Iranian Crypto Exchange Nobitex Suffers $80 Million Exploit on Tron Network
Iran’s largest cryptocurrency exchange, Nobitex, has reportedly been exploited for $80 million on the Tron network.
On-chain investigator ZachXBT flagged suspicious outflows from several wallets linked to the platform.
Nobitex Halts Operations After $48 Million Tron ExploitIn an official statement posted Wednesday, June 18, Nobitex confirmed unauthorized access to parts of its notification infrastructure and hot wallet, prompting an emergency shutdown of all access and services.
The platform emphasized that the breach was contained to hot wallets, and that cold-stored user funds remain fully secure.
“Nobitex takes full responsibility for this incident and assures users that all incurred losses will be fully compensated through the insurance fund and Nobitex resources,” the exchange stated.
All website and app functions have been temporarily suspended while internal investigations continue.
The exchange did not publicly confirm the total loss. However, ZachXBT’s analysis places the figure at over $80 million, involving swift transfers to unidentified Tron addresses.
“The Iranian crypto exchange ‘Nobitex’ appears to have been exploited for $81.7M on Tron after suspicious outflows were observed from many wallets linked to them,” the blockchain investigator shared on Telegram.
Nobitex attack transfers. Source: PeckShield
Following the attack, the hacker group Gonjeshke Darande (Predatory Sparrow) claimed credit.
“We, ‘Gonjeshke Darande’, conducted cyberattacks against Nobitex,” the group wrote in a post.
After the IRGC’s “Bank Sepah” comes the turn of Nobitex
WARNING!
In 24 hours, we will release Nobitex's source code and internal information from their internal network.
Any assets that remain there after that point will be at risk!
The Nobitex exchange is at the heart of the… pic.twitter.com/GFyBCPCFIE
This marks one of the largest publicly known exploits of an Iranian crypto platform. It adds further pressure on digital asset infrastructure in the region amid growing geopolitical and economic uncertainty.
Nobitex, which handles most of Iran’s crypto trading volume, has previously faced scrutiny for its exposure to sanctioned entities.
“The Nobitex exchange is at the heart of the regime’s efforts to finance terror worldwide, as well as being the regime’s favorite sanctions violation tool…Nobitex doesn’t even pretend to abide by sanctions. It publicly instructs users on how to use its infrastructure to bypass sanctions. The regime’s dependence on Nobitex is evident from the fact that working at Nobitex is considered valid military service, as it is vital to its efforts,” the hacker group explained.
Who is Gonjeshke Darande?Gonjeshke Darande, also known as Predatory Sparrow, is a hacker group widely believed to be linked to Israeli military intelligence.
The group has claimed responsibility for several high-profile cyberattacks targeting Iranian infrastructure, including:
- Bank Sepah in 2025, which destroyed data of a US-sanctioned Iranian bank, accusing it of financing terrorism and bypassing sanctions.
Destruction of the infrastructure of the Islamic Revolutionary Guard Corps “Bank Sepah”
We, “Gonjeshke Darande”, conducted cyberattacks which destroyed the data of the Islamic Revolutionary Guard Corps’ “Bank Sepah”.
“Bank Sepah” was an institution that circumvented… pic.twitter.com/1r4XyDmXcJ
- Disrupted 70% of Iran’s gas pumps in 2023 in response to Iranian aggression, conducted with measures to limit harm to emergency services.
- Attacked Iranian steel facilities in 2022, leaking nearly 20 GB of data, revealing ties to the Islamic Revolutionary Guard Corps (IRGC).
- Targeted Iranian railway systems and fuel distribution networks in 2021.
The group often justifies its actions as retaliation against Iran’s regional aggression and its proxies, such as Hezbollah and the Houthis.
At the same time, it emphasizes efforts to minimize civilian harm. Reports suggest Gonjeshke Darande operates with sophisticated access, potentially tied to Israel’s Unit 8200 or Unit 81, though Israel maintains ambiguity about its involvement.
The incident will likely prompt closer attention to exchange security standards in jurisdictions outside traditional regulatory frameworks.
The group warned about an imminent attack in a Tuesday post on X (Twitter).
“Caution: Associating with the regime’s instruments for evading sanctions and financing its ballistic missiles and nuclear program is bad for your long-term financial health. Who’s next?” they said on Tuesday.
More updates are expected once the investigation concludes.
The post Iranian Crypto Exchange Nobitex Suffers $80 Million Exploit on Tron Network appeared first on BeInCrypto.