An onchain investigator has flagged a major breach at Iran-based Nobitex, where hackers made off with more than $81 million in digital assets.
Based on reports from blockchain sleuth ZachXBT, at least $81.7 million was moved out of the exchange’s hot wallets on June 16, 2025. The stolen funds came from both the Tron network and various Ethereum Virtual Machine (EVM) chains.
Massive Funds Drained From Hot Wallets
According to ZachXBT’s Telegram post, the first chunk—$49 million—went through a vanity address that read “TKFuckiRGCTerrorists…mNX.” A second custom address, “0xffFFfFFffFF…Dead,” was used to pull the rest.
These special wallet names aren’t random. They show how attackers slipped around Nobitex’s checks and grabbed funds meant to stay locked down.
Vanity Addresses Exploit Access Controls
Experts say the use of these human‑readable addresses points to a flaw in the exchange’s internal controls. “Attackers managed to infiltrate systems that should have blocked unauthorized wallets,” noted Hakan Unal of Cyvers security. The exchange confirmed that it spotted the breach quickly and suspended the affected hot wallets.
Political Motive Behind The Breach
A pro‑Israel hacker group calling itself “Gonjeshke Darande” claimed responsibility in an X post. The group called Nobitex a tool for “regime financing” and threatened to release source code and internal files within 24 hours.
After the IRGC’s “Bank Sepah” comes the turn of Nobitex
WARNING!
In 24 hours, we will release Nobitex’s source code and internal information from their internal network.
Any assets that remain there after that point will be at risk!
The Nobitex exchange is at the heart of the… pic.twitter.com/GFyBCPCFIE
— Gonjeshke Darande (@GonjeshkeDarand) June 18, 2025
They warned that any assets left on the platform would be in danger. This hack comes as tensions surged between Israel and Iran after Israel’s largest strikes on Iran since the 1980s. Reports say at least 224 people died in Iran and 24 in Israel during the renewed conflict.
Cold Storage And User Security Assurances
Nobitex says users’ main funds are safe in cold storage, and only a fraction of hot‑wallet assets were hit. The exchange promised to cover all losses with its insurance fund and internal resources. That promise should reassure customers, though the fear of leaked code or files could drive some to pull funds.
Unmoved Funds Could Reveal Next Steps
Interestingly, none of the stolen coins have moved since the hack was first spotted. That could mean the hackers are choosing their next move. Or it might be a warning shot meant to show they can strike again.
Either way, this incident highlights how vital it is for exchanges to guard against insider‑level slip‑ups. Protocols alone aren’t enough if people and processes leave doors open.
As the crypto world watches, Nobitex users will be looking closely at how the platform rebuilds trust and keeps their money safe.
Featured image from Unsplash, chart from TradingView
