Hackers with alleged ties to Israel have stolen more than $90 million from Nobitex, Iran’s largest cryptocurrency exchange, according to blockchain analytics firms.
The group responsible, Gonjeshke Darande (“Predatory Sparrow” in Farsi), leaked what they claim is Nobitex’s full source code and warned that all remaining assets are exposed. The stolen funds were moved to cryptocurrency addresses containing messages critical of Iran’s Revolutionary Guard, suggesting the attack was politically motivated rather than financially driven.
Blockchain firm Elliptic noted the hackers likely ‘burned’ the funds by transferring them to inaccessible wallets, sending a message to Nobitex. The group accused Nobitex of aiding Iran in evading Western sanctions and funding militant groups.
Nobitex acknowledged the breach, taking its app and website offline to investigate unauthorized access.
The theft included various cryptocurrencies such as Bitcoin, Ethereum, and Dogecoin. Andrew Fierman, head of national security intelligence at Chainalysis, highlighted the attack’s severity given Iran’s relatively small crypto market.
This incident aligns with escalating Israel-Iran tensions following Israeli strikes on Iranian nuclear and military sites, which were met with missile responses from Tehran. Gonjeshke Darande also claimed responsibility for a recent cyberattack on Iran’s state-controlled Bank Sepah.
Elliptic reported connections between Nobitex and relatives of Iran’s Supreme Leader Ali Khamenei, as well as sanctioned Revolutionary Guard operatives. The exchange reportedly transacted with wallets linked to Iranian allies such as Yemen’s Houthis and Hamas.
Gonjeshke Darande has a history of cyberattacks targeting Iran, including disruptions at gas stations in 2021 and a 2022 attack on a steel mill.
While Israeli media associate the group with Israel, its government has not confirmed any involvement.
U.S. Senators Elizabeth Warren and Angus King have previously expressed concerns about Iran’s use of cryptocurrencies to circumvent sanctions.