Iranian Crypto Exchange Nobitex Breached in $81M Hack Tied to Israel-Linked Group

Iranian Crypto Exchange Nobitex Breached in $81M Hack Tied to Israel-Linked Group

Attack Drains Millions in Digital Assets as Hackers Send Political Message

Iranian cryptocurrency exchange Nobitex has been hacked for over $81.7 million, marking one of the most significant crypto breaches of 2025. The attackers, allegedly linked to a pro-Israel group, exploited multiple hot wallets on the Ethereum Virtual Machine (EVM) and Tron blockchains.

Blockchain investigator ZachXBT first revealed the breach, citing the use of suspicious vanity wallet addresses, including one bearing the provocative label: “TKFuckiRGCTerroristsNoBiTEXy2r7mNX.” These personalized addresses helped funnel millions in crypto from Nobitex wallets.

Nobitex confirmed the breach, stating that the attack was isolated to hot wallets and that all affected funds would be fully reimbursed through its insurance fund and internal reserves. “Users’ assets are completely secure,” the exchange said in a public post, assuring that its cold storage systems remain uncompromised.

Hackers Claim Intent Was Political

The group “Gonjeshke Darande,” which claims to be a pro-Israel hacker collective, took responsibility. In a statement, the group accused Nobitex of acting as a financial arm of the Iranian regime, stating:

“The Nobitex exchange is at the heart of the regime’s efforts to finance terror worldwide.”

They also threatened to release the platform’s internal source code and documents within 24 hours, warning users to withdraw assets immediately.

$2.1 Billion in Crypto Stolen in 2025 Alone

The Nobitex hack is part of a broader trend in 2025, where more than $2.1 billion worth of crypto has been stolen to date, according to blockchain security firm CertiK. Co-founder Ronghui Gu noted that this year’s breaches are increasingly caused by wallet compromises, key mismanagement, and social engineering attacks.

Security firm Cyvers indicated the Nobitex breach stemmed from a critical failure in internal access controls, which allowed the attackers to drain funds across over 20 tokens. Surprisingly, the stolen assets have not yet been moved, raising hopes for partial recovery.

Security analyst Yehor Rudytsia of Hacken said the breach looked more like a political cyberattack than a theft motivated by profit. A large portion of the stolen assets was reportedly sent to burner wallets, making recovery difficult. Rudytsia added that only $55 million in USDT might be reissued by Tether.

Exchange Wallet Balance Plummets

Nobitex’s wallet balances dropped dramatically, from over $1.8 billion on June 16 to just $96 million by June 18, according to data from Arkham Intelligence.

However, Cyvers noted this drop may not indicate further losses. Nobitex is known to routinely migrate hot wallets, sometimes weekly, meaning the figures may not reflect the true status of reserves.

The hack comes amid rising geopolitical tensions, with Israel and Iran exchanging missile strikes that have claimed at least 248 lives in recent days. The cyberattack on Nobitex may represent a new frontier in digital warfare, as crypto infrastructure becomes a target in global conflict.