Flows into Iranian crypto trading platforms have fallen in 2025 due to a breakdown in nuclear negotiations with Israel, a $90 million hack on Iran’s largest crypto exchange, and a major stablecoin blacklisting, says blockchain analytics firm TRM Labs.

Iranian crypto flows hit $3.7 billion between January and July, an 11% decrease compared to the same period last year, with the worst drop off coming in June and July, TRM Labs said in a report on Tuesday.

“This downturn coincided with a breakdown in nuclear negotiations, a 12-day conflict with Israel beginning June 13, and widespread power outages in Iran — driven by a combination of Israeli kinetic and cyber operations, as well as regime-initiated shutdowns.”

Iran’s crypto flows started to sharply drop in June, just after the $90 million hack on Nobitex, which handles 87% of the country’s crypto transactions. 

Many Iranians rely on US dollar stablecoins as a store of value amid skyrocketing inflation and to skirt tough sanctions on the country, which has largely cut it off from the global economy.

Nobitex hack big contributor to Iran’s crypto shake-up

Confidence in Iran-based virtual asset service providers (VASPs) deteriorated following Nobitex’s security breach, which came at the hands of pro-Israel group Predatory Sparrow on June 18 — when tensions between Iran and Israel were at their peak.

While Nobitex continues to dominate Iran crypto transaction volume, the incident disrupted liquidity, slowed transaction processing and temporarily pushed users toward alternative platforms, TRM said.

Heightened Iran-Israel tensions further amplified the outflows, which surged more than 150% in the worst week and a large percentage of that volume headed to high-risk foreign exchanges with little to no Know Your Customer checks, TRM said.

Tether’s blacklisting slowed flows

Stablecoin issuer Tether also carried out its largest-ever freeze of Iranian-linked funds, blacklisting 42 crypto addresses with Tether (USDT) balances on July 2.

The incident sparked a coordinated push from Iranian exchanges, influencers and state-backed channels for users to offload their TRON-based USDT balances — Iran’s most widely used network and token — and move funds into Dai (DAI) on Polygon.

Related: UAE reportedly holds $700M in mined Bitcoin: Arkham

Many everyday Iranians continue to turn to crypto as a hedge against inflation, TRM said, highlighting Iran’s strong reliance on stablecoins.

Iran continues to use crypto for political objectives

Iran is still relying on crypto to pay for sensitive goods from Chinese chip resellers, including hardware critical for artificial intelligence, drone components, and other electrical equipment — enabling it to effectively bypass sanctions, TRM noted.

It has also used crypto to fund espionage payments with foreign operatives, the crypto analytics firm added.

However, illicit crypto transactions in Iran still only account for less than 1% of total volume.

Magazine: Bitcoin is ‘funny internet money’ during a crisis: Tezos co-founder

]]> https://earlybirdsinvest.com/iranian-crypto-flows-fall-11-on-israel-conflict-nobitex-hack-trm-labs/feed/ 0 55297 https://earlybirdsinvest.com/100-million-nobitex-hack-triggers-trading-hour-limits-in-iran/ https://earlybirdsinvest.com/100-million-nobitex-hack-triggers-trading-hour-limits-in-iran/#respond Fri, 20 Jun 2025 06:23:58 +0000 https://earlybirdsinvest.com/100-million-nobitex-hack-triggers-trading-hour-limits-in-iran/

After a security incident at Nobitex, Iran’s cryptocurrency exchange, the country’s central bank has set new time limits for all local exchanges.

These platforms can only operate between 10 AM and 8 PM, as stated in Chainalysis’ blog post on June 18.

Nobitex reported that about $100 million worth of various digital assets, including Bitcoin
BTC


$104,280.24

, Ethereum
ETH


$2,511.30

, XRP
XRP


$2.14

, Solana
SOL


$144.67

, and Dogecoin
DOGE


$0.1675

, had been stolen.

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe – We publish new crypto explainer videos every week!

What is Staking Crypto? (Rewards & Risks Explained SIMPLY)

A hacker group called “Gonjeshke Darande”, which supports Israel, said it was behind the attack. The group claimed it gained access to Nobitex’s internal systems and drained its hot wallets.

