of the hack, Nobitex cut off all external access to its servers, the exchange’s communications team said in a statement posted to X on Wednesday.
“As part of Nobitex’s ongoing response to the recent security incident, we would like to inform our users that the situation is now under control,” the statement read.
While user access remains suspended for now, the exchange assured customers that all lost assets will be fully covered by the Nobitex Reserve Fund.
The Nobitex technical team is actively transferring funds from the exchange’s online hot wallets to offline cold storage in an effort to prevent further exploits and losses.
Additionally, the communications team noted that ongoing internet disruptions and restricted access to external servers could lead to delays in restoring user access to the platform.
Nobitex Serves as a Key Pillar in Iran’s Crypto Ecosystem
Chainalysis reported that Nobitex has received over $11 billion in total inflows—significantly surpassing the combined total of just under $7.5 billion for the next ten largest Iranian crypto exchanges.
According to Chainalysis, Nobitex is the primary platform for Iranian users seeking access to global cryptocurrency markets and serves as a central pillar of the country’s digital asset ecosystem.
“Nobitex isn’t just a local exchange; it functions as a critical hub within Iran’s heavily sanctioned crypto ecosystem, providing users—who are otherwise cut off from traditional financial systems—with access to global markets,” the firm stated.
Chainalysis also noted that the exchange has connections to several groups designated as terrorist organizations by Western governments, including the Houthi rebels in Yemen, a pro–al-Qaeda propaganda channel, and sanctioned Russian crypto exchanges Garantex and Bitpapa.
