Jun 2025 - Nobitex Hot Wallet Funds Burned In Politically Motivated Attack - $81.7m (Iran)
Nobitex is Iran’s largest centralized cryptocurrency exchange, founded in 2017 by graduates of Sharif University of Technology. It serves as the primary gateway for Iranians to convert Iranian rials into digital assets such as Bitcoin, Ethereum, Litecoin, and Tether, processing roughly 70–87% of all domestic crypto transactions—translating into billions of dollars in trading volume and around 6 million active users by late 2024. The platform prioritizes security, employing encrypted data transmission, cold wallets for asset storage, two-factor authentication, and offline private key management. It also offers value-added services like DeFi tools, margin trading aligned with Islamic law, and zero-knowledge proof–based proof-of-reserves systems.
Despite its prominence in Iran’s digital financial landscape, Nobitex has drawn scrutiny for its role in facilitating sanctions evasion. Open-source blockchain analysis firms—TRM Labs, Elliptic, and Chainalysis—have linked the exchange to transactions involving the IRGC, Hamas, the Houthis, and other sanctioned groups. Notably, in 2022, U.S. senators warned that the exchange may be assisting in the laundering of illicit funds for Iran’s regime. Additionally, Nobitex has openly encouraged users to use intermediary wallets and foreign platforms such as Binance—a strategy that, according to Reuters, effectively instructs users in methods of sanctions evasion.
The Nobitex exploit “appears to stem from a critical failure in access controls, allowing attackers to infiltrate internal systems and drain hot wallets across multiple blockchains,” according to Hakan Unal, senior security operations lead at blockchain security firm Cyvers, quoted in CoinTelegraph.
"Some of the wallets
Bitcoin - 1FuckiRGCTerroristsNoBiTEXXXaAovLX
Tron - TKFuckiRGCTerroristsNoBiTEXy2r7mNX
Dogecoin - DFuckiRGCTerroristsNoBiTEXXXWLW65t
Ethereum - 0xffffffffffffffffffffffffffffffffffffdead
Ton - UQABFuckIRGCTerroristsNOBITEX1111111111111111_jT
Solana - FuckiRGCTerroristsNoBiTEXXXXXXXXXXXXXXXXXXX
Harmony - one19fuckterr0rfuckterr0rfuckterr0rxn7kj7u
Ripple - rFuckiRGCTerroristsNoBiTEXypBrmUM"
"approximately $90 million in crypto holdings" "According to @zachxbt, around $81.7M was drained from Nobitex across Tron, EVM and BTC chains."
“Users’ assets are completely secure according to cold storage standards, and the above incident only affected a portion of the assets in hot wallets,” Nobitex said in an X post, adding that “all damages will be compensated through the insurance fund and Nobitex resources.”
A pro-Israel hacker group calling itself “Gonjeshke Darande” claimed responsibility for the Nobitex hack.
"After the IRGC’s “Bank Sepah” comes the turn of Nobitex
WARNING!
In 24 hours, we will release Nobitex's source code and internal information from their internal network.
Any assets that remain there after that point will be at risk!
The Nobitex exchange is at the heart of the regime’s efforts to finance terror worldwide, as well as being the regime’s favorite sanctions violation tool.
We, “Gonjeshke Darande”, conducted cyberattacks against Nobitex.
Nobitex doesn’t even pretend to abide by sanctions. In fact, it publicly instructs users on how to use its infrastructure to bypass sanctions.
The regime's dependence on Nobitex is evident from the fact that working at Nobitex is considered valid military service, as it is considered vital to the regime's efforts.
These cyberattacks are the result of Nobitex being a key regime tool for financing terrorism and violating sanctions. Associating with regime terror financing and sanction violation infrastructure puts your assets at risk.
Take action before it's too late!"
There is no conceivable way in which the tokens can be recovered, since they have been send to "burn" addresses. The only proposed possibility for recovery would be the centralized USDT stablecoin, which could be re-issued, however this seems unlikely.
There is concern that "the total value held in the Nobitex-labelled wallet fell over 90%, from over $1.8 billion on June 16 to $96 million as of June 18". However, it's suspected that Nobitex may have simply relocated their wallets.
However, this does not signal more losses, as Nobitex “routinely migrate their hot wallets, sometimes weekly,” explained Cyvers’ Unal, adding that this “data may not reflect the full picture accurately.”
Further Analysis
Nobitex, Iran’s largest centralized crypto exchange, suffered a major hack. Attackers—allegedly a pro-Israel hacker group called “Gonjeshke Darande”—drained approximately $81.7 million in assets from its hot wallets across multiple blockchains due to critical access control failures. The incident drew renewed scrutiny of Nobitex’s role in facilitating sanctions evasion and alleged ties to sanctioned groups like the IRGC and Hamas. Despite speculation around a sudden drop in wallet balances from $1.8 billion to $96 million, security experts noted that Nobitex routinely migrates wallets, and the data may not indicate further losses. Nobitex claimed user funds in cold storage were unaffected and promised full compensation via its insurance fund. The stolen tokens were largely sent to burn addresses, making recovery virtually impossible except potentially for centralized assets like USDT.
