On June 18, 2025, Iranian cryptocurrency platform, Nobitex, was exploited, resulting in the loss of more than $90 million in assets spanning a range of cryptocurrencies, including Bitcoin, Ethereum, Dogecoin, Ripple, Solana, Tron, and Ton. As Iran’s largest digital asset exchange, the compromise of Nobitex marks a major development within the Iranian crypto ecosystem.
While the cryptocurrency space has always been shaped by geopolitical dynamics and associated cyber incidents, this event stands out. A pro-Israel group known as Gonjeshke Darande has claimed responsibility, framing the attack as a politically motivated strike against Iranian digital infrastructure. Notably, our analysis indicates that this is the case — the attacker-controlled wallets were burner addresses lacking private key access, suggesting that the theft of more than $90 million was likely politically motivated, rather than financial in nature. While this is the first hack of this scale exclusively for geopolitical purposes, this is not the first time there’s been increased activity during windows of high geopolitical tensions between Israel and Iran, as noted in our 2024 Crypto Crime Report.
Keep reading to learn more about Nobitex’s known links to illicit activity, Iran’s heavily sanctioned crypto ecosystem, and more.
What is Nobitex?
Nobitex is the largest cryptocurrency exchange in Iran and a central pillar of the country’s digital asset ecosystem. Operating in a heavily sanctioned environment, it has become the go-to platform for Iranian users seeking access to global crypto markets, facilitating the majority of on-chain exchange activity originating in the country.
Historically, Nobitex’s daily and monthly trading volumes have been significantly higher than those of its domestic competitors. Nobitex serves a broad user base, ranging from retail traders to entities seeking to bypass traditional financial channels. Its dominance is not only a reflection of scale, but also of necessity, as limited access to global platforms has made Nobitex a key infrastructure provider for crypto activity under Iran’s economic constraints. As seen below, Nobitex’s total inflows are well over $11 billion, compared to just under $7.5 billion for the next ten largest Iranian exchanges combined.
Nobitex’s known links to illicit activity
Past on-chain analysis has linked Nobitex to a range of illicit actors, including wallets affiliated with IRGC-affiliated ransomware operators, and entities tied to Houthi and Hamas-affiliated networks as identified by the National Bureau for Counter Terror Financing (NBCTF) of Israel. As we see in the Chainalysis Reactor graph below, the platform has also facilitated transactions with sanctioned pro-Hamas media outlet, Gaza Now, a pro-al-Qaeda propaganda channel; sanctioned Russian crypto exchanges, Garantex and Bitpapa; and many other illicit operators.
The aftermath of Nobitex’s exploit
In the immediate aftermath of the exploit, Nobitex issued a public statement, assuring users that their funds were safe. While on-chain analysis confirms that the attacker burned the stolen funds, making them irretrievable, Nobitex has taken additional steps to reinforce user trust. Notably, the exchange has moved large quantities of Bitcoin to what appear to be newly established cold storage wallets, an effort likely aimed at bolstering its security posture and reducing exposure to similar future attacks.
Beyond Nobitex itself, the incident appears to have triggered a wider response from the Iranian regime. According to reports, the Central Bank of Iran has directed all domestic crypto exchanges to limit their operating hours to between 10 AM and 8 PM, suggesting an attempt to exert greater oversight and control over the sector. This operational curfew could signal increasing pressure on exchanges operating within Iran, as the regime attempts to manage systemic risk in a market that plays an outsized role in navigating around global sanctions.
Why does this matter?
Nobitex isn’t just a local exchange; it serves as a critical hub within Iran’s heavily sanctioned crypto ecosystem, enabling access to global markets for users cut off from traditional finance. Today’s exploit underscores the inherent tension between the borderless nature of cryptocurrency and the geopolitical realities of nation-state restrictions. It also highlights the urgent need for continued blockchain intelligence and off-chain analysis to monitor risk, uncover sanctions evasion among other illicit activity, and provide clarity in high-risk jurisdictions.
Chainalysis continues to monitor Iran’s crypto ecosystem in the wake of the Nobitex exploit, with a focus on surfacing insights into how the Iranian crypto ecosystem responds to today’s action. By combining on-chain forensics with geopolitical context, we help public and private sector partners navigate emerging risks with clarity and precision.
이 웹사이트에는 links 이 관리하지 않는 제3자 사이트로의 링크가 포함되어 있습니다. 체이널리시스, Inc. 또는 그 계열사(이하 총칭하여 “체이널리시스”)의 통제 하에 있지 않은 제3자 사이트로의 링크([email protected])를 포함하고 있습니다. 이러한 정보에 대한 접근이 해당 사이트 또는 그 운영자와의 제휴, 지지, 승인 또는 추천을 의미하는 것은 아닙니다 체이널리시스 해당 사이트나 그 운영자와의 제휴, 지지, 승인 또는 추천을 의미하지 않으며, 체이널리시스 해당 사이트에 게시된 제품, 서비스 또는 기타 콘텐츠에 대해 책임을 지지 않습니다.
본 자료는 정보 제공만을 목적으로 하며, 법률, 세무, 금융 또는 투자 자문을 제공하기 위한 것이 아닙니다. 수신자는 이러한 유형의 결정을 내리기 전에 본인의 자문가와 상담해야 합니다. 체이널리시스 는 수신자가 본 자료를 이용함에 따라 내린 어떠한 결정이나 기타 행위 또는 부작위에 대해서도 어떠한 책임도 지지 않습니다.
체이널리시스 본 보고서에 포함된 정보의 정확성, 완전성, 시의성, 적합성 또는 유효성을 보장하거나 보증하지 않으며, 해당 자료의 어느 부분에서든 발생하는 오류, 누락 또는 기타 부정확성으로 인해 제기되는 어떠한 청구에 대해서도 책임을 지지 않습니다.
