Over $90 Million Stolen from Iran’s Nobitex Exchange Destroyed by Hacker Group
By Leon Okwatch
June 19, 2025
In a dramatic turn of events, the pro-Israel hacker group known as Gonjeshke Darande has reportedly destroyed over $90 million worth of digital assets stolen from Nobitex, Iran’s largest cryptocurrency exchange. This significant breach was announced on June 18, following an earlier exploit that allowed attackers to drain a range of cryptocurrencies, including Bitcoin (BTC), Ethereum (ETH), and Dogecoin (DOGE), from Nobitex’s hot wallets.
Details of the Cyber Attack
The hacker group disclosed that the funds were burned using multiple "vanity addresses" that do not contain recoverable private keys, rendering the assets permanently inaccessible. This bold action came as a direct response to Nobitex’s alleged involvement in enabling the Iranian regime to bypass economic sanctions and fund terrorism.
In their announcement on social media platform X, Gonjeshke Darande emphasized their motives, stating: “12 hours ago, 8 burn addresses burned $90M from the wallets of the regime’s favorite sanctions violation tool, Nobitex." As part of their threat to further expose the exchange’s vulnerabilities, they hinted at plans to release the source code and other internal data from Nobitex.
Ongoing Cyber and Military Tensions
The attack on Nobitex occurs amid rising military and cyber tensions between Iran and Israel, heightened by recent Israeli airstrikes on Iran’s nuclear facilities. The hack illustrates a concerning trend where financial technologies and cryptocurrency infrastructures are increasingly becoming battlegrounds in state conflicts.
Blockchain security firms, including Chainalysis, confirmed that the stolen funds had not been transferred to mixers or exchanged but were instead sent to unspendable addresses with incendiary labels aimed at Iran’s Islamic Revolutionary Guard Corps. This targeted messaging is indicative of the attack’s political nature, as some addresses were explicitly named to denounce the Iranian regime.
During the high-profile exploit, attackers drained an impressive $90 million from Nobitex’s resources, exacerbating the situation for the cryptocurrency platform, which boasts over 11 million users.
Nobitex’s Response and User Assurances
In the aftermath of the incident, Nobitex has reassured its users by stating that all assets are secure within cold storage and that the situation is now under control. The exchange stressed that customer funds remain protected by a reserve fund and insurance pool, despite the hack’s implications.
“We would like to inform our users that the situation is now under control. All external access to our servers has been completely severed," Nobitex stated in a press release.
Conclusion
The destruction of over $90 million in digital assets by Gonjeshke Darande not only highlights the vulnerability of cryptocurrency exchanges but also underscores the connection between cyber operations and geopolitical conflicts. As crypto assets continue to gain prominence, the intersection of politics and technology remains a focal point of concern showing how digital currencies can be wielded as weapons in state-level disputes.
As governments and cyber entities navigate this evolving landscape, the incident at Nobitex serves as a stark reminder of the potential consequences when national interest intertwines with emerging financial infrastructures.