Iran has ordered a curfew on domestic cryptocurrency exchanges after a politically motivated attack on the country’s largest trading platform, Nobitex.
According to blockchain analytics platform Chainalysis, the June 18 hack resulted in losses upwards of $90 million.
The funds, which included assets like Bitcoin, Ethereum, Dogecoin, Ripple, Solana, Tron, and Ton, were drained from Nobitex’s hot wallets and subsequently burned, making them permanently inaccessible.
In response to the incident, the Central Bank of Iran restricted the operating hours of all local crypto exchanges, limiting them to between 10 am and 8 pm.
“This operational curfew could signal increasing pressure on exchanges operating within Iran, as the regime attempts to manage systemic risk in a market that plays an outsized role in navigating around global sanctions,” the analytics firm wrote in a recent report.
Pro-Israel hacker group Gonjeshke Darande, also known as Predatory Sparrow, has claimed responsibility and stated that the operation was intended to disrupt Iran’s sanctioned financial infrastructure. The stolen assets were sent to burner wallets without private key access, indicating a deliberate act of destruction.
Chainalysis’s findings confirmed that none of the funds were sent to mixers or exchanges, and a significant portion was transferred to addresses labeled with anti-IRGC slogans.
Some were sent to blockchain burn addresses, including Ethereum’s “0x…dead” wallet, while a portion of Bitcoin was directed to a provably unspendable address with an invalid checksum.
Nobitex is widely considered a central pillar of Iran’s crypto economy. According to Chainalysis, it has processed over $11 billion in total inflows, more than the combined inflows of Iran’s ten next-largest crypto exchanges.
It acts as the backbone for the majority of on-chain activity in the country and serves as a gateway to global markets for users cut off from traditional finance due to international sanctions.
Beyond its domestic role, Chainalysis linked Nobitex to wallets associated with a range of sanctioned and illicit actors. These include ransomware operators affiliated with Iran’s Islamic Revolutionary Guard Corps, pro-Hamas media channels such as Gaza Now, and sanctioned Russian crypto exchanges including Garantex and Bitpapa.
The Nobitex hack followed a series of Israeli airstrikes inside Iran, part of ongoing military and cyber tensions between the two countries. The attackers published inflammatory wallet labels and threatened to release internal source code and infrastructure data unless Nobitex users withdrew funds.
In its official response, Nobitex said user assets remain secure in cold storage and that all hot wallets have been emptied. It also confirmed that its reserve fund would fully cover the losses and that it has taken steps to bolster platform security, including migrating funds to new offline wallets.
