Nobitex, Iran’s largest cryptocurrency exchange, has been the target of a highly coordinated cyberattack that resulted in the theft of over $90 million in digital assets. The breach was executed using "vanity addresses" — blockchain wallets with personalized, often symbolic or politically charged identifiers.

Blockchain forensic analysts reported that the stolen funds were transferred into wallets that had no associated private keys, rendering the assets permanently inaccessible. The blockchain intelligence firm Elliptic confirmed that these wallets were deliberately engineered to be inaccessible, characterizing the event as a uniquely destructive exploit.

In response, Nobitex shut down its website and mobile application. Its Telegram and X (formerly Twitter) accounts have also been deactivated and remain offline.

A pro-Israeli hacker group known as Gonjeshke Darande has claimed responsibility for the attack, declaring Nobitex a central component of Iran’s international sanctions-evasion infrastructure. The group has threatened to leak internal source code and sensitive data from the exchange within 24 hours, warning that "all remaining assets on the platform are at risk."

Security firm Cyvers attributed the exploit to a fundamental failure in access control, which allowed attackers to compromise internal systems and drain hot wallets across multiple blockchains.

Andrew Fierman, Head of National Security at Chainalysis, told Reuters that the scope and signature of the attack "clearly indicate a geopolitical motivation." The same group has previously claimed responsibility for disabling Iran’s fuel distribution network in 2021 and causing a fire at a steel plant in 2022.

💸💲🧠 Get up to 5020 USDT as a welcome bonus and an additional 1025 USDT by using this referral on  Bybit