Security Breach at Iranian Cryptocurrency Exchange Nobitex
Nobitex, a cryptocurrency exchange based in Iran, has reportedly experienced a significant security breach, leading to the theft of over $81 million in digital assets. A group of hackers, claiming to have connections to Israel, has taken responsibility for this attack.
The incident, revealed in a Telegram post on Wednesday, affected funds across the Tron Network and Ethereum Virtual Machine (EVM) blockchains. According to crypto investigator ZachxBT, the hackers utilized a “Vanity address,” which allowed them to exploit vulnerabilities linked to several wallets associated with Nobitex. The exchange confirmed that unauthorized access was detected in some of its hot wallets—those connected to the internet—and halted operations once the breach was identified. They reassured users that their cold storage assets remained secure and that only certain assets in the hot wallets were affected. Nobitex has pledged to cover all losses using funds from its insurance and other resources.
The group behind the hack, identified as “Gonjeshke Darande,” has threatened to release the exchange’s source code and internal files within a day. They warned that any remaining assets on the platform could be compromised, claiming that Nobitex plays a role in facilitating the Iranian regime’s support for terrorism and violation of sanctions.
Yehor Rudytsia, a security researcher from Hacken, observed that the stolen assets had been transmitted to clean burner addresses across more than 20 tokens on EVMs, which significantly diminishes the chances of recovery. However, he noted a potential for partial recovery if USDT reissues stolen stablecoins valued at $55 million.
Blockchain security firm Certik has pointed out that Nobitex’s breach is just one among many in the crypto industry, with more than $2.1 billion in digital assets stolen this year. Most losses have been attributed to wallet breaches, management errors, and operational issues rather than serious protocol-level attacks.
