Iranian Exchange Nobitex Restarts After Bitcoin, Dogecoin and Tron Swiped in $90M Hack

Iranian crypto exchange Nobitex is slowly restarting its services following a $90 million hack from a pro-Israel group earlier this month. One expert said that civilians were severely affected despite the attackers claiming they only wanted to target the Iranian government.

On Sunday, the exchange said via a post on X that verified users would soon regain access to their accounts and be able to view their Nobitex wallet balance, while most other features remain disabled. The next step is to resume withdrawal, deposit, and trading services for those same users.

Nobitex was drained for more than $90 million in digital assets in mid-June due to an attack from the pro-Israel hacking group Gonjeshke Darande, which means “Predatory Sparrow“ in Persian. Following the attack, Nobitex suspended users from accessing their accounts and claimed that all user funds would be restored.

The swiped funds included $49.3 million on Tron, $24.3 million across Ethereum-linked chains, $6.7 million in Dogecoin, and $2 million in Bitcoin, per data from blockchain security firm Cyvers.

The attackers of the exchange used wallet addresses that sent political messages, such as one address called “TKFuckiRGCTerroristsNoBiTEXy2r7mNX” referencing the Islamic Revolutionary Guard Corps, aka the IRGC, a branch of the Iranian armed forces.

Rajat Ahlawat, APAC research lead at compliance firm Crystal Intelligence, told Decrypt that it is likely that the IRGC has been using the exchange, but it is also likely not the only place the group can access cryptocurrency.

“Nobitex is the largest centralized exchange in Iran; in many ways, [it is] as common a household name among crypto users as Binance or Coinbase may be in other countries,” Ahlawat said. “Whilst Gonjeshke Darande stated the intended target was the IRGC, and not the people of Iran, the reality is that many normal people were affected by this action.”

The attack came the day after Bank Sepah, one of the country’s largest banks, was also hacked by the same group, which prevented a large number of Iranian civilians from being paid on payday. Gonjeshke Darande is believed to be connected to the Israeli government due to their “state-like capabilities,” Ahlawat explained, although there has been no official confirmation of this link.

“As a result of Gonjeshke Darande’s other actions against Bank Sepah, many people were not paid salaries and could not use ATMs or debit cards,” Ahlawat told Decrypt. “Cryptocurrency, particularly stablecoins, are often kept as a hedge against inflation [in Iran]. So after Nobitex was hacked, there were a lot of people on Twitter talking that they don’t have access to any money at that point.”

Iran has high levels of crypto literacy, as the government and general population look to cryptocurrencies as a way to avoid global sanctions and hedge against the nation’s severe inflation. As a result, Nobitex claims more than seven million users, which is approximately 7.6% of the entire Iranian population. 

“I think the Nobitex hack was also meant to sow discontent among the population,” Ahlawat explained. “But rather, what happened actually on the ground was that people are like, ‘Oh, another country is attacking my country.’ So instead of the anti-regime sentiment, the pro-nationalism sentiment took over.”

Predictors on Myriad Markets believe there is a 79% likelihood that Iranian Supreme Leader Ali Khamenei will remain in power by the end of September, despite tensions with Israel and the United States. Users on the platform also think there is a 44% chance that a nuclear deal between the U.S. and Iran will be reached by the end of the year.

Fortunately for Iranians, the biggest crypto exchange in the country is slowly resuming its operations, which is crucial for so many civilians attempting to avoid the country’s inflation of 38.7%.

Edited by Andrew Hayward