Nobitex Begins Gradual Recovery After $90M Hack Tied to Pro-Israel Group

Iran’s largest cryptocurrency exchange, Nobitex, has started to restore access to its platform weeks after suffering a $90 million cyberattack in early June. The company is cautiously reopening services, allowing verified users back onto the platform—but for now, trading, deposits, and withdrawals remain suspended.

Nobitex announced via social media that while it’s taking initial steps to bring operations back online, it’s proceeding carefully. The exchange had earlier stated that withdrawals could resume as early as June 30, but acknowledged that the timeline may shift depending on security developments.

The attack, claimed by a pro-Israel hacker group called Gonjeshke Darande, not only resulted in the theft of millions in digital assets but also led to additional damage. The group reportedly destroyed the stolen crypto and released what it said was part of Nobitex’s source code. Cybersecurity firm TRM Labs has speculated that data taken in the breach might have been used by Israeli authorities in recent operations against Iranian agents allegedly funded through crypto.

In response to the breach, Nobitex said it had migrated users to new wallets, warning that deposits to previous wallet addresses would no longer be valid. The exchange’s efforts to reset its infrastructure reflect the scale and seriousness of the incident.

According to blockchain analytics firm Chainalysis, Nobitex dominates Iran’s crypto space, having processed more than $11 billion in inflows—significantly more than the next ten Iranian exchanges combined. However, the company has also drawn scrutiny. Chainalysis has linked Nobitex to various sanctioned entities, including Iranian Revolutionary Guard-affiliated ransomware groups and Russian crypto platforms under international sanctions.

Iranian Exchange Nobitex: The $90M Exploit

Iranian cryptocurrency platform, Nobitex, was exploited, resulting in the loss of more than $90 million in assets spanning a range of cryptocurrencies.

ChainalysisChainalysis Team

In a statement, Nobitex CEO Amir Rad pushed back against allegations of state affiliation, emphasizing that the exchange is a private entity with no formal ties to the Iranian government or military. He further claimed that the cyberattack bore signs of support from the Israeli state.

As Nobitex works to recover from one of the largest crypto attacks in the region, the incident highlights the increasing geopolitical complexity surrounding digital assets—especially in countries facing international restrictions.