Chainalysis investigated the case and stated that the stolen funds were transferred into wallets that appear to be temporary and do not have private keys.

In response to the hack, Nobitex shut off all external connections to its systems. The team stated that they had brought the situation under control.

However, users are still unable to log in to the platform. The exchange said it plans to use its Reserve Fund to cover all lost funds. It also warned that internet issues and blocked external servers may slow down the process of reopening the platform to users.

Chainalysis also shared that Nobitex has received more than $11 billion in total crypto deposits, far more than any other exchange in Iran. For comparison, the next ten largest platforms combined have seen under $7.5 billion.

On June 12, Chainalysis reported that the black-market trading network linked to Huione Group is still active, despite claims it had shut down. How? Read the full story.

Having completed a Master’s degree in Economics, Politics, and Cultures of the East Asia region, Aaron has written scientific papers analyzing the differences between Western and Collective forms of capitalism in the post-World War II era.
With close to a decade of experience in the FinTech industry, Aaron understands all of the biggest issues and struggles that crypto enthusiasts face. He’s a passionate analyst who is concerned with data-driven and fact-based content, as well as that which speaks to both Web3 natives and industry newcomers.
Aaron is the go-to person for everything and anything related to digital currencies. With a huge passion for blockchain & Web3 education, Aaron strives to transform the space as we know it, and make it more approachable to complete beginners.
Aaron has been quoted by multiple established outlets, and is a published author himself. Even during his free time, he enjoys researching the market trends, and looking for the next supernova.

---

The pro-Israel “Predatory Sparrow” hacking group claims to have stolen over $90 million in cryptocurrency from Nobitex, Iran’s largest crypto exchange, and burned the funds in a politically motivated cyberattack.

The attack occurred on June 18, 2025, with Nobitex first reporting the breach on X at 2:24 AM EST.

“This morning, June 19, our technical team detected signs of unauthorized access to a portion of our reporting infrastructure and hot wallet,” reads Nobitex’s post.

“Immediately upon detection, all access was suspended and our internal security teams are closely investigating the extent of the incident.”

Soon after, Predatory Sparrow claimed responsibility for the attack through their Gonjeshke Darande X account, promising to publish the company’s source code and internal information stolen during the cyberattack. Nobitex’s website has remained offline since the attack.

“After the IRGC’s ‘Bank Sepah’ comes the turn of Nobitex. WARNING! In 24 hours, we will release Nobitex’s source code and internal information from their internal network. Any assets that remain there after that point will be at risk,” reads Predatory Sparrow’s post.

“The Nobitex exchange is at the heart of the regime’s efforts to finance terror worldwide, as well as being the regime’s favorite sanctions violation tool. We, ‘Gonjeshke Darande,’ conducted cyberattacks against Nobitex.”

Blockchain analysis firm Elliptic reports that more than $90 million in crypto was drained from Nobitex’s wallets and funneled into addresses controlled by the hackers.

However, instead of attempting to capitalize on the breach and keep the stolen crypto for themselves, the hacking group sent nearly all of the crypto to vanity addresses, which are cryptographic wallet addresses with embedded anti-Islamic Republic Guard Corps (IRGC) messages such as “F*ckIRGCterrorists.”

These vanity addresses require a lot of computational power to generate with usable private keys, and according to Elliptic, the creation of such long string names in a vanity address is “computationally infeasible.” This means the hackers intentionally burnt the crypto so that no one could gain access to it again.

“The hack also does not appear to be financially motivated,” explains Elliptic.

“The vanity addresses used by the hackers are generated through “brute force” methods – involving the creation of large numbers of cryptographic key pairs until one contains the desired text. But creating vanity addresses with text strings as long as those used in this hack is computationally infeasible.”

Elliptic reports that their investigations into Nobitex also show ties to the IRGC and Iranian leadership.

Other researchers previously linked the exchange to relatives of Supreme Leader Ali Khamenei, IRGC-affiliated business interests, and sanctioned individuals, who have reportedly used Nobitex to move funds generated from the DiskCryptor and BitLocker ransomware operations.

