On June 18, 2025, Iranian cryptocurrency platform, Nobitex, was exploited, resulting in the loss of more than $90 million in assets spanning a range of cryptocurrencies, including Bitcoin, Ethereum, Dogecoin, Ripple, Solana, Tron, and Ton. As Iran’s largest digital asset exchange, the compromise of Nobitex marks a major development within the Iranian crypto ecosystem.
While the cryptocurrency space has always been shaped by geopolitical dynamics and associated cyber incidents, this event stands out. A pro-Israel group known as Gonjeshke Darande has claimed responsibility, framing the attack as a politically motivated strike against Iranian digital infrastructure. Notably, our analysis indicates that this is the case — the attacker-controlled wallets were burner addresses lacking private key access, suggesting that the theft of more than $90 million was likely politically motivated, rather than financial in nature. While this is the first hack of this scale exclusively for geopolitical purposes, this is not the first time there’s been increased activity during windows of high geopolitical tensions between Israel and Iran, as noted in our 2024 Crypto Crime Report.
Keep reading to learn more about Nobitex’s known links to illicit activity, Iran’s heavily sanctioned crypto ecosystem, and more.
What is Nobitex?
Nobitex is the largest cryptocurrency exchange in Iran and a central pillar of the country’s digital asset ecosystem. Operating in a heavily sanctioned environment, it has become the go-to platform for Iranian users seeking access to global crypto markets, facilitating the majority of on-chain exchange activity originating in the country.
Historically, Nobitex’s daily and monthly trading volumes have been significantly higher than those of its domestic competitors. Nobitex serves a broad user base, ranging from retail traders to entities seeking to bypass traditional financial channels. Its dominance is not only a reflection of scale, but also of necessity, as limited access to global platforms has made Nobitex a key infrastructure provider for crypto activity under Iran’s economic constraints. As seen below, Nobitex’s total inflows are well over $11 billion, compared to just under $7.5 billion for the next ten largest Iranian exchanges combined.
Nobitex’s known links to illicit activity
Past on-chain analysis has linked Nobitex to a range of illicit actors, including wallets affiliated with IRGC-affiliated ransomware operators, and entities tied to Houthi and Hamas-affiliated networks as identified by the National Bureau for Counter Terror Financing (NBCTF) of Israel. As we see in the Chainalysis Reactor graph below, the platform has also facilitated transactions with sanctioned pro-Hamas media outlet, Gaza Now, a pro-al-Qaeda propaganda channel; sanctioned Russian crypto exchanges, Garantex and Bitpapa; and many other illicit operators.
The aftermath of Nobitex’s exploit
In the immediate aftermath of the exploit, Nobitex issued a public statement, assuring users that their funds were safe. While on-chain analysis confirms that the attacker burned the stolen funds, making them irretrievable, Nobitex has taken additional steps to reinforce user trust. Notably, the exchange has moved large quantities of Bitcoin to what appear to be newly established cold storage wallets, an effort likely aimed at bolstering its security posture and reducing exposure to similar future attacks.
Beyond Nobitex itself, the incident appears to have triggered a wider response from the Iranian regime. According to reports, the Central Bank of Iran has directed all domestic crypto exchanges to limit their operating hours to between 10 AM and 8 PM, suggesting an attempt to exert greater oversight and control over the sector. This operational curfew could signal increasing pressure on exchanges operating within Iran, as the regime attempts to manage systemic risk in a market that plays an outsized role in navigating around global sanctions.
Why does this matter?
Nobitex isn’t just a local exchange; it serves as a critical hub within Iran’s heavily sanctioned crypto ecosystem, enabling access to global markets for users cut off from traditional finance. Today’s exploit underscores the inherent tension between the borderless nature of cryptocurrency and the geopolitical realities of nation-state restrictions. It also highlights the urgent need for continued blockchain intelligence and off-chain analysis to monitor risk, uncover sanctions evasion among other illicit activity, and provide clarity in high-risk jurisdictions.
Chainalysis continues to monitor Iran’s crypto ecosystem in the wake of the Nobitex exploit, with a focus on surfacing insights into how the Iranian crypto ecosystem responds to today’s action. By combining on-chain forensics with geopolitical context, we help public and private sector partners navigate emerging risks with clarity and precision.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.
The post Nobitex, Sanctions, and The $90 Million Exploit: A Window into Iran’s Largest Crypto Exchange appeared first on Chainalysis.
