Iran’s Nobitex Slowly Restores Services After $90M Hack by Pro-Israel Group

Highlights:

• Nobitex starts phased recovery, spot wallets open only for verified users first.
• Around $100 million was stolen in the June 18 hack linked to a pro-Israel hacker group.
• Users are warned that old wallet addresses are inactive and may cause permanent fund loss.

Iran’s largest crypto exchange, Nobitex, has begun restoring wallet access to users after suffering a major exploit earlier this month that resulted in losses exceeding $90 million. On June 29, the exchange shared an update on X, saying only verified users will get access first. For now, only spot wallets are open. Other wallets will be available after users finish ID checks. The exchange also asked users to wait for confirmation before checking their balances, which will appear slowly as security reviews continue.

Follow- up on Nobitex Security Incident, Step-by-step wallet access has begun, 29 June 2025

Please note:

1. This process is being carried out gradually, starting with verified users and initially for spot wallets, followed by other types of wallets.

2. The identity…

— Nobitex | نوبیتکس (@nobitexmarket) June 29, 2025

Exchange Starts Recovery After $100M Crypto Hack

Nobitex said it will start showing wallet balances in steps once all data is fully checked and secure. The exchange aims to complete this process by mid-week, but the timeline may change depending on technical or security issues. The June 18 hack was carried out by Gonjeshke Darande, also known as Predatory Sparrow, a pro-Israel hacking group. Blockchain experts estimate that around $90–100 million in digital assets were stolen from hot wallets on Ethereum and Tron networks. The stolen assets include Bitcoin, Ethereum, and Dogecoin.

The hacking group claimed it attacked Nobitex due to its links with the Iranian government and support for malicious actors. According to a report by Chainalysis, Nobitex plays a key role in Iran’s crypto system, handling $11 billion in inflows—more than all other top ten Iranian exchanges combined, which saw $7.5 billion. Chainalysis also found, through onchain analysis, that Nobitex is connected to several malicious and sanctioned entities. 

After the Nobitex hack, Iranian authorities limited local crypto exchanges to work from 10 a.m. to 8 p.m. But the recent hack has shaken user trust and raised doubts about Iran’s financial security, especially as cyber threats become more advanced.

NOW: Iran orders crypto exchange curfew (10 am–8 pm) after a $90–100M hack on @nobitexmarket, aimed at preventing capital flight and improving incident response.#Israel #IsraellranConflict #Iran #IranIsraelConflict pic.twitter.com/BQxF9sNLzQ

— Coin Headlines (@coinheadline) June 19, 2025

Nobitex Warns Users as Wallets Reopen After Major Hack

Nobitex cautioned users against depositing any crypto into its old wallet addresses, warning that this could lead to the loss of their funds. “Due to the wallet system migration, previous addresses are no longer valid, and any deposits made to them may result in loss of funds,” the post read. The exchange asked users with saved settings, like mining devices or auto-withdrawals, to update their info or wait for new wallet addresses. This slow restart follows a major hack earlier this month that even got the attention of Iran’s central bank.

In a post shared on X on Tuesday, Iran’s Nobitex announced that it will begin withdrawal services on June 30. The exchange also mentioned that it expects to fully restore all platform functionalities in the coming days. However, the exchange noted that the timeline could change based on the outcome of ongoing system checks.

Follow- up on Nobitex Security Incident- june 24, 2025
Nobitex Service Restoration Roadmap

As outlined in previous updates, Nobitex is working to restore its services in a secure and stable manner. This process will be carried out gradually and in multiple phases, with each…

— Nobitex | نوبیتکس (@nobitexmarket) June 24, 2025