Nobitex Exchange Drain and Burn (June 18, 2025)

Overview

On June 18, 2025, during active military conflict between Israel and Iran, Iran's largest cryptocurrency exchange, Nobitex, was drained of approximately $90M from its hot wallets across multiple blockchains, including EVM-compatible chains, Tron, and Bitcoin. The attack was not financially motivated and stands almost alone in the incident record for that reason: the perpetrators, the pro-Israel hacking group Gonjeshke Darande (Persian for Predatory Sparrow), did not attempt to keep or launder the stolen crypto. Instead they sent it to vanity burn addresses, wallets whose strings contained anti-regime and anti-IRGC political slogans (for example, strings mocking the Islamic Revolutionary Guard Corps), and for which it is computationally infeasible to ever derive a spending private key. The funds were therefore destroyed, not stolen, a symbolic act of sabotage rather than theft. The root cause was conventional: compromised hot-wallet private keys, reflecting poor off-chain key-management hygiene rather than any smart-contract flaw. The following day the attackers escalated, threatening to publish Nobitex's source code and internal infrastructure within twenty-four hours, and then making good on the threat, exposing the exchange's codebase and configuration and enabling further analysis of Iran's crypto infrastructure (later examined by TRM Labs, among others). Nobitex suspended services, said it would restore access and compensate users from its reserves and insurance, and the incident became the defining example of cryptocurrency exchanges as targets in nation-state cyber-conflict, where the objective is to inflict economic and reputational damage on an adversary's financial infrastructure rather than to profit. It sits alongside the same group's earlier sabotage of Iranian fuel-distribution and steel systems as part of a sustained campaign against Iranian critical infrastructure.

Timeline and geopolitical context

The Nobitex breach occurred on June 18, 2025, against the backdrop of an intense and rapidly-escalating Israel-Iran military confrontation. Gonjeshke Darande, known in English as Predatory Sparrow, is a hacking group widely understood to act in alignment with Israeli interests and which had previously claimed responsibility for disruptive attacks on Iranian critical infrastructure, including fuel-distribution systems and a steel plant. On June 18 the group drained roughly $90M from Nobitex's hot wallets across EVM chains, Tron, and Bitcoin, and publicly claimed the operation, framing it explicitly in political terms as an attack on the financial infrastructure of the Iranian regime and its security apparatus. The following day the group threatened to release Nobitex's source code and internal infrastructure details within twenty-four hours, and subsequently followed through, publishing the exchange's codebase and sensitive configuration. Nobitex suspended deposits and withdrawals and its broader platform in the immediate aftermath, working to migrate to fresh infrastructure and restore services. Elliptic, CNBC, and other blockchain-analytics commentary reported the scale and the burn mechanism within days, and TRM Labs later published analysis of what the leaked source code revealed about Iran's crypto infrastructure and Nobitex's role in sanctioned-finance flows. The timing, mid-conflict, and the explicitly political framing distinguish this from the financially-motivated thefts that dominate the rest of the incident record.

Attack mechanism

The technical entry mechanism was conventional and is, by the standards of the incident class, unremarkable: the attackers obtained Nobitex's hot-wallet private keys, which were insecurely stored on systems the attackers were able to compromise. There was no smart-contract exploit, no clever reentrancy, no oracle manipulation; this was a custodial-key compromise of the same broad family as the Coincheck (2018) and many other exchange hot-wallet thefts, in which the security failure is in off-chain key management rather than on-chain code. What makes Nobitex mechanistically distinctive is not how the funds were taken but where they were sent. Rather than routing the stolen assets through mixers, cross-chain bridges, or exchanges to launder and cash out, the attackers sent the funds to vanity burn addresses: addresses deliberately constructed to contain human-readable political messages within the address string itself, such as slogans denouncing the IRGC. Because a usable cryptocurrency address corresponds to a private key, and because it is computationally infeasible to find a private key that produces an arbitrary chosen vanity string of that length, these addresses are provably unspendable, no one, including the attackers, can ever move the funds out of them. The assets are therefore destroyed. This converts the act from theft into sabotage: the economic value is annihilated rather than transferred, and the political message is literally inscribed on-chain in the destination addresses for permanent public display.

Root cause analysis

The proximate root cause was insecure storage of hot-wallet private keys on compromisable systems, a failure of off-chain operational security rather than of any on-chain mechanism. Custodial exchanges hold the canonical single-point-of-failure: whoever controls the private keys controls the funds, and any pathway by which an attacker can reach those keys, whether through server compromise, insider access, or, as in the Bybit and WazirX cases, manipulation of the signing flow, is sufficient. Nobitex's failure was the most basic version of this: keys reachable on systems the attacker could breach. The deeper root cause, however, is contextual rather than technical. Nobitex was, by design, a high-value target in a nation-state cyber-conflict: as Iran's largest exchange and a node in the country's mechanisms for moving value under international sanctions, it represented financial infrastructure whose disruption carried strategic and symbolic value for an adversary. The conventional incident-response question, how to recover or trace the stolen funds, was moot, because the attackers never intended to keep the funds. The relevant root cause for defenders is therefore that an exchange operating as critical financial infrastructure for a state under conflict must assume it is a target for politically-motivated destruction, not only financially-motivated theft, and that its threat model must include adversaries whose goal is to burn its reserves and dox its codebase rather than to profit.

