On June 18, 2025, Nobitex, Iran’s largest cryptocurrency exchange, was hit by a major cyberattack that resulted in the theft of more than $81 million in digital assets. A pro-Israel hacker group called Gonjeshke Darande, or “Predatory Sparrow,” claimed responsibility. They said the attack was meant as a political statement against Iran’s government and its alleged use of Nobitex to fund terrorism and avoid sanctions.
The hackers took advantage of weaknesses in Nobitex’s “hot wallets,” which are digital wallets connected to the internet used for active transactions. They stole cryptocurrencies including Bitcoin, Dogecoin, and over 100 other tokens across several blockchains such as Tron and Ethereum.
Instead of trying to cash out, the hackers sent the stolen funds to special “vanity addresses” with insulting messages targeting Iran’s Islamic Revolutionary Guard Corps (IRGC). This action effectively destroyed the stolen assets, removing them from circulation as a symbolic protest.
Nobitex confirmed the breach and immediately took down its website and app to stop further damage. The company said that assets kept in “cold storage” — offline wallets not connected to the internet — were safe. Nobitex also promised to cover all losses through insurance and its own funds. Still, the hack caused major disruption and the exchange remains offline as investigations continue.
Cybersecurity experts found that the attack likely started when malware infected the devices of key Nobitex employees. This malware stole their login details, allowing hackers to enter the company’s systems and steal funds.
This cyberattack is part of rising digital conflicts between Israel and Iran. Predatory Sparrow has targeted Iranian institutions before, including a recent hack on Iran’s Bank Sepah that disrupted ATM services. The group’s actions show how modern warfare increasingly includes online attacks on financial systems.
With more than 10 million users, Nobitex is a key player in Iran’s cryptocurrency market. This breach is one of the largest crypto thefts tied to political conflict in 2025 and highlights the risks faced by exchanges operating in sensitive regions.
In summary, the Nobitex hack is a politically charged cyberattack that caused the loss and destruction of over $81 million in cryptocurrencies and has left Iran’s biggest crypto exchange facing serious operational challenges.
