Iran’s largest crypto exchange Nobitex got absolutely demolished by Israeli-linked hackers who made off with $90 million in June 2025. The Predatory Sparrow group didn’t just steal funds—they grabbed source code, left anti-regime graffiti, and spread stolen crypto across multiple blockchains. Iran’s government freaked out, implementing internet blackouts and shutting down trading markets. The sophisticated attack exposed serious vulnerabilities in sanctioned economies’ digital infrastructure, turning a simple heist into full-blown cyber warfare with lasting geopolitical consequences.
Ninety million dollars. Gone. Just like that, Iran’s biggest cryptocurrency exchange, Nobitex, found itself staring at a massive hole in its digital wallet after hackers decided to go shopping with other people’s money on June 18, 2025.
Ninety million dollars vanished from Iran’s largest crypto exchange when hackers went on an unauthorized shopping spree.
The culprits? A group calling itself Gonjeshke Darande, or Predatory Sparrow if you prefer English. These weren’t your typical basement-dwelling crypto thieves looking for quick cash. They’re allegedly linked to Israel, turning this heist into something much bigger than a simple robbery.
The attackers didn’t just grab the money and run. They went full scorched earth, stealing source code and infrastructure documentation. It’s like robbing a bank and taking the blueprints too. The leaked code basically handed over Nobitex’s entire operational playbook to anyone curious enough to look.
What makes this particularly spicy is the political theater. The hackers used vanity addresses with anti-regime slogans, fundamentally spray-painting digital graffiti while cleaning out the vault. Subtle, they were not.
Iran’s government response was predictably heavy-handed. Internet blackouts rolled out faster than you could say “cyber warfare.” Officials told people to delete WhatsApp because apparently Israel might be using it for military purposes. The Central Bank temporarily shut down trading markets, trying to stop the financial bleeding.
The stolen funds were spread across multiple blockchains including TRON, Ethereum, and Bitcoin. Some estimates put the total closer to $100 million, because when you’re already having a terrible day, why not make it worse? Interestingly, the hackers haven’t moved the funds from their initial exploit wallets, suggesting they may be planning something bigger or waiting for the heat to die down.
This attack highlights the messy reality of operating crypto exchanges in sanctioned economies. Nobitex had segmented wallet infrastructure with hot and cold storage, but sophisticated attackers don’t care about your security measures when they’ve got bigger fish to fry.
The bigger picture here isn’t just about stolen cryptocurrency. This is cyber warfare masquerading as a heist, part of an escalating digital conflict between Israel and Iran. The financial damage is immediate and painful, but the geopolitical implications stretch far beyond any exchange’s balance sheet. The same group has previously claimed responsibility for attacks on Iran’s steel plants in 2022, demonstrating their sustained campaign against Iranian infrastructure.
For Nobitex, rebuilding trust will be harder than recovering the stolen funds.
