Iranian Crypto Exchange Nobitex Hacked for $47M by Suspected Israeli Group

Iranian crypto exchange Nobitex has been hacked for nearly $47 million with Israeli-linked hacking group Gonjeshke Darande — or Predatory Sparrow — claiming responsibility as attackers.

The group said in an X post: “After Bank Sepah, it was Nobitex’s turn,” referencing their Tuesday cyberattack on Iran’s state-owned lender. They warned that Nobitex’s internal veri and source code would be released within a day, and any assets left on the exchange would be “at risk.”

On-chain sleuth Zachxbt first flagged suspicious outflows totaling $48.65 million in Tron’s TRX tokens in his Telegram channel on Wednesday.

The stolen funds were traced to a wallet using a provocative vanity address: TKFuckiRGCTerroristsNoBiTEXy2r7mNX.

The group called Nobitex a “core part of the regime’s terror financing network,” accusing it of helping Iran evade international sanctions by enabling crypto-based payments.

Nobitex, Iran’s largest exchange, confirmed the attack in an X post but did not mention or confirm stolen funds.

At the time of writing, it is unclear what attack method was used by Gonjeshke Darande to conduct the exploit.

The hack comes amid a flurry of cyber and physical attacks between Iran and Israel.

Gonjeshke Darande, believed by cybersecurity analysts to have ties to Israeli intelligence, has previously claimed responsibility for coordinated infrastructure attacks on Iranian steel factories and gas stations.

With the source code leak looming, Nobitex now faces not only financial loss but a full-blown credibility crisis — and users who haven’t yet moved funds may stand to lose everything, per the hacking group’s followup threats.