Nobitex Hit by $90M Hack as Cyberwar Targets Iran’s Crypto
Iran’s largest cryptocurrency exchange, Nobitex, has been struck by a devastating cyberattack in which over $90 million in digital assets were not only stolen but deliberately destroyed. The attack, which unfolded on June 18, appears to be politically motivated, with the hacking group publicly identifying itself as Predatory Sparrow—a name linked to earlier cyber strikes on Iran’s infrastructure.
Cyberattack Linked to Geopolitical Tensions
The attackers transferred tens of millions in cryptocurrency from Nobitex’s hot wallets into so-called “burn addresses”—wallets with no known private keys—rendering the assets permanently inaccessible. Many of these wallets bore provocative names, with explicit messages targeting Iran’s Islamic Revolutionary Guard Corps (IRGC), suggesting the motive was not financial gain but deliberate sabotage.
The group accused Nobitex of assisting in the financing of Iran’s military operations and evading international sanctions, stating the exchange was a “node in a terror-financing network.” These accusations add a deeper layer to the cyberattack, positioning it within the context of Iran’s growing isolation amid escalating regional tensions, particularly with Israel.
Damage Control Underway
Nobitex has suspended operations temporarily and issued a public statement vowing to reimburse affected users through its insurance fund. While its cold wallets remain secure, the breach of hot wallets—used for daily transactions—has disrupted exchange services and sparked alarm across the Iranian crypto sector. Cybersecurity analysts noted a lapse in multi-factor authentication and access controls, which allowed the breach.
Iranian cybercrime authorities have launched an investigation, but given the attack’s geopolitical dimensions, domestic resolution may be limited. The hackers have threatened to release Nobitex’s internal data and source code, raising the stakes for further damage both reputational and systemic.
Rise of Politicized Crypto Hacks
This incident is one of a growing number of politically charged cyberattacks involving cryptocurrencies. Rather than aiming to profit from the stolen funds, attackers chose to destroy them as a symbolic strike against the Iranian state. Experts warn this trend signals a new phase in cyberwarfare, where crypto exchanges become proxies in state-level conflicts.
The Nobitex breach is a chilling reminder that crypto infrastructure is now part of modern warfare. As Iran reels from this financial sabotage, concerns mount about retaliatory cyberstrikes and the vulnerability of financial systems entangled in global power games.
