Iran Crypto Exchange Hack: Millions Stolen and Destroyed

Nobitex Crypto Exchange Suffers Major Hack

Nobitex, Iran’s leading cryptocurrency exchange, announced on Wednesday that it experienced a security breach resulting in the unauthorized removal of funds from its hot wallet.

Details of the Security Incident

According to a statement published on the exchange’s website and reported by TechCrunch, Nobitex identified unauthorized access to its systems and the hot wallet used to hold a segment of customer cryptocurrency holdings. A thorough investigation into the incident is currently underway.

The company has temporarily suspended access to both its website and mobile application while the security review is being conducted.

Financial Impact and Fund Tracing

Blockchain data indicates that the perpetrators successfully stole at least $90 million in assets through a series of transactions.

Elliptic, a blockchain analysis firm, reports that the stolen cryptocurrency was subsequently “burned” – transferred to wallets where it is permanently inaccessible, effectively removing it from circulation.

Nobitex Customer Base and Hacker Claims

Archived versions of Nobitex’s website reveal the exchange serves a substantial user base, exceeding 10 million customers.

The pro-Israel hacking collective, Predatory Sparrow (known as “Gonjeshke Darande” in Farsi), has claimed responsibility for the attack.

In a post on X, the group stated that Nobitex was targeted due to alleged involvement in financing terrorism supporting the Iranian government and circumventing international sanctions.

Related Cyberattacks on Iranian Institutions

Just prior to the Nobitex hack, Predatory Sparrow also asserted responsibility for a cyberattack on Bank Sepah, an Iranian financial institution.

This attack caused significant disruptions to ATM services throughout the country.

Geopolitical Context

These cyberattacks occur amidst escalating tensions and direct attacks between Israel and Iran. The origins of Predatory Sparrow remain unclear, with the group first appearing in 2021.

However, its past actions demonstrate a pattern of destructive cyberattacks targeting Iranian organizations, and its activities generally align with Israeli interests.