Iran’s largest crypto exchange, Nobitex, has reportedly fallen victim to a sophisticated cyberattack, resulting in the theft of nearly $90 million in digital assets. The hack is attributed to the group Gonjeshke Darande (“Predatory Sparrow”), known for previous cyber offensives against Iranian targets.
The attack, carried out during the early morning hours, hit multiple blockchain networks including Bitcoin, Ethereum, and TRON. While early estimates put the losses at $73 million, blockchain analysts from firms like Elliptic and TRM Labs now place the figure between $90 and $100 million.
Read more: Jerusalem Faces Missile Threat Amid Overnight Iran-Israel Strikes
Hackers embedded anti-Iran slogans like “F\ckIRGCterrorists” into public wallet keys—a rare, technically advanced tactic suggesting involvement by a well-resourced and skilled group.
Analysts suggest that the attackers might not even possess the private keys, meaning the stolen assets could be permanently locked. This points to the cyberattack being more of a political message than an attempt at financial theft, aimed at embarrassing Tehran and disrupting its crypto-financial networks.
Nobitex, which serves over 7 million users, has faced allegations of facilitating crypto transactions for entities linked to the IRGC, Hamas, Houthis, and Palestinian Islamic Jihad—potentially making it a deliberate target in the geopolitical struggle.
Following the breach, Nobitex’s operations were disrupted, and its website was briefly taken offline. Iranian authorities reportedly responded by tightening internet controls across parts of the country, labeling the incident as “foreign-led digital aggression” and citing national security concerns.
