Hackers linked to Israel just emptied Iran’s largest exchange

Anand Sinha

Wed, Jun 18, 2025, 6:52 AM 2 min read

Hackers linked to Israel just emptied Iran’s largest exchange originally appeared on TheStreet.

Nobitex, the largest crypto exchange in Iran, announced on June 18 that it has detected unauthorized access to a portion of its reporting infrastructure and hot wallet.

The incident affected only a portion of the assets in hot wallets, and users' assets are completely secure as per cold storage standards, the exchange told its users on X. All affected users will be compensated through the insurance fund and Nobitex resources, it added.

For now, the crypto exchange's website and app are temporarily unavailable.

The hacking group Gonjeshke Darande, also known as Predatory Sparrow, claimed responsibility for the attack. Reports have linked the group to Israel.

The group threatened to release Nobitex's source code and internal information within 24 hours. The Iranian regime uses the crypto exchange to violate sanctions and "finance terror," the group claimed as the reasons behind the attack on Nobitex.

Gonjeshke Darande earlier claimed responsibility for another cyberattack on the data of the Islamic Revolutionary Guard Corps’ “Bank Sepah.”

Popular on-chain sleuth ZachXBT wrote on Telegram, “The Iranian crypto exchange ‘Nobitex’ appears to have been exploited for $81 million across Tron and Ethereum-based network after suspicious outflows were observed from many wallets linked to them.”

The hacking group's next post confirmed ZachXBT's claim.

As reported earlier, Iran has relied on crypto as a source of fighting Western economic "terrorism." The country is also a popular choice for Bitcoin traders, with several Chinese firms moving there due to relatively cheap electricity and China's crypto crackdown.