How Could This Have Been Prevented?
More Cryptocurrency Exchange Hacks/Scams/Frauds
ChainSaw NFT Replicandy Peplicator HEDZ ZOGZ Rug Pull > > < < Meta Pool ERC-4626 mpETH Mint Without ETH Flaw Exploited
Sources/Further Reading
SlowMist - "The Iranian crypto exchange @nobitexmarket has detected signs of unauthorized access to some of its information infrastructure and hot wallets. According to @zachxbt, around $81.7M was drained from Nobitex across Tron, EVM and BTC chains." - Twitter/X (Dec 31)
Iranian exchange Nobitex hacked for over $81M by Israel-linked hackers - CoinTelegraph (Dec 31)
ZachXBT Post On Telegram (Dec 31)
https://tronscan.org/#/address/TKFuckiRGCTerroristsNoBiTEXy2r7mNX (Dec 31)
Gonjeshke Darand - "12 hours ago 8 burn addresses burned $90M from the wallets of the regime's favorite sanctions violation tool, Nobitex." - Twitter/X (Dec 31)
Gonjeshke Darand - "After the IRGC’s “Bank Sepah” comes the turn of Nobitex WARNING! In 24 hours, we will release Nobitex's source code and internal information from their internal network. Any assets that remain there after that point will be at risk! The Nobitex exchange is at the heart of the regime’s efforts to finance terror worldwide, as well as being the regime’s favorite sanctions violation tool." - Twitter/X (Dec 31)
First Transaction Draining Bitcoin - Blockchain.com (Dec 31)
Onchain Lens - "According to (Dec 31)
@zachxbt, the Iranian exchange "Nobitex" (@nobitexmarket) was exploited for $48.65M in $USDT on #Tron Network." - Twitter/X (Dec 31)
Israel-Tied Predatory Sparrow Hackers Are Waging Cyberwar on Iran’s Financial System (Dec 31)
Israel-linked group hacks Iranian cryptocurrency exchange in $90m heist (Dec 31)
Nobitex - "Earlier today, June 18, Nobitex identified unauthorized access to parts of its infrastructure, specifically affecting our internal communication systems and a portion of our hot wallet. Immediately upon detection, all affected systems were isolated, and our internal incident response teams initiated a comprehensive investigation in accordance with industry best practices." - Twitter/X (Dec 31)
Nobitex Fourth Official Statement - Twitter/X (Dec 31)
Iranian crypto exchange Nobitex hacked for over $90 million by pro-Israel group - Elliptic.co (Dec 31)
Suspected Israeli Group Hacks Iran’s Nobitex Crypto Exchange, $82M Stolen - The Crypto Times (Dec 31)
Nobitex Logo - Wikimedia Commons (Dec 31)
Exclusive-Crypto exchange Binance helped Iranian firms trade $8 billion despite sanctions (Dec 31)
Binance helped Iranian firms trade $8B in crypto despite sanctions (Dec 31)
Exclusive-Crypto exchange Binance helped Iranian firms trade $8 billion despite sanctions (Dec 31)
Crypto exchange Binance helped Iranian firms trade $8 billion despite sanctions - Markets - Business Recorder (Dec 31)
https://en.shanbemag.com/2793-crypto-boom-in-iran-nobitex-hits-10m-users-seven-years-strong/ (Dec 31)
Nobitex and the Rise of Autonomous Finance: Leveraging AI for a Decentralized Future - Cash Platform (Dec 31)
https://www.irantalent.com/en/company/nobitex/90f98983-22a1-43c7-a86b-04151e2f8136/overview (Dec 31)
https://ideannotation.com/nobitex-exchange-intoruction/ (Dec 31)
https://www.reddit.com/r/Wallstreetsilver/comments/yteqbg (Dec 31)
https://apidocs.nobitex.ir/en// (Dec 31)
https://www.reddit.com/r/iran/comments/1gg1dty (Dec 31)
https://www.reuters.com/world/middle-east/iran-crypto-exchange-hit-by-hackers-90-million-destroyed-2025-06-18/ (Dec 31)
Current Status of Irans Local Cryptocurrency Exchanges Tens of Millions of Users And Severe Us (Dec 31)
Nobitex is first decentralized exchange built and launched in Iran (Dec 31)
https://www.wsj.com/livecoverage/israel-iran-conflict-news/card/iranian-crypto-exchange-hacked-more-than-90-million-taken-WsddW70Z3ENCr4phTBY7 (Dec 31)
Virtual currency law in Iran - Wikipedia (Dec 31)
https://www.reddit.com/r/iran/comments/1aupqhg (Dec 31)
Nobitex Twitter/X (Dec 31)
 t.me/QuadrigaInitiative
|
 /r/QuadrigaInitiative
|
 @QuadrigaInit
|
 info@quadrigainitiative.com
|