nobitex

According to a Reuters investigation, Iran's largest cryptocurrency exchange, Nobitex, was founded by members of the Kharrazi family, who have close ties to Iran's supreme leadership. The investigation revealed that the exchange was created by brothers Ali and Mohammad Kharrazi, who previously used the surname "Aghamir" to conceal their connection to the Kharrazi family, which has long been closely linked to the core of Iranian politics, including historical ties to Ali Khamenei and his successors.The report noted that Nobitex currently serves over 11 million users, dominates the Iranian crypto market, and continues to operate during conflicts between Iran and the United States and Israel, processing transactions even amid nationwide internet outages. Analysts stated that its trading volume during wartime exceeded $100 million, with significant amounts of funds flowing overseas.Additionally, several on-chain analysis firms pointed out that the platform had processed transactions related to sanctioned entities, with estimated volumes ranging from $22 million to $366 million. Other data indicated that wallets associated with the Central Bank of Iran transferred hundreds of millions of dollars in crypto assets to Nobitex in 2025, believed to be used to evade financial sanctions. Nobitex, however, denied any connection to the government and stated that illegal transactions account for only a small portion of its overall business.

According to Arkham data, at 14:12, 578.13 BTC (worth approximately 38.16 million USD) was transferred from one anonymous address (starting with bc1qunat...) to another anonymous address (starting with bc1q6mau...). Subsequently, the address transferred a portion of the BTC (5 BTC) to Nobitex.ir.

According to Arkham data, at 16:30, 587.13 BTC (worth approximately 40.01 million USD) was transferred from one anonymous address (starting with bc1qmwy2h0d...) to another anonymous address (starting with bc1q4ekd8q...). Subsequently, that address transferred a portion of the BTC (3 coins) to Nobitex.ir.

According to Arkham data, at 15:08, 594.13 BTC (worth approximately 42.42 million USD) was transferred from one anonymous address (starting with bc1qkpas...) to another anonymous address (starting with bc1qf7tz...). Subsequently, that address transferred a portion of the BTC (3 BTC) to Nobitex.ir.

According to Arkham data, at 15:05, 594.13 BTC (worth approximately 41.51 million USD) was transferred from one anonymous address (starting with bc1q3qj2q...) to another anonymous address (starting with bc1qkpas...). Subsequently, that address transferred a portion of the BTC (3 BTC) to Nobitex.ir.

According to CoinDesk, monitoring by Elliptic shows that within minutes of the first airstrikes by the U.S. on Tehran, the outflow of cryptocurrency from Iran's largest exchange, Nobitex, surged by 700%. Elliptic reported that Nobitex processed $7.2 billion in cryptocurrency transactions in 2025 and has over 11 million users.The flow of funds indicates that cryptocurrencies are being sent to overseas exchanges, which may represent a capital outflow to evade the traditional banking system. Additionally, Elliptic had previously detected a spike in outflows on January 9 due to protests and internet blackouts. After the airstrikes, Bitcoin briefly fell below $64,000 before recovering to around $65,500, while Ethereum dropped to around $1,930.

ChainCatcher message, the Iranian crypto trading platform Nobitex announced on X platform that it will begin to gradually restore the display of user wallet balances. This process is being carried out step by step, starting with verified users, initially targeting spot wallets, and then moving on to other types of wallets.In addition, the verification process that started two days ago is a prerequisite for accessing wallets. "If you are temporarily unable to view your wallet balance, please wait for the account verification to be completed. As we mentioned in our previous announcement, this process is expected to be completed by the middle of this week. However, please note that the timeline may change or be delayed based on technical conditions and further security checks."

According to ChainCatcher, The Block reported that the crypto analytics platform TRM Labs stated that Israel recently arrested three individuals suspected of engaging in espionage activities for Iran, two of whom were compensated with cryptocurrency, marking a rare public case involving government agents using digital assets.TRM noted that on June 18, Iran's largest crypto exchange, Nobitex, suffered a hack resulting in losses exceeding $90 million, with the attackers being the pro-Israel organization Gonjeshke Darande. TRM's analysis indicated that, although there is no direct evidence, Israel may have used internal data obtained from Nobitex during this attack (such as wallet and message records) to identify suspects, a tactic consistent with past Israeli behavior. Chainalysis further pointed out that Nobitex is a key node in Iran's crypto system under sanctions and has had on-chain connections with groups related to the Iranian Revolutionary Guard.