The Predatory Sparrow hacktivist group breached the Iran-controlled Bank Sepah a day before the Nobitex attack and also focused on disruption and damage rather than financial gain.

These attacks come as Iran increasingly isolates itself from the global Internet to reduce the risk of escalating cyberattacks on its infrastructure.

Journalist

Hassan Shittu

Journalist

Hassan Shittu

About Author

Hassan, a Cryptonews.com journalist with 6+ years of experience in Web3 journalism, brings deep knowledge across Crypto, Web3 Gaming, NFTs, and Play-to-Earn sectors. His work has appeared in…

Share

Last updated: 

June 18, 2025

Iran’s largest cryptocurrency exchange, Nobitex, has confirmed a major security breach that resulted in a loss of nearly $73 million from its hot wallets.

The platform disclosed the incident in a Telegram post on June 19, stating that unauthorized access was detected in part of its hot wallet infrastructure.

The company said it had “immediately suspended” all access to impacted systems and is now conducting a full investigation.

“Our technical team detected signs of unauthorized access to a portion of our reporting infrastructure and hot wallet,” Nobitex said in a Telegram post.

“Immediately upon detection, all access was suspended, and our internal security teams are closely investigating the extent of the incident.” they added

ZachXBT Trace Nobitex Exploit to TRON Wallets With Provocative Vanity Names

The attack, first flagged by blockchain investigator ZachXBT, involved suspicious transactions across the Tron and Ethereum Virtual Machine (EVM)-compatible blockchains.

According to estimates, the exploit drained at least $73 million in assets, though only a portion of that total has been confirmed lost by Nobitex.

ZachXBT reported that attackers used so-called “vanity addresses” to carry out the exploit. These are custom-generated wallet addresses containing specific phrases.

The first suspicious address used to steal funds began with “TKFuckiRGCTerroristsNoBiTEX,” while another appeared as “0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead,” according to Tronscan.

The bulk of the stolen funds, around $73 million, was traced to transactions involving these addresses. Most of the drained assets were moved through the TRON network.

In a follow-up post on X, Nobitex stated, “Users’ assets are completely secure according to cold storage standards, and the incident only affected a portion of the assets in hot wallets. All damages will be compensated through the insurance fund and Nobitex resources.”

As of now, Nobitex’s platform remains offline as the team continues to assess the full impact of the breach.

Users have been assured that trading and withdrawals will resume once security reviews are completed.

Pro-Israel Hacker Group Claims Nobitex Attack as Tensions Escalate Across Middle East

The recent cyberattack on Iranian crypto exchange Nobitex has taken a political turn after a pro-Israel hacker group, “Gonjeshke Darande,” claimed responsibility.

In a post on X, the group threatened to release the exchange’s internal files and source code within 24 hours, warning that remaining funds on the platform were still vulnerable.

Describing Nobitex as “central to the regime’s terror financing,” the hackers alleged that employment at the exchange is recognized as a form of military service in Iran.

Users were urged to withdraw funds “before it’s too late.”

Nobitex has yet to respond to the group’s claims or comment on the political nature of the breach. The company’s ongoing investigation is expected to shed more light on the full scope of the attack in the coming days.

The cyberattack comes amid rising regional conflict. On June 12, Israeli forces launched “Operation Rising Lion,” striking Iran’s Natanz nuclear site and military installations near Tehran and Tabriz.

Israeli officials said the strikes were a preemptive move against Iran’s nuclear capabilities.

The geopolitical escalation rattled financial markets, sending Bitcoin tumbling from a 24-hour high of $108,500 as investors fled risk assets.

Over $1.16 billion in long positions were liquidated in a wave of panic, compared to just $113.97 million in shorts.

Meanwhile, Q1 2025 has been the worst quarter on record for crypto hacks, with $1.63 billion lost across 39 incidents, according to Immunefi.

Bybit and Phemex accounted for most of the damage, with $1.52 billion attributed to the North Korea-linked Lazarus Group.