The burn mechanism and its meaning

The use of vanity burn addresses is the conceptual heart of the Nobitex incident and is worth understanding precisely. In normal operation, sending cryptocurrency to an address that no one controls the key for is an irreversible loss; the assets remain visible on-chain forever but can never be moved. Attackers seeking profit go to great lengths to avoid this, carefully laundering through mixers and cross-chain hops to preserve and obscure value. Gonjeshke Darande did the opposite on purpose: they constructed destination addresses whose strings encoded political slogans, which guarantees the addresses are not derived from any known key and are computationally infeasible to ever spend from, and then deliberately sent the stolen assets there. The result is a permanent, public, on-chain monument: roughly $90M of the Iranian regime's exchange reserves, provably and irrevocably destroyed, with the reason for their destruction inscribed in the very addresses holding them. The act communicates several things simultaneously: that the attackers had full control of the funds (they could have kept them), that profit was never the goal, that the operation was an act of war or protest rather than crime, and that the damage is irreversible. It also sidesteps the laundering and sanctions exposure that keeping the funds would have entailed, the attackers face no cash-out problem because there is no cash-out. For the broader industry, it is a vivid demonstration that the same custodial-key compromise that normally precedes a theft can instead be used for pure economic sabotage.

The source-code leak and its consequences

The second phase of the operation, the threatened and then executed publication of Nobitex's source code and internal infrastructure, amplified the damage well beyond the $90M burn. By exposing the exchange's codebase and sensitive configuration, the attackers handed both security researchers and other adversaries a detailed map of Nobitex's systems, including any further vulnerabilities, and they exposed operational and architectural details of how Iran's largest exchange functioned. TRM Labs and other analysts subsequently mined the leaked materials for insight into Iran's crypto infrastructure, including how Nobitex interfaced with sanctioned-finance flows and the structure of its wallet and key-management systems. The leak therefore served multiple adversarial purposes: it deepened the immediate operational disruption (Nobitex had to assume its entire codebase was compromised and rebuild accordingly), it provided intelligence value to parties studying Iran's sanctions-evasion infrastructure, and it inflicted lasting reputational damage by demonstrating that the exchange's most sensitive internal assets were not safe. The combination, burn the reserves and dox the code, is a more complete act of infrastructure sabotage than either alone, and it reflects the operational sophistication of a group whose objective was maximal damage to an adversary's financial node rather than the narrow extraction of value.

Response and aftermath

Nobitex suspended its platform in the immediate aftermath, working to migrate to fresh infrastructure given that its codebase and configuration had been exposed, and stated that it would restore user access and compensate affected users from its reserves and insurance fund, an important distinction from the financially-motivated thefts where the funds are gone to an adversary who keeps them; here the exchange's stated position was that user balances would be made whole from its own resources even though the burned hot-wallet funds were irrecoverable. The incident drew attention from international analytics firms and sanctions-focused researchers, both because of its geopolitical character and because the leaked source code offered a rare window into the workings of a major Iranian exchange. For Iran, the breach was a significant blow to a piece of financial infrastructure that had operated as a relief valve under sanctions, and it underscored the vulnerability of such infrastructure to state-aligned adversaries. There was, by the nature of the operation, no funds-tracking or recovery story in the conventional sense: the assets were destroyed, the perpetrators sought no profit, and there was nothing to freeze or claw back. The relevant aftermath is strategic, the establishment of cryptocurrency exchanges as legitimate targets in nation-state cyber-conflict, and the demonstration that economic sabotage via custodial-key compromise and on-chain burning is a viable and impactful technique.

Industry implications and verdict

Nobitex is the canonical example of cryptocurrency as a theater of nation-state cyber-conflict, and it reframes several assumptions. First, it expands the exchange threat model beyond profit-motivated theft to include politically-motivated destruction: an exchange that is strategically significant to a state, especially a state in active conflict, must assume adversaries whose goal is to burn its reserves and expose its code, against whom the usual recovery and bounty playbooks are irrelevant. Second, it confirms that the dominant exchange-security failure remains mundane custodial key management: as with Coincheck and many others, the funds were lost because hot-wallet keys were reachable, not because of any exotic on-chain flaw, and the remedy is the same well-understood discipline of hardware-backed key storage, minimized hot-wallet balances, and rigorous segregation. Third, the vanity-burn technique is a durable demonstration that the same key compromise that enables theft enables sabotage, and that the irreversibility of on-chain transfers, usually a hazard to be avoided, can be weaponized. Fourth, the source-code leak underscores that an exchange's codebase and infrastructure configuration are themselves high-value targets whose exposure compounds a breach. The verdict is that Nobitex sits outside the ordinary taxonomy of crypto incidents: it was not a theft to be traced and recovered but an act of economic warfare to be understood as such, and it stands as a warning that financial infrastructure in geopolitically contested contexts faces a class of adversary for whom destruction, not profit, is the point.

Recovery

None in the conventional sense: the ~$90M was destroyed (sent to provably-unspendable vanity burn addresses), not stolen, so there was nothing to trace, freeze, or claw back. Nobitex suspended services, migrated to fresh infrastructure after the source-code leak, and stated it would restore user access and compensate affected users from its own reserves and insurance fund.

Frequently asked questions

Related

• Coincheck NEM Hot-Wallet Theft (Jan 26, 2018)
• Bybit Cold Wallet Compromise (Feb 21, 2025)
• WazirX Exchange Hack (Jul 18, 2024)
• Mt. Gox Hot-Wallet Drain and Collapse (2011-2014)
• ofac
• ethereum
• tron
• bitcoin