Israeli Cyber Teams May Have Used $90M Nobitex Hack to Uncover Iranian Spies

Blockchain intelligence firm TRM Labs suggests Israel's cyber units potentially Leveraged data from a $90 million hack on Iran's largest crypto exchange, Nobitex, to identify Iranian operatives. The breach occurred on June 18, targeting hot wallets across multiple networks.

A pro-Israel group, Gonjeshke Darande, claimed responsibility for the attack. Six days later, Israeli authorities arrested three individuals—including 28-year-old Dmitri Cohen—on suspicion of espionage. Two suspects received cryptocurrency payments for disseminating propaganda, with Cohen earning $500 per task.

TRM Labs highlights the temporal proximity of three key events: Israel's June 13 strike on Iran, the June 18 exchange hack, and the June 24 arrests. While no official confirmation exists, analysts note this pattern aligns with Israel's cyber warfare tactics against Iranian targets.

The intelligence firm theorizes hackers may have accessed Nobitex's private data—including wallet information or communications—to trace the alleged spies. Chainalysis confirms Nobitex's strategic importance in Iran's crypto ecosystem.