Pro-Israel Hackers Strike: Iran’s Nobitex Loses $49M in Brazen Cyber Heist

Digital warfare escalates as a pro-Israel hacker group takes credit for a $49 million crypto raid on Iran’s Nobitex exchange. The attack—timed like a Wall Street short-seller’s dream—exposes the fragile underbelly of even state-linked crypto platforms.

How it happened: The group bypassed Nobitex’s security layers with surgical precision, draining wallets in what appears to be a politically-motivated strike. No ‘rug pull’ here—just old-fashioned cyber looting with a geopolitical twist.

Why it matters: Crypto exchanges remain prize targets for hackers, but this attack blurs the line between cybercrime and digital warfare. Meanwhile, TradFi bankers will clutch their pearls—right before asking how to short Iranian crypto.

Nobitex Hacked

In an official statement, Nobitex said all access was promptly suspended and assured users that the incident had not impacted customer assets held in cold storage. The exchange also pledged full compensation through its insurance fund and internal reserves.

The pro-Israel hacker group Gonjeshke Darande (Persian for “Predatory Sparrow”) has claimed responsibility for the cyberattack and issued a stark warning in a graphic posted to social media. The message accuses Nobitex of being “at the heart of the regime’s efforts to finance terror worldwide” and functioning as Iran’s favored mechanism for circumventing international sanctions.

The hackers even threatened to release the platform’s source code and internal data within 24 hours, which has put all remaining assets on the platform at risk.

“The regime’s dependence on Nobitex is evident from the fact that working at Nobitex is considered valid military service, as it is considered vital to the regime’s efforts. These cyberattacks are the result of Nobitex being a key regime tool for financing terrorism and violating sanctions. Associating with regime terror financing and sanction violation infrastructure puts your assets at risk.”

The breach coincides with day six of escalating Iran-Israel tensions, as both sides intensify the attacks.

Nobitex Linked to 85% of Crypto Inflows to Sanctioned Entities

Earlier this year, blockchain intelligence firm TRM Labs highlighted Nobitex’s central role in global illicit finance flows. TRM’s March report revealed that, in 2024 alone, Nobitex and the now-defunct Russian exchange Garantex facilitated over 85% of crypto inflows to sanctioned entities and jurisdictions.

Although not under international sanctions, Nobitex has functioned as a key LINK in transferring funds between Iran and high-risk Russian exchanges, often facilitating cross-border transactions that bypass traditional financial controls.