Iran’s Nobitex Exchange Loses $48M in Israel-Linked Cyberattack

June 18, 2025 - 2 min. read

By Karim Noun

Exchange hacked

On June 18, Nobitex posted an X post confirmed a key security breach that included unauthorized access to its reporting infrastructure and hot wallets. This attack incurred a loss of more than $48million with hackers looting their USDT through Tron network. The company shut down all access and began an internal inquiry. Nobitex had promised its customers that their funds that had been stored in cold storage were safe. Furthermore, guaranteed users total reimbursement using its insurance fund and company funds.

Israel-Linked Group Claims Responsibility

An organization which styles itself Gonjeshke Darande or Predatory Sparrow took responsibility of the attack. Reuters and Israel Times have referred to the organization as an Israel-affiliated one, and there is still no evidence of a state sponsorship. The collective implicated Nobitex of assisting Iran in its military undertakings and assisting its users to bypass international sanctions. They charged that the exchange trains users on how to dodge sanctions, and by working there, people can be considered military employees under the Iranian system, which would make it an Iranian defense system.

Threats of Data Release and Source Code Exposure

Totally in control, Predatory Sparrow threatened to drop the source code and internal data of Nobitex in 24 hours.The coalition has cautioned the users against the possibility of the loss of their remaining assets on the platform. It is after their earlier raids of other Iranian organizations such as the Bank Sepah on the basis of parallel reasons of sanctions. Its said the group focused on the perspective of them that Nobitex plays an instrumental role in funding terrorism activities.

Escalating Cyber Warfare Context

The hack is made during tense moments between Iran and Israel. Furthermore, there have been recent exchanges of missiles between the two nations. This is another battle ground during the ongoing warfare and the major targets of this cyberattack is financial systems. The episode sheds light on how cryptocurrency markets have turned into a temporary swing in the international disputes. Specifically when they are believed to assist countries in escaping economic sanctions or enabling military expeditions.

Karim Noun

Bio coming soon..