Predatory Sparrow, a pro-Israel cyber group, has claimed responsibility for an attack on Iran’s largest cryptocurrency exchange, Nobitex, which ended with the loss of $90 million worth of crypto assets.
The cyberattack explained
Cryptocurrency exchange attacks are usually about one thing only: stealing money. This time, though, the attackers had no intention of stealing the funds; they were only trying to destroy them.
The attack took place on June 18, 2025. Nobitex detected unauthorized access to its hot wallet system and immediately shut down its systems. Shortly after the attack began, the company confirmed it via an official statement on X.
“We emphasize that users’ assets, stored according to cold storage standards, remain completely secure. The incident has affected only a portion of the assets stored in our hot wallets,” said the company.
“Nobitex fully accepts responsibility for this incident, and we assure our users that all losses will be compensated through our insurance fund and Nobitex’s resources. Until the investigation concludes, access to the website and app has been temporarily suspended.”
Who is Nobitex?
Established in 2017, Nobitex is Iran’s largest cryptocurrency exchange, with 7 million users.
The attackers transferred the stolen cryptocurrency into specially created vanity addresses, which made the assets irretrievable and thus essentially destroyed.
The hackers confirmed the attack in a post on X and said they also stole the online service’s source code.
“Nobitex doesn’t even pretend to abide by sanctions. In fact, it publicly instructs users on how to use its infrastructure to bypass sanctions. The regime’s dependence on Nobitex is evident from the fact that working at Nobitex is considered valid military service, as it is considered vital to the regime’s efforts,” the group said on X.
The Guardian reported that following the breach, although not directly caused by it, Iranian authorities implemented a nationwide shutdown of internet infrastructure, causing a dramatic 98% drop in network traffic.
The Iranian government said that it took drastic measures to prevent further cyberthreats and potential data leaks but didn’t mention the Nobitex attack.