A cyberattack on Iran’s largest crypto exchange, Nobitex, has made headlines after a pro-Israel hacking group “Gonjeshke Darande” (Predatory Sparrow) claimed responsibility for stealing and permanently destroying over $90 million worth of crypto assets.
Hackers Burn Funds Using Irreversible Addresses
In a post shared on June 18 via X (formerly Twitter), the group announced it had sent the stolen funds to “vanity addresses” — wallets created without access to a private key, making the digital assets irrecoverable forever.
Blockchain analysts have since confirmed that the hacked Bitcoin, Ethereum, Dogecoin, and other tokens were not sold or moved to mixers, but instead burned intentionally. Some of the wallets used in the burn even contained messages like “FuckIRGCTerroristsNoBiTEX,” aimed at Iran’s Islamic Revolutionary Guard Corps (IRGC).
One Bitcoin address involved was found to have an invalid checksum, rendering it provably unspendable. On Ethereum, some of the stolen tokens were sent to the 0x…dead wallet, a common method used to remove tokens from circulation permanently.
Political Motivation Behind the Attack
This breach appears to be part of the ongoing cyber and military conflict between Iran and Israel. The hackers claim Nobitex helped the Iranian regime evade international sanctions and finance terrorism, making it a target. The attack comes just days after Israeli airstrikes hit Tehran’s nuclear sites, escalating tensions between the two nations.
With over 11 million users, Nobitex is Iran’s most prominent crypto platform. In response to the incident, the exchange confirmed that it had detected unauthorized access to its hot wallets, which are used for real-time transactions. The company stated that user funds stored in cold wallets remain safe, and that it has activated an insurance fund to cover any affected customers.
Hackers Threaten Further Exposure
The attackers have also threatened to leak Nobitex’s source code and internal infrastructure if users don’t withdraw their assets immediately. Nobitex urged calm, assuring users that it had already emptied its remaining hot wallets as a precaution.
A New Kind of Cyberwarfare?
What makes this attack different is that it wasn’t financially motivated. Instead, the destruction of over $90 million worth of digital assets appears to be an act of political sabotage — marking a troubling trend where nation-state conflicts spill into the crypto world.
Cybersecurity experts warn that as crypto continues to gain mainstream use, blockchain infrastructure could become a soft target in geopolitical conflicts, making platform security more important than ever.
