Iranian Crypto Exchange Nobitex Suffers $73M Crypto Hack

On Wednesday, June 18, 2025, Iran-based cryptocurrency exchange Nobitex confirmed a significant security breach, revealing that digital assets exceeding $73 million had been drained from its platform.

The onchain investigator ZachXBT initially disclosed the attack, highlighting suspicious outflows from multiple Nobitex-linked wallets across the Tron network and Ethereum Virtual Machine (EVM)-compatible blockchains. While the full extent of the loss is still being investigated, initial estimates indicate a substantial financial impact.

Nobitex Hacked

ZachXBT identified the attackers’ use of a “vanity address” as the primary method of exploitation. A vanity address is a public wallet address customized to include a specific, user-defined sequence of characters.

In this instance, the attackers employed provocative addresses, such as “TKFuckiRGCTerroristsNoBiTEXy2r7mNX,” linked to the initial theft of $49 million. The second address used in the exploit was “0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead,” according to data from Tronscan.

After discovering unauthorized access, Nobitex promptly halted the parts of its online wallets that were affected. The exchange stated that assets stored offline were safe and unaffected by the issue. Nobitex promised to compensate all users affected by its actions using its insurance funds and other resources.

This event adds to a worrying rise in crypto-related cybercrimes in 2025. Security firm CertiK says that over $2.1 billion in digital assets have been stolen this year. Ronghui Gu, a co-founder of CertiK, stated that many of these losses stem from hacked wallets, poor key management, and weaknesses in operational processes.

Pro-Israel Hackers Claim Credit

Adding a layer of political complexity, a pro-Israel hacker group called “Gonjeshke Darande” has claimed responsibility for hacking Nobitex. In a statement on X, the group said that Nobitex helps the Iranian government fund terrorism and avoid sanctions. The group threatened to release Nobitex’s code and internal files within 24 hours, warning that any assets left on the platform would be at risk.

Gonjeshke Darande also stated that working at Nobitex is akin to military service in Iran, highlighting the importance of the exchange to the government’s objectives. The group advised users to withdraw their assets from Nobitex, stating, “Act now before it’s too late.”

“In 24 hours, we will release Nobitex’s source code and internal information from their internal network. Any assets that remain there after that point will be at risk! The Nobitex exchange is at the heart of the regime’s efforts to finance terror worldwide, as well as being the regime’s favorite sanctions violation tool,” Gonjeshke Darande group states.

The post Iranian Crypto Exchange Nobitex Suffers $73M Crypto Hack appeared first on Cointab.