
In a dramatic cyberattack that has sent shockwaves across the cryptocurrency world, Iran Crypto Exchange Nobitex was targeted by a hacker group known as Gonjeshke Darande or Predatory Sparrow, resulting in the destruction of nearly $90 million worth of crypto assets. This marks one of the most severe blows to Iran’s growing crypto infrastructure—and it’s not just about money.
Who Is Behind the Attack of Iran Crypto Exchange Nobitex ?
The attack was claimed by Predatory Sparrow, a group believed to have possible ties to Israel. Known for their sophisticated and politically charged operations, the group made headlines in 2021 when they disrupted gas stations across Iran and again in 2022 when they attacked a steel mill, triggering an industrial fire. This week, they returned with force.
Just a day before the Nobitex incident, the same group claimed responsibility for another cyberattack—this time on Iran’s state-owned Bank Sepah. The series of strikes comes amid escalating tensions and missile exchanges between Iran and Israel, hinting at deeper geopolitical undertones.
Read more on Predatory Sparrow from Reuters
Why Iran Crypto Exchange Nobitex?
Iran Crypto Exchange Nobitex is not just any platform—it’s one of Iran’s largest crypto exchanges. For years, it has operated in a space already shadowed by international sanctions and allegations of misuse. According to various reports and investigations, including a 2022 exposé by Reuters, Nobitex has allegedly facilitated transactions that help Iran’s government circumvent sanctions and even fund groups hostile to Israel, such as Hamas and the Houthis.
That background may explain why the hackers made it their latest target. Their statement accused Nobitex of enabling the Iranian regime’s “illicit global operations.”
What Happened During the Attack?
The cyberattack on Iran Crypto Exchange Nobitex was not just a typical crypto heist—it was a calculated act of digital sabotage. Early Wednesday morning, the hacker group Predatory Sparrow infiltrated Nobitex’s systems and swiftly transferred around $90 million worth of cryptocurrencies into wallets they controlled. However, these weren’t ordinary wallets. According to TRM Labs and Elliptic, the hackers created “burn wallets”—addresses with no private keys—making the assets permanently inaccessible to anyone. This bold move ensured that the money was effectively destroyed, not stolen. The attack was likely a political statement, targeting Nobitex’s alleged ties to Iran’s Islamic Revolutionary Guard Corps (IRGC). The sequence unfolded rapidly:
- Early morning: Hackers accessed the system.
- Within hours: Funds moved to burn wallets.
- Midday: Nobitex took down its website and app.
- Aftermath: $90 million lost forever.
This operation, unprecedented in its intent and execution, transformed cryptocurrency into a tool of geopolitical warfare.
Elliptic’s official blog post on the hack
Nobitex Goes Dark
After the cyberattack, Iran Crypto Exchange Nobitex reacted by immediately shutting down its website and mobile app. This move was likely a precaution to prevent further damage and investigate the breach without exposing more data or assets.
In a brief post on X (formerly Twitter), the platform admitted there was “unauthorised access” to its systems, meaning hackers managed to infiltrate their infrastructure. However, beyond that statement, Nobitex has gone silent.
Attempts by users and journalists to contact Nobitex through Telegram or other support channels have failed. This lack of communication has led to growing anxiety among users, many of whom are now unsure if their funds or data are safe. The silence has also sparked speculation—with some wondering whether Nobitex is downplaying the full impact of the attack or struggling to recover its systems.
International Reaction
This attack didn’t just stir the crypto community—it caught the attention of global policymakers. U.S. Senators Elizabeth Warren and Angus King had previously expressed concerns about Iran Crypto Exchange Nobitex in a letter to the Biden administration in May 2024. They cited evidence that the platform was being used to facilitate sanctions evasion.
Chainalysis, another top blockchain intelligence firm, confirmed that the destroyed funds were indeed worth approximately $90 million and linked the event to Iran’s Islamic Revolutionary Guard Corps (IRGC). Their head of national security intelligence, Andrew Fierman, stated that the exchange has been a known tool for IRGC-affiliated actors to launder funds.
What This Means Going Forward
The attack on Iran Crypto Exchange Nobitex is more than a cybercrime—it’s a warning. It reveals the fragility of digital infrastructure when it’s tied to state politics and proxy wars. While the Iranian government may not formally acknowledge its links to Nobitex, this event lays bare the risks of using crypto to bypass international norms.
And for the average Nobitex user? It’s a stark reminder that trust, once lost in the crypto world, is hard to regain—especially when platforms double as political tools.
Final Thoughts
The recent attack on Iran Crypto Exchange Nobitex highlights the stark reality of today’s digital financial landscape—where cryptocurrency is no longer just a tool for investment, but a player in global power struggles. For everyday users, this incident is a wake-up call about the vulnerabilities tied to politically connected platforms. When national interests intersect with digital assets, even secure exchanges can become targets of cyber warfare. The destruction of $90 million wasn’t about theft—it was a statement. As crypto adoption grows, users must demand greater transparency, regulatory clarity, and operational integrity to protect both their assets and trust.