Chainalysis Confirms Political Motives Behind $90M Nobitex Crypto Exchange Hack

More than $90 million worth of digital assets were drained in the incident, which the firm attributes to a pro-Israel hacker group known as Gonjeshke Darande.

According to Chainalysis, the attackers used burner wallets that lacked private key access, effectively rendering the stolen assets inaccessible. This behaviour strongly suggests that the goal was not financial gain but instead to undermine Iran’s crypto infrastructure during a period of heightened geopolitical tension.

🚨Today, Iran’s largest crypto exchange Nobitex was exploited for $90M+ across multiple cryptocurrencies. A pro-Israel group claimed responsibility, using burner addresses without private key access, suggesting political motivation. Read our blog to learn more:… pic.twitter.com/1M49QEEEha

— Chainalysis (@chainalysis) June 18, 2025

The exploit targeted a range of cryptocurrencies, including Bitcoin, Ethereum, Dogecoin, Ripple, Solana, Tron, and Ton. Nobitex, which plays a central role in Iran’s heavily sanctioned digital asset ecosystem, has facilitated over $11 billion in inflows—more than all other domestic platforms combined. It has become the default exchange for Iranians seeking access to global markets, making it a key target in any attempt to disrupt the country’s financial workarounds.

Chainalysis has previously linked Nobitex to multiple illicit actors. These include wallets tied to Iranian state-sponsored ransomware groups and financial networks affiliated with Hamas, the Houthis, and other sanctioned entities. The platform has also been connected to transactions involving Russian exchanges Garantex and Bitpapa, both of which are under international sanctions.

Nobitex has issued a public statement assuring users that their funds are safe. On-chain data confirms that the stolen funds were burned, but the exchange has taken further steps by relocating large quantities of Bitcoin to newly created cold wallets.

Iran’s Central Bank reacted swiftly, ordering all domestic crypto platforms to restrict their operating hours from 10 a.m. to 8 p.m. The move signals increased regulatory scrutiny as Tehran seeks to contain the fallout and prevent similar incidents in the future. The Nobitex hack marks a rare case of a politically driven exploit in the crypto world, raising concerns about the growing convergence of geopolitics and blockchain-based financial systems.

If you want to read more news articles like this, visit DeFi Planet and follow us on Twitter , LinkedIn , Facebook , Instagram , and CoinMarketCap Community.

“Take control of your crypto portfolio with MARKETS PRO, DeFi Planet’s suite of analytics tools.”