After Iranian’s largest cryptocurrency platform, Nobitex, was exploited, resulting in the loss of more than $90 million in assets spanning a range of cryptocurrencies, including Bitcoin, Ethereum, Dogecoin, Ripple, Solana, Tron, and Ton, in the aftermath, the Iranian government has since then asked crypto exchanges to limit their operational hours from 10 am to 8 pm.
The exploitation was carried out by a pro-Israel group known as Gonjeshke Darande framing the attack as a politically motivated strike against Iranian digital infrastructure. Notably, Chainalysis analysis indicates that this is the case, the attacker-controlled wallets were burner addresses lacking private key access, suggesting that the theft of more than $90 million was likely politically motivated, rather than financial in nature. While this is the first hack of this scale exclusively for geopolitical purposes, this is not the first time there’s been increased activity during windows of high geopolitical tensions between Israel and Iran, as noted in our 2024 Crypto Crime Report.
Israel is attacking the financial infrastructure of Iran, both with ATMs and crypto exchanges. Because of the sanctions, crypto exchanges like Nobitex have become the access platform for Iranians who want to access global crypto markets. Nobitex’s total inflows are well over $11 billion, compared to just under $7.5 billion for the next ten largest Iranian exchanges combined.
In the immediate aftermath of the exploit, Nobitex issued a public statement, assuring users that their funds were safe. While on-chain analysis confirms that the attacker burned the stolen funds, making them irretrievable, Nobitex has taken additional steps to reinforce user trust. Notably, the exchange has moved large quantities of Bitcoin to what appear to be newly established cold storage wallets, an effort likely aimed at bolstering its security posture and reducing exposure to similar future attacks.
Beyond Nobitex itself, the incident appears to have triggered a wider response from the Iranian regime. According to reports, the Central Bank of Iran has directed all domestic crypto exchanges to limit their operating hours to between 10 AM and 8 PM.
