Isabella García
Nobitex, Iran’s leading cryptocurrency exchange, has begun gradually reactivating access for verified users after suffering a devastating $90 million breach earlier in June, allegedly orchestrated by a pro-Israel cyber group.
According to a statement on X (formerly Twitter), the platform is now partially open to users who have completed identity verification, though deposits, withdrawals, and trading functions remain suspended. The company had initially targeted June 30 to restore withdrawals, but warned that the timeline is subject to change based on ongoing recovery efforts.
Hacker Group Destroys Funds, Releases Source Code
The group Gonjeshke Darande, which claims to be behind the attack, reportedly destroyed the stolen crypto assets and publicly leaked portions of Nobitex’s proprietary source code, compounding the exchange’s operational setbacks.
TRM Labs, a blockchain intelligence firm, suggested that Israeli authorities may have used intel from the hack to detain alleged Iranian operatives who were receiving crypto payments in Israel. In its latest update, Nobitex said it had migrated all user wallets as a security measure and warned users that previous deposit addresses are now invalid.
A Central Player in Iran’s Crypto Ecosystem Under Scrutiny
Nobitex dominates Iran’s digital asset scene, having processed over $11 billion in crypto inflows, a figure that dwarfs the combined volume of the next ten exchanges, which stand below $7.5 billion, according to data from Chainalysis.
However, Chainalysis also linked Nobitex to several high-risk entities, including ransomware operators tied to Iran’s IRGC and sanctioned Russian exchanges. Much like in Russia, crypto in Iran is frequently used as a tool to circumvent international financial sanctions.
CEO Denies State Affiliation Amid Allegations
Nobitex CEO Amir Rad pushed back against suggestions of government ties, stating that the company operates privately and maintains no affiliation with the Iranian regime or military institutions. He emphasized that their internal investigation points to state-sponsored involvement from Israel in the cyberattack.
