Pro-Israel Hacker Group Claims Responsibility for Iran’s Nobitex $49M Cyberattack

Iranian cryptocurrency exchange Nobitex has suffered a security breach that led to the unauthorized transfer of approximately $48.65 million worth of crypto assets on the Tron network, according to on-chain sleuth ZachXBT.

The exchange confirmed that a portion of its hot wallets and reporting infrastructure had been compromised.

Nobitex Hacked

In an official statement, Nobitex said all access was promptly suspended and assured users that the incident had not impacted customer assets held in cold storage. The exchange also pledged full compensation through its insurance fund and internal reserves.

The pro-Israel hacker group Gonjeshke Darande (Persian for “Predatory Sparrow”) has claimed responsibility for the cyberattack and issued a stark warning in a graphic posted to social media. The message accuses Nobitex of being “at the heart of the regime’s efforts to finance terror worldwide” and functioning as Iran’s favored mechanism for circumventing international sanctions.

The hackers even threatened to release the platform’s source code and internal data within 24 hours, which has put all remaining assets on the platform at risk.

“The regime’s dependence on Nobitex is evident from the fact that working at Nobitex is considered valid military service, as it is considered vital to the regime’s efforts. These cyberattacks are the result of Nobitex being a key regime tool for financing terrorism and violating sanctions. Associating with regime terror financing and sanction violation infrastructure puts your assets at risk.”

The breach coincides with day six of escalating Iran-Israel tensions, as both sides intensify the attacks.

Nobitex Linked to 85% of Crypto Inflows to Sanctioned Entities

Earlier this year, blockchain intelligence firm TRM Labs highlighted Nobitex’s central role in global illicit finance flows. TRM’s March report revealed that, in 2024 alone, Nobitex and the now-defunct Russian exchange Garantex facilitated over 85% of crypto inflows to sanctioned entities and jurisdictions.

Although not under international sanctions, Nobitex has functioned as a key link in transferring funds between Iran and high-risk Russian exchanges, often facilitating cross-border transactions that bypass traditional financial controls.