Iran’s Crypto Exchange Nobitex Hit by $48M Hack, Pro-Israel Group Claims Responsibility

Highlights:

• Nobitex suffers $48M hack, attackers target hot wallets and move funds via Tron.
• Exchange assures users cold wallets are safe, promises full compensation for losses.
• Pro-Israel hacker group claims responsibility, threatens to release Nobitex’s internal data.

Nobitex, the largest crypto exchange in Iran, reportedly faced a major hack on Wednesday. Blockchain investigator ZachXBT said the platform lost more than $48 million due to the breach. Nobitex confirmed the hack via an X post on June 18. It said the hackers had targeted its hot wallets.

Nobitex explained that early in the morning, the technical team saw signs of strange activity in part of its system and hot wallets. Right after that, the team shut down all access. The company said its security team is now checking how serious the attack was.

اطلاعیه در خصوص حادثه امنیتی

صبح امروز ۲۸ خرداد، تیم فنی ما نشانه‌هایی از دسترسی غیرمجاز به بخشی از زیرساخت‌های اطلاع‌رسانی و کیف پول گرم را شناسایی کرده است. بلافاصله پس از تشخیص، تمام دسترسی‌ها متوقف شد و تیم‌های امنیتی داخلی ما در حال بررسی دقیق ابعاد این حادثه هستند.

یادآور…

— Nobitex | نوبیتکس (@nobitexmarket) June 18, 2025

According to blockchain researcher ZachXBT, the stolen funds were mainly in Tether’s USDT and moved through the Tron network. Even after the hack, Nobitex tried to calm users by saying their cold wallet funds were still safe. It also plans to use its insurance fund and other resources to cover user losses. For now, Nobitex’s website and mobile app have been taken offline while the team continues to look into the breach.

Predatory Sparrow Targets Nobitex and Iranian Bank

After the hack was reported, a pro-Israel hacker group called Predatory Sparrow, also known as Gonjeshke Darande, said they were behind it. They claimed Nobitex helped the Iranian government avoid global sanctions and was used in its money and military systems. 

It stated:

“The Nobitex exchange is at the heart of the regime’s efforts to finance terror worldwide, as well as being the regime’s favorite sanctions violation tool. We, ‘Gonjeshke Darande,’ conducted cyberattacks against Nobitex.”

Hackers Threaten Data Leak

The group issued a warning that they planned to release Nobitex’s internal data and source code within 24 hours. They told users that any funds left after that could be at risk. The hackers first used an address named “TKFuckiRGCTerroristsNoBiTEXy2r7mNX” to steal $49 million. Another address used in the hack was “0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead,” as shown on Tronscan.

After the IRGC’s “Bank Sepah” comes the turn of Nobitex
WARNING!

In 24 hours, we will release Nobitex's source code and internal information from their internal network.
Any assets that remain there after that point will be at risk!

The Nobitex exchange is at the heart of the… pic.twitter.com/GFyBCPCFIE

— Gonjeshke Darande (@GonjeshkeDarand) June 18, 2025

Nobitex stated:

“Nobitex accepts full responsibility for this incident and assures users that all damages will be compensated through the insurance fund and Nobitex resources.”

Just one day earlier, the hacker group Predatory Sparrow claimed they were behind another major cyberattack. This attack targeted Iran’s state-owned Bank Sepah, which plays a key role in the country’s financial system. Bank Sepah is directly connected to the Islamic Revolutionary Guard Corps (IRGC), a powerful branch of Iran’s military forces. The hackers said they had destroyed key data from the bank’s systems and accused the institution of playing a role in funding Iran’s military and alleged terrorist activities. 

The attack comes as tensions between Israel and Iran continue to rise, with both countries recently exchanging missile strikes, making the timing of these cyberattacks even more significant. The full scale of the damage is still under investigation and not yet fully confirmed. However, the timing and the messages shared by the attackers suggest something more serious.