- Iranian crypto exchange Nobitex hacked for $81 million.
- Pro-Israel group claims responsibility.
- It isn't Israel's first cyberattack against Iran.
A pro-Israel hacker group claimed responsibility for an attack on Iranian crypto exchange Nobitex on Wednesday, which stole over $81 million worth of assets.
The attack began at around 5:30 a.m. UK time. Onchain records show millions of dollars worth of assets on Bitcoin, Ethereum, and several other blockchains were siphoned out of the exchange’s crypto wallets over several hours.
The suspicious outflows were quickly identified by several crypto security investigators, who posted about the situation on social media.
At 8:00 a.m., Gonjeshke Darande, a hacker group whose name translates to Predatory Sparrows and is widely believed to be linked to Israeli military intelligence, said in an X post that it was behind the theft.
After the IRGC’s “Bank Sepah” comes the turn of Nobitex
— Gonjeshke Darande (@GonjeshkeDarand) June 18, 2025
WARNING!
In 24 hours, we will release Nobitex's source code and internal information from their internal network.
Any assets that remain there after that point will be at risk!
The Nobitex exchange is at the heart of the… pic.twitter.com/GFyBCPCFIE
“The Nobitex exchange is at the heart of the regime’s efforts to finance terror worldwide, as well as being the regime’s favorite sanctions violation tool,” the group said.
“Nobitex takes full responsibility for this incident,” the exchange said in an X post.
“All potential user losses will be fully covered through our insurance fund and internal reserves. Users will not experience any financial loss.”
The Nobitex website and mobile app have since been taken offline.
Conflict escalates
The theft comes as the conflict between Israel and Iran intensifies.
On June 13, Israel launched missiles at dozens of targets in Iran with the stated aim of stopping the expansion of the state’s nuclear programme. Iran responded by launching ballistic missiles and drones at military sites, intelligence sites, and residential areas in Israel.
The Nobitex hack isn’t the first instance of cyber warfare in the current round of hostilities. On June 17 the same hacker group said they were behind a nationwide IT failure at the US-sanctioned Sepah bank.
Source code access
This has been the worst year for crypto thefts after state sponsored North Korean hackers stole an unprecedented $1.4 billion from crypto exchange Bybit in February.
Security researchers have also linked North Korean hackers to several other recent crypto exchange hacks, including those at Indian exchange WazirX and Japanese exchange DMM Bitcoin.
Hackers often rely on social engineering and phishing techniques to carry out attacks on crypto exchanges.
It’s not clear how Gonjeshke Darande was able to gain access to Nobitex’s systems. But it appears the hack didn’t just target the exchange’s crypto wallets.
The hacker group also claims to have access to Nobitex’s source code and internal information, and has threatened to release it in 24 hours.
Israel has a history of utilising cyber warfare against Iran.
In 2010, security researchers uncovered a malicious computer worm called Stuxnet, which is believed to be responsible for causing substantial damage to Iran’s nuclear programme.
Although neither the US nor Israel has admitted responsibility, multiple independent news organisations claim Stuxnet was a cyberweapon built jointly by the two allies.
Tim Craig is DL News’ Edinburgh-based DeFi correspondent. Reach out to him with tips at tim@dlnews.com.
