Report: Israel-Linked Hackers Raid Iranian Crypto Exchange Nobitex

Iran-based cryptocurrency exchange Nobitex has reportedly suffered a major security breach, resulting in the theft of over $81 million in digital assets by a hacker group claiming ties to Israel.

CoinTelegraph reports that the Iranian cryptocurrency exchange Nobitex has fallen victim to a devastating hack, resulting in the loss of more than $81 million in digital assets. The attack, disclosed in a Telegram post on Wednesday, drained funds across the Tron network and Ethereum Virtual Machine (EVM)-compatible blockchains.

According to noted crypto investigator ZachXBT, the attackers exploited the protocol using “vanity addresses,” which led to suspicious outflows from multiple Nobitex-linked wallets. Nobitex confirmed the unauthorized access to a portion of its internet-accessible “hot wallets” and immediately suspended them upon detection. The exchange assured users that their assets are secure in cold storage and that the incident only affected a portion of the assets in hot wallets. Nobitex pledged to compensate all damages through its insurance fund and own resources.

A pro-Israel hacker group called “Gonjeshke Darande” has claimed responsibility for the Nobitex hack. The group threatened to release the exchange’s source code and internal files within 24 hours, warning that any remaining assets on the platform would be at risk. They accused Nobitex of being at the heart of the Iranian regime’s efforts to finance terror worldwide and violate sanctions.

Yehor Rudytsia, a security researcher at blockchain security firm Hacken, noted that the stolen assets across more than 20 tokens on EVM were sent to clean burner addresses, making recovery unlikely. However, there is a potential for partial recovery if USDT reissues the $55 million worth of stolen stablecoins.

The Nobitex hack is the latest in a growing list of crypto industry breaches, with more than $2.1 billion in digital assets stolen so far this year, according to blockchain security firm CertiK. The majority of these losses are attributed to wallet compromises, key mismanagement, and operational issues, rather than more serious protocol-level hacks.