Iran's Nobitex Crypto Exchange Faces Major Hack: A Detailed Examination

By: Eliza Bennet

The Iranian cryptocurrency exchange Nobitex has recently faced a significant security incident, resulting in a substantial financial loss. Sources indicate that the platform was attacked, leading to the theft of over $48 million, primarily in Tether’s USDT, stolen through the Tron network. Despite the severity of the breach, Nobitex has assured that customer funds held in its cold wallets remain secure, and they have made commitments to compensate all affected parties through its insurance fund and own resources.

The confirmation of this attack came through an announcement on social media platform X, wherein Nobitex revealed that unauthorized access was detected within a portion of its reporting infrastructure and hot wallet. The immediate response involved suspending all access to prevent further damage and a comprehensive internal investigation to assess the full extent of the breach. The company's website and app are currently disabled as part of its ongoing investigation efforts.

Allegations of Geopolitical Involvement

An additional layer of complexity has been introduced with a group named Gonjeshke Darande, or “Predatory Sparrow” claiming responsibility for the hack. This group, described as potentially Israel-linked in various reports, has accused Nobitex of facilitating Iran’s military operations and breaching global sanctions. The group further alleged that Nobitex is integral to Iran’s defense infrastructure, suggesting that employment at the exchange is tantamount to military service under Iranian law.

In a threatening message, the same group claimed they would release Nobitex's source code and other sensitive internal data. They warned Nobitex users that their funds might be compromised if immediate action wasn’t taken against the exchange. Predatory Sparrow has a history of cyberattacks targeting Iranian institutions, notably targeting Bank Sepah on similar grounds.

Reports also surfaced suggesting that the attackers utilized a “vanity address” to facilitate the theft, resulting in suspicious and rapid outflows from multiple Nobitex wallets on both the Tron network and other Ethereum Virtual Machine (EVM)-compatible blockchains. Although the total estimated compromised funds amount to over $73 million, verification issues have left some of these figures unconfirmed.

This security breach emerges amid escalating tensions between Israel and Iran, with accusations and military confrontations frequently occurring between the two nations. The geopolitical backdrop adds a complex dimension to the cyberattack's implications, as it may potentially be more than just a financially motivated hacking incident.