Iran has imposed a nationwide curfew on domestic cryptocurrency exchanges following a politically motivated cyberattack on Nobitex, the country’s largest digital asset platform.
The June 18 hack, claimed by the pro-Israel hacker group Gonjeshke Darande (Predatory Sparrow), resulted in losses exceeding $81 million.
The stolen funds—including Bitcoin, Ethereum, Dogecoin, Ripple, Solana, Tron, and Ton—were drained from Nobitex’s hot wallets and deliberately burned, making them permanently unrecoverable.
The ongoing battle between Iran and Israel
The attack is a result of the escalation in cyber hostilities between Iran and Israel, coming just after a series of Israeli airstrikes inside Iran.
Gonjeshke Darande framed the breach as a targeted disruption of Iran’s sanctioned financial systems, stating the operation aimed to undermine the regime’s ability to bypass international restrictions.
Chainalysis, a blockchain analytics firm, confirmed the stolen assets were sent to burn addresses, including Ethereum’s “0x…dead” wallet and a Bitcoin address with an invalid checksum, ensuring they could never be accessed.
In response, Iran’s Central Bank restricted the operating hours of all local cryptocurrency exchanges, limiting them to between 10:00 AM and 8:00 PM.
“This operational curfew could signal increasing pressure on exchanges operating within Iran, as the regime attempts to manage systemic risk in a market that plays an outsized role in navigating around global sanctions,” Chainalysis noted in its report.
Nobitex is more than just an exchange—it’s the backbone of Iran’s cryptocurrency ecosystem. The exchange has processed over $11 billion in inflows, which dwarfs the combined activity of Iran’s following ten largest platforms.
The exchange serves as a critical gateway for users cut off from traditional finance due to sanctions, facilitating access to global markets.
However, Chainalysis has also linked Nobitex to illicit actors, including wallets tied to Iran’s Islamic Revolutionary Guard Corps (IRGC), the pro-Hamas media outlet Gaza Now, and sanctioned Russian exchanges such as Garantex and Bitpapa.
Following the hack, Nobitex assured users that their assets in cold storage remained secure and that all hot wallets had been emptied. The exchange stated its reserve fund would cover the losses and announced enhanced security measures, including migrating funds to new offline wallets.
Meanwhile, the attackers threatened to leak internal source code and infrastructure data unless users withdrew their funds.
Geopolitical tensions spill into crypto warfare
The latest breach highlights how cryptocurrency platforms are becoming increasingly battlegrounds in geopolitical conflicts.
Unlike typical financially motivated hacks, this attack was designed to inflict economic damage in the nation, with stolen funds deliberately destroyed rather than laundered.
As the financial regulator tightens controls on the crypto sector, the curfew may foreshadow further crackdowns.