cpeditor
Israel-Linked Hackers Steal $90M From Iran’s Nobitex Exchange, Threaten Source Code Leak
Iranian crypto exchange Nobitex has fallen victim to a $90 million cyberattack carried out by Gonjeshke Darande—a hacking collective believed to be tied to Israeli interests—according to blockchain security firm Elliptic.
In a statement posted on X, Gonjeshke Darande declared: “After Bank Sepah, it was Nobitex’s turn,” referencing their prior attack on Iran’s state-owned Bank Sepah just one day earlier. The group threatened to release Nobitex’s internal data and source code within 24 hours and warned that any remaining assets on the platform could be in jeopardy.
Early signs of the hack surfaced when blockchain investigator ZachXBT flagged suspicious outflows totaling $81.7 million in various cryptocurrencies, including Tron’s TRX, bitcoin (BTC), and dogecoin (DOGE). Those stolen funds were transferred to a wallet boasting the provocative vanity address “TKFuckiRGCTerroristsNoBiTEXy2r7mNX.”
Elliptic later revised the stolen sum to over $82 million, spread across Bitcoin, Dogecoin, and EVM-compatible chains. Funds were siphoned from addresses sporting similarly charged vanity names such as:
0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead1FuckiRGCTerroristsNoBiTEXXXaAovLXDFuckiRGCTerroristsNoBiTEXXXWLW65t
The attackers labeled Nobitex as a “core part of the regime’s terror financing network,” accusing it of helping Iran skirt international sanctions through crypto-based payments.
Nobitex, Iran’s largest cryptocurrency exchange, acknowledged the attack in a brief post on X but stopped short of confirming the amount stolen.
Political Motives, Not Financial Gain
Despite the massive sums involved, Elliptic believes financial gain was not the attackers’ primary motivation. The stolen crypto was sent to vanity addresses containing explicit anti-Nobitex messages—addresses that were likely created through brute-force methods requiring immense computing power.
“Creating vanity addresses with strings as long as those seen in this hack is computationally impractical,” Elliptic explained. “It suggests that Gonjeshke Darande does not possess the private keys to those wallets. In essence, they have permanently burned the funds as a political statement.”
At the time of writing, the precise method Gonjeshke Darande used to infiltrate Nobitex remains unknown.
The attack underscores the ongoing digital and physical hostilities between Iran and Israel. Gonjeshke Darande, known in English as Predatory Sparrow, has previously claimed credit for sophisticated cyber operations targeting Iranian steel plants and gas stations.
Now, with the looming threat of a source code leak, Nobitex faces not only substantial financial fallout but a significant crisis of confidence among its users. Those who have not yet withdrawn funds may still be at risk, as the hacking group has continued issuing ominous warnings about further action.
