Iranian cryptocurrency exchange Nobitex has been hacked, causing losses of nearly $82 million. The Gonjeshke Darande group, which is linked to Israel, has claimed responsibility for the hack.
Iranian cryptocurrency exchange Nobitex has been hacked, causing losses of nearly $82 million. The Gonjeshke Darande group, which is linked to Israel, has claimed responsibility for the hack.
According to researcher ZachXBT, $81.7 million worth of digital assets were stolen from Nobitex on the Tron network and Ethereum Virtual Machine (EVM)-compatible blockchains, Coin Telegraph reports.
ZachXBT discovered that attackers were using a vanity address (a shortened web address adapted for a specific brand) to exploit the protocol, which led to «suspicious outflows» from several wallets associated with Nobitex.
The first $49 million was stolen through the address «TKFuckiRGCTerroristsNoBiTEXy2r7mNX». The second address looked like «0xffFFfFFffFFffFfFffFFFFFfFFFFFFFFDead».
Nobitex confirmed that some of the hot wallets showed signs of «unauthorized access» and were immediately «suspended» upon detection.
«User assets are fully protected according to cold storage standards, and the above incident only affected a portion of the assets in hot wallets,» Nobitex noted in a post on X, adding that «all losses will be compensated by the insurance fund and Nobitex resources».
Cryptocurrency exchange platform Nobitex was founded in 2017. It currently supports over 50 coins and tokens such as Bitcoin, Ethereum, Litecoin, and USDT, in conjunction with IRR.
Gonjeshke Darande said that «after Bank Sepah, it’s Nobitex’s turn,» referring to its cyberattack on Iran’s state-owned bank on Tuesday. The hackers warned that Nobitex’s internal data and source code would be made public within 24 hours, and any assets remaining on the exchange would be «at risk».
The group called Nobitex «the backbone of the regime’s terrorist financing network» and accused it of helping Iran evade international sanctions through cryptocurrency payments.
In 2022, Gonjeshke Darande claimed responsibility for a cyberattack on an Iranian steel plant. The sophisticated attack caused a large fire at the plant, causing significant damage. According to security experts, such attacks are usually beyond the capabilities of activist hackers and are more in line with state-level capabilities.
Cybersecurity researchers have also publicly linked the group to a 2021 cyberattack that caused widespread disruptions at gas stations across Iran. Israel has never officially acknowledged being behind the group, although Israeli media has frequently reported its ties to the state.
Recall that last week, Israel launched a large-scale attack on Iranian nuclear facilities and air defenses as part of Operation Lion Nation. The attack involved strike systems installed on vehicles secretly brought into Iran, as well as strike drones launched from a hidden base near Tehran.
