Nobitex Crypto Exchange Hit by $85M Hack, Gonjeshke Darande Claims Responsibility

A major security breach has rocked Iran’s largest cryptocurrency exchange, Nobitex, with Cyvers.AI system detecting multiple suspicious transactions totaling approximately $85 million in losses across several blockchain networks.

The breakdown of the stolen funds is as follows:

$49.3M on the Tron network. 

$24.3M on EVM-compatible chains. 

$2M on the Bitcoin network. 

$6.7M on the Dogecoin network. 

$3B NOT (valued at over $6M) on the TON network. 

The breach was first reported by blockchain investigator @zachxbte arlier today, June 18, 2025. Surprisingly, no swaps or movements of the stolen funds have been detected so far, raising questions about the attackers’ next steps.

A hacker group identifying as Gonjeshke Darande (Predatory Sparrow) has claimed responsibility for the attack, alleging Nobitex facilitates Iran’s sanctions evasion and terrorism financing.

The group threatened to release the exchange’s internal files and source code within 24 hours, warning that remaining funds on the platform are at risk. The hackers’ addresses involved in the breach are:

BTC: 1FuckiRGCTerroristsNoBiTEXXXaAovLX

EVM: 0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead

TRON: TKFuckiRGCTerroristsNoBiTEXy2r7mNX

DOGE: DFuckiRGCTerroristsNoBiTEXXXWLW65t

TON: UQABFuckIRGCTerroristsNOBITEX1111111111111111_jT

Nobitex confirmed the incident in a statement posted on X, stating:

“Earlier today, June 18, Nobitex identified unauthorized access to parts of its infrastructure, specifically affecting our internal communication systems and a portion of our hot wallet.”

The exchange has suspended platform access while its security team investigates and claims user funds in cold storage remain secure, with losses to be covered by its insurance fund and internal reserves.

The attack comes amid heightened Israel-Iran tensions, with Gonjeshke Darande accusing Nobitex of being “central to the regime’s terror financing.” The group’s claims remain unverified, and Nobitex has not addressed the allegations directly.

Stay tuned for updates as the situation develops.