ChainCatcher news, according to official sources, the Iranian cryptocurrency trading platform Nobitex has released a service recovery plan, and the platform services will soon be restored in phases:The first phase will start on June 25, during which all users must re-verify their identities through the web version to ensure account security. Most platform functions will remain closed during the verification period;The second phase is expected to begin on June 28, and users who complete the verification will regain access to their accounts;The third phase will start on June 30, and the platform will gradually reopen withdrawal, deposit, and trading functions, with specific details to be announced in subsequent updates.Nobitex was previously attacked by the pro-Israel hacker group "Gonjeshke Darande," resulting in an estimated loss of about 100 million dollars.

ChainCatcher news, according to Bitcoin News, Iran has implemented a curfew on cryptocurrency exchanges after a hack at Nobitex exchange to prevent capital outflow and strengthen control over digital asset trading. Exchanges can only operate daily from 10 AM to 8 PM local time.

ChainCatcher message, the Israeli-linked hacking group Gonjeshke Darande announced that it has made the entire source code of Iran's largest cryptocurrency exchange Nobitex public, and related asset information has now been fully exposed. The organization warned that user assets remaining in Nobitex are facing extremely high risks and showcased details of Nobitex's internal system on social media platforms.

ChainCatcher news, the Iranian cryptocurrency trading platform Nobitex has released its fourth announcement regarding the theft incident: "In the ongoing response to the recent security incident at Nobitex, the situation is now under control, and all external access to our servers has been completely severed. Users may notice a significant decrease in their wallet balances on various blockchain networks at Nobitex. This is due to our technical team proactively emptying the hot wallet funds to protect user assets. Therefore, users need not worry about the changes in these wallet balances.The stolen assets have been transferred to a wallet using a non-standard address, composed of random characters, which is distinctly different from the patterns of attacks on traditional cryptocurrency trading platforms. These wallets were subsequently used to destroy and burn user assets. Clearly, the purpose of this attack is not economic gain, but rather an attempt to harm the security and psychological safety of users' assets through deceptive means.The stolen funds can still be publicly tracked on the blockchain network, with the estimated total amount of stolen assets currently around 100 million USD. Furthermore, due to network restrictions and blocked access to external servers, the platform's recovery may take longer than usual. However, Nobitex is making every effort to expedite the repair process. All user assets are fully secured by Nobitex's reserve fund, and users will not incur any financial losses. Further updates will be provided through subsequent announcements."

ChainCatcher message, Slow Mist Yu Xian posted on social media, "Looking at it now, over 80 million dollars worth of cryptocurrency was directly transferred to an address that is highly likely to be a black hole, which means it was directly destroyed... contributing a little bit of deflation to the entire cryptocurrency industry. Even North Korean hackers would be stunned by this behavior of pro-Israel hackers... and the Iranian exchange's leg has already been broken."

ChainCatcher news, according to CoinDesk, the blockchain security company Elliptic stated that the attack on the Iranian cryptocurrency exchange Nobitex by the hacker group Gonjeshke Darande, linked to Israel, resulting in a loss of $90 million, was not motivated by financial gain, as the related funds were sent to a Vanity Address, essentially destroying the tokens.Previous news, the hacker group "Gonjeshke Darande" (Persian for "Fierce Sparrow") announced that it had launched a cyber attack on the Iranian cryptocurrency exchange Nobitex and warned that it would release the exchange's source code and internal network information within 24 hours.

ChainCatcher message, on-chain detective ZachXBT released an update on his personal channel regarding the "Iranian cryptocurrency exchange Nobitex hack" incident. The current suspicious fund outflow has increased from the previous $48.65 million to approximately $81.7 million, with outflows detected on Tron, Bitcoin, DOGE Chain, and EVM chains, involving multiple wallets associated with the exchange.

ChainCatcher news, the Iranian cryptocurrency exchange Nobitex today issued a security incident notification, confirming that the platform has suffered a hacker attack, affecting some assets in hot wallets. It is reported that the pro-Israel hacker group "Gonjeshke Darande" has claimed responsibility for the attack and threatened to release Nobitex's source code and internal information within 24 hours.Nobitex stated that user assets in cold storage are safe and promised to fully compensate losses through insurance funds and platform resources. Currently, the platform's website and application have been temporarily closed, awaiting the security team's completion of a comprehensive investigation.