Iranian crypto exchange Nobitex has been hacked for nearly $82 million by Israel-linked hacking activist group Gonjeshke Darande.
The group said in an X post: “After Bank Sepah, it was Nobitex’s turn,” referencing their Tuesday cyberattack on Iran’s state-owned lender. They warned that Nobitex’s internal data and source code would be released within a day, and any assets left on the exchange would be “at risk.”
On-chain sleuth ZachXBT flagged suspicious outflows totaling $81.7 million in Tron’s TRX TRX, bitcoin BTC, dogecoin DOGE and other tokens in his Telegram channel on Wednesday.
The stolen funds were traced to a wallet using a provocative vanity address: TKFuckiRGCTerroristsNoBiTEXy2r7mNX.
Estimates of funds stolen was later updated to over $82 million, with funds stolen across Bitcoin, Dogecoin and EVM chains from addresses including
“0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead,” “1FuckiRGCTerroristsNoBiTEXXXaAovLX,” and “DFuckiRGCTerroristsNoBiTEXXXWLW65t.”
The group called Nobitex a “core part of the regime’s terror financing network,” accusing it of helping Iran evade international sanctions by enabling crypto-based payments.
Nobitex, Iran’s largest exchange, confirmed the attack in an X post but did not mention or confirm stolen funds.
At the time of writing, it is unclear what attack method was used by Gonjeshke Darande to conduct the exploit.
The hack comes amid a flurry of cyber and physical attacks between Iran and Israel.
Gonjeshke Darande, believed by cybersecurity analysts to have ties to Israeli intelligence, has previously claimed responsibility for coordinated infrastructure attacks on Iranian steel factories and gas stations.
With the source code leak looming, Nobitex now faces not only financial loss but a full-blown credibility crisis — and users who haven’t yet moved funds may stand to lose everything, per the hacking group’s followup threats.
UPDATE (Jun. 18, 08:34 UTC): Updates headline and text with new information.