Iran’s Leading Crypto Hub Rocked by $82M Heist—Israeli-Linked Hackers Strike
Iran’s flagship crypto exchange just got schooled in blockchain’s oldest lesson: code isn’t law when hackers have better code.
The $82 million digital heist—traced to groups with Israeli ties—exposes the brutal irony of decentralized finance: your keys might be yours, until someone else takes them.
Meanwhile, traditional finance bros are already using this as ‘proof’ crypto is unstable—ignoring that banks lose $8 billion annually to old-fashioned fraud. Glass houses, meet stone vaults.
Massive Funds Drained From Hot Wallets
According to ZachXBT’s Telegram post, the first chunk—$49 million—went through a vanity address that read “TKFuckiRGCTerrorists…mNX.” A second custom address, “0xffFFfFFffFF…Dead,” was used to pull the rest.
These special wallet names aren’t random. They show how attackers slipped around Nobitex’s checks and grabbed funds meant to stay locked down.
Vanity Addresses Exploit Access Controls
Experts say the use of these human‑readable addresses points to a flaw in the exchange’s internal controls. “Attackers managed to infiltrate systems that should have blocked unauthorized wallets,” noted Hakan Unal of Cyvers security. The exchange confirmed that it spotted the breach quickly and suspended the affected hot wallets.
Political Motive Behind The BreachA pro‑Israel hacker group calling itself “Gonjeshke Darande” claimed responsibility in an X post. The group called Nobitex a tool for “regime financing” and threatened to release source code and internal files within 24 hours.
After the IRGC’s “Bank Sepah” comes the turn of Nobitex WARNING!
In 24 hours, we will release Nobitex’s source code and internal information from their internal network. Any assets that remain there after that point will be at risk!
The Nobitex exchange is at the heart of the… pic.twitter.com/GFyBCPCFIE
— Gonjeshke Darande (@GonjeshkeDarand) June 18, 2025
They warned that any assets left on the platform WOULD be in danger. This hack comes as tensions surged between Israel and Iran after Israel’s largest strikes on Iran since the 1980s. Reports say at least 224 people died in Iran and 24 in Israel during the renewed conflict.
Nobitex says users’ main funds are SAFE in cold storage, and only a fraction of hot‑wallet assets were hit. The exchange promised to cover all losses with its insurance fund and internal resources. That promise should reassure customers, though the fear of leaked code or files could drive some to pull funds.
Unmoved Funds Could Reveal Next StepsInterestingly, none of the stolen coins have moved since the hack was first spotted. That could mean the hackers are choosing their next move. Or it might be a warning shot meant to show they can strike again.
Either way, this incident highlights how vital it is for exchanges to guard against insider‑level slip‑ups. Protocols alone aren’t enough if people and processes leave doors open.
As the crypto world watches, Nobitex users will be looking closely at how the platform rebuilds trust and keeps their money safe.
Featured image from Unsplash, chart from TradingView
