Iran's largest cryptocurrency exchange Nobitex has announced that it has been subject to a major cyber attack. According to the statements, the attack targeted the exchange's hot wallets and while it was initially claimed that there was a loss of $48.65 million, it was later reported that this amount reached $73 million. The allegations regarding the attack were revealed by blockchain detective ZachXBT.
Statement from Nobitex
Nobitex stated in a statement it made on X (former Twitter) on June 18 that its technical teams detected unauthorized access to the system. The company announced that it suspended all access immediately after the attack and launched a comprehensive internal security investigation. The statement emphasized that users' funds in cold wallets were safe and that all losses would be covered by Nobitex's insurance fund and its own resources.
Exchange officials said, "Nobitex is fully responsible for this incident. Our users' losses will be fully covered." The company's website and mobile application were also temporarily closed during the investigation.
Who is behind the attack?
Investigating the details of the attack, ZachXBT stated that the suspicious transactions took place on the Tron network and that the wallet address used by the hacker contained a striking phrase such as “TKFuckiRGCTerroristsNoBiTEX…” The phrase “IRGC” (Iranian Revolutionary Guard Corps) in the address raised the possibility that the attack could be based on political motivation.
According to ZachXBT, the attack was not limited to the Tron network. Suspicious exits from wallets belonging to Nobitex also occurred on Ethereum Virtual Machine (EVM) chains.
Statement from the Israeli-linked hacker group
Immediately after the cyber attack, a hacker group identifying itself as “Gonjeshke Darande” (Turkish for “Sparrow of Prey”) claimed responsibility for the attack. In a statement made on the social media platform X, the group described Nobitex as one of the Iranian regime’s means of financing terrorism and evading global sanctions.
The group said: “Nobitex is at the heart of the regime’s efforts to finance terrorism around the world and is used as a primary tool to evade sanctions. That’s why we launched cyberattacks against the platform.”
Furthermore, the group’s statements claimed that Nobitex employees are considered military personnel under Iranian law and that the platform is part of the country’s defense and intelligence infrastructure. The hackers threatened to release Nobitex’s source code and internal data within the next 24 hours.
Iran-Israel tensions spill over into cyberspace
This incident showed that the recent escalation of tensions between Iran and Israel has spilled over into the cryptocurrency world. The political and ideological conflicts between the two countries have escalated into open conflict with mutual missile attacks in recent weeks. This tension has also led to volatility in cryptocurrency markets. According to market data, approximately $1 billion worth of positions were liquidated in the market since the clashes began, but the Fear and Greed Index still remains in the “greed” zone.
