This morning, the pro-Israeli hacker group Gonjeshke Darande hacked the Iranian exchange Nobitex, stealing $82 million in cryptocurrencies. Here’s what you need to know about the attack.
Hackers affiliated with Israel hack the Nobitex crypto exchange
Shortly before 9 a.m. this morning, on-chain investigator ZachXBT alerted his community on his Telegram channel to a hack on the Iranian cryptocurrency exchange Nobitex. At the time of reporting, approximately $47 million had already been stolen from the Tron (TRX) blockchain, and the address involved now holds $49.45 million at the time of writing.
Suspicious activity was quickly identified on other blockchains as well, to the point that losses now total more than $82 million, spread across the following networks:
- $49.45 million on Tron;
- $11.33 million on Ethereum;
- $6.73 million on Dogecoin;
- $6.17 million on BNB Chain;
- $4.86 million on Arbitrum One;
- $1.94 million on Bitcoin
- $1.04 million on Polygon;
- $884,000 on Avalanche C-Chain.
Initially at 8:13 a.m., Nobitex teams announced a temporary suspension of access to the website “due to problems with the country’s internet infrastructure,” but a few minutes later, a new statement revealed unauthorized access. Nobitex then attempted to reassure its customers by explaining that the lost funds came from hot wallets, where the majority of funds were stored on cold wallets.
The platform stated that it would take responsibility:
Nobitex accepts full responsibility for this incident and assures users that all damages will be compensated by Nobitex’s insurance fund and resources.
At 9 a.m. sharp, Gonjeshke Darande, a group of hackers affiliated with Israel, claimed responsibility for the hack, explaining that the attack would take another turn within 24 hours:
In 24 hours, we will publish Nobitex’s source code and information about their internal network. Any assets remaining after that point will be at risk! The Nobitex exchange is central to the regime’s efforts to finance terrorism around the world, and is also the regime’s preferred tool for violating sanctions. […] Nobitex does not even pretend to comply with sanctions. In fact, the company publicly explains to users how to use its infrastructure to circumvent them.
Since then, the Nobitex team has communicated several times to provide updates on the progress of the work. “The exact scope of the incident” is now to be announced shortly, along with “the terms for restoring services.” Furthermore, the exchange maintains that user funds have not been affected and that users will be able to recover their balances in full once services resume.
As more and more media outlets use the word “war” to describe the conflict between Israel and Iran, we are seeing that the fighting is even spilling over into the digital world.
