Iran’s largest cryptocurrency exchange, Nobitex, has suffered a major security breach, resulting in the loss of approximately $48.65 million in USDT on the Tron network.
The incident was initially revealed by on-chain cryptocurrency investigator ZachXBT, who flagged suspicious activity involving several wallets associated with Nobitex.
According to his analysis, the stolen funds were quickly funneled into unidentified Tron addresses, indicating a well-coordinated and sophisticated operation.
In a statement on June 18, Nobitex confirmed that its hot wallets and parts of its notification infrastructure had been compromised, prompting an emergency shutdown of all access and services.
The exchange assured users that its cold wallets, where most user funds are stored, remain secure and unaffected by the breach. However, Nobitex has not officially disclosed the total amount lost.
“Nobitex accepts full responsibility for this incident and assures users that all damages will be compensated through the insurance fund and Nobitex resources,” the exchange said.
Geopolitical role in Nobitex hack
Interestingly, geopolitical tensions between Israel and Iran appear to have played a role in the breach.
Specifically, an Israeli-linked hacker group known as Gonjeshke Darande (Predatory Sparrow) has claimed responsibility for the attack.
In a message posted on Wednesday, the group announced its intention to leak Nobitex’s source code and internal data within 24 hours.
Known for its previous cyber operations targeting Iranian institutions, Predatory Sparrow is widely believed to have ties to Israeli intelligence.
The group accused Nobitex of helping the Iranian regime finance terrorism and circumvent international sanctions through the use of cryptocurrency.
It framed the attack as part of a broader campaign against Iran’s regional influence and its military proxies, including Hezbollah and the Houthis. The hackers also emphasized that they aim to avoid civilian harm in their operations.
This breach follows closely on the heels of another cyberattack targeting Sepah Bank, a financial institution linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), which disrupted the bank’s online services earlier this week.
Featured image via Shutterstock
