Iranian Crypto Exchange Nobitex Hacked for Over $48M by Suspected Israeli Group
The anti-Iran group targeted state-owned Bank Sepah a day prior, and now threatens to leak Nobitex’s source code, calling the platform a "terror-financing tool" used to bypass sanctions.
Iranian crypto exchange Nobitex has been hacked for over $48 million by Israeli-linked hacking group Gonjeshke Darande — or Predatory Sparrow — claiming responsibility as attackers.
The group said in an X post: “After Bank Sepah, it was Nobitex's turn,” referencing their Tuesday cyberattack on Iran’s state-owned lender. They warned that Nobitex’s internal data and source code would be released within a day, and any assets left on the exchange would be “at risk.”
On-chain sleuth ZachXBT first flagged suspicious outflows totaling $48.65 million in Tron's TRX tokens in his Telegram channel on Wednesday.
The stolen funds were traced to a wallet using a provocative vanity address: TKFuckiRGCTerroristsNoBiTEXy2r7mNX.
The group called Nobitex a “core part of the regime’s terror financing network,” accusing it of helping Iran evade international sanctions by enabling crypto-based payments.
Nobitex, Iran’s largest exchange, confirmed the attack in an X post but did not mention or confirm stolen funds.
At the time of writing, it is unclear what attack method was used by Gonjeshke Darande to conduct the exploit.
The hack comes amid a flurry of cyber and physical attacks between Iran and Israel.
Gonjeshke Darande, believed by cybersecurity analysts to have ties to Israeli intelligence, has previously claimed responsibility for coordinated infrastructure attacks on Iranian steel factories and gas stations.
With the source code leak looming, Nobitex now faces not only financial loss but a full-blown credibility crisis — and users who haven’t yet moved funds may stand to lose everything, per the hacking group’s followup threats.
