Iran’s largest cryptocurrency exchange, Nobitex, confirmed Wednesday it suffered a cyberattack resulting in the theft of millions of dollars worth of digital assets from its hot wallet.
In an official statement issued on its website, Nobitex acknowledged unauthorized access to its technical infrastructure and confirmed that significant digital assets had been drained from the hot wallet, which holds a portion of its customers’ cryptocurrencies. The company is currently conducting a thorough investigation into the security breach and has suspended access to its website and app until further notice.
Blockchain analysis revealed that attackers transferred approximately $90 million in cryptocurrencies out of Nobitex through multiple transactions. According to security experts at Elliptic, the hackers subsequently “burned” these funds by sending them to wallets with no means of recovery, effectively removing the stolen assets from circulation permanently.
Nobitex, a widely used platform in Iran boasting over ten million users, has become the latest focal point of escalating digital attacks against Iranian economic and government institutions amid rising geopolitical tensions. Responsibility for this attack has been claimed by the pro-Israel hacking organization known as Predatory Sparrow, or “Gonjeshke Darande” in Farsi.
In a public post, Predatory Sparrow accused Nobitex of knowingly facilitating terrorism funding and helping Iran evade international sanctions. This incident closely follows another claimed attack by the same hacking group against Iran’s Bank Sepah, the nation’s oldest banking institution, causing widespread outages that reportedly disrupted ATM services across the country.
The cyberattacks emerge amid an intensifying military and cyber escalation between Iran and Israel. Iranian state media agency IRIB recently reported a significant increase in cyberattacks attributed to Israel targeting the country’s critical infrastructure, alleging attempts by the adversary to disrupt everyday life by undermining public services.
Predatory Sparrow, whose members remain unidentified, first surfaced in 2021. The group has repeatedly launched destructive attacks against Iranian governmental and private sector entities and appears closely aligned with Israeli geopolitical interests.
