The Iran crypto exchange Nobitex hacked on June 18, 2025, and destroyed nearly $90 million worth of digital assets. The attack is linked to a cyber group allegedly tied to Israel. The hackers drained multiple cryptocurrencies from Nobitex’s hot wallets and transferred them to vanity addresses, effectively burning the assets and making them irrecoverable.
The attackers accused the Iran crypto exchange of facilitating transactions for sanctioned groups, including the IRGC, Hamas, and the Houthis. Blockchain forensics firms confirmed that the stolen funds deliberately destroyed rather than moved for profit, pointing to a politically motivated cyber operation.
The breach occurred early morning around 6 a.m. IRST, prompting Nobitex to suspend its operations. The platform acknowledged a “security incident” and initiated an internal review of its infrastructure. It also announced that user funds will be covered through its reserve assets and that remaining hot wallet holdings transferred to cold storage for enhanced security.
In response to the hack, Iranian authorities imposed operational time restrictions on crypto exchanges across the country. A nationwide internet disruption was also reported on the same day, believed to be a precaution against further cyber threats.
This attack follows a separate cyberattack on Bank Sepah just a day earlier, which caused outages and data loss. Both incidents are seen as part of an intensifying wave of cyberwarfare targeting Iran’s financial and digital infrastructure.
The Iran crypto exchange Nobitex remains under close monitoring as blockchain analysts continue to trace transaction flows across Bitcoin, Ethereum, and TRON networks. The platform is currently operational under limited capacity while investigations and security reinforcements continue.
