Iran Clamps Down on Crypto Exchanges After $100M Nobitex Hack

The attack, claimed by pro-Israel hacker group Gonjeshke Darande, has sent shockwaves through Iran’s crypto ecosystem, raising questions about cybersecurity, geopolitical tensions, and the future of digital finance in a sanctioned economy. This bold move underscores Iran’s struggle to balance financial innovation with national security amid escalating regional conflicts.

A Devastating Cyberattack

Nobitex, which processes over $11 billion in crypto inflows annually, more than Iran’s next ten exchanges combined, was breached in a sophisticated cyberattack. Hackers drained hot wallets containing Bitcoin, Ethereum, Dogecoin, XRP, Solana, Tron, and Toncoin, with losses estimated at $100 million by blockchain analytics firm Chainalysis.

Unlike typical crypto heists aimed at profit, the attackers sent the stolen funds to “burner” addresses, wallets with no private key access, effectively destroying the assets.

These addresses carried inflammatory labels like “F*ckIRGCterrorists,” signaling a political motive tied to Iran-Israel tensions.

The hack, attributed to Gonjeshke Darande (Farsi for “Predatory Sparrow”), came amid a flare-up in hostilities, following Israeli airstrikes on Iranian targets on June 13. The group, previously linked to attacks on Iranian infrastructure like gas stations in 2021 and a steel mill in 2022, also threatened to leak Nobitex’s source code, exposing critical security details.

This breach not only crippled Nobitex’s operations but also highlighted vulnerabilities in Iran’s digital economy, which relies heavily on crypto to bypass international sanctions.

Why the Curfew?

The Central Bank’s curfew is a direct response to the Nobitex hack, aimed at tightening oversight and reducing the risk of further cyberattacks. The move also addresses fears of capital flight, a growing concern as Iran’s economy faces pressure from sanctions and regional instability.

This isn’t Iran’s first crackdown on crypto. In December 2024, the government temporarily shut down exchanges to stabilize the plummeting Iranian rial. The current curfew, however, marks a shift from earlier policies promoting crypto as a tool for economic resilience.

Finance Minister Abdolnaser Hemmati had previously championed digital currencies to boost youth employment and counter U.S. sanctions, but the Nobitex breach has forced a rethink.

Nobitex: Iran’s Crypto Powerhouse

Nobitex is the backbone of Iran’s crypto economy, serving over 11 million users and handling 87% of the country’s crypto inflows in 2022. Its dominance stems from necessity: sanctions have cut Iranians off from global financial systems, making platforms like Nobitex critical for cross-border transactions.

However, its prominence has also made it a target. Blockchain analysis by Elliptic and Chainalysis has linked Nobitex to illicit activities, including transactions with IRGC-affiliated ransomware operators and sanctioned entities like Russian exchanges Garantex and Bitpapa.

The exchange has since moved remaining funds to cold storage and pledged to cover losses using its reserve fund. Nobitex’s technical team is working to restore services, but ongoing internet disruptions and enhanced security protocols may delay full recovery.

The hack has already dented user confidence, with TRX and Tether trading at a 3-5% discount on Iranian P2P markets compared to global prices.

Global Implications

Iran’s curfew sets a precedent that could ripple through the global crypto market. Unlike the 24/7 nature of decentralized finance, this restriction challenges the ethos of uninterrupted access.

Critics argue it may erode trust in local platforms, pushing traders to international exchanges or VPNs to bypass controls, as seen in 2022 when Iranian crypto enthusiasts promoted OpenVPN for accessing global markets.

The hack also underscores the growing weaponization of cyber infrastructure in geopolitical conflicts. Similar incidents have occurred elsewhere: in 2023, North Korean hackers stole $340 million from crypto platforms to fund state programs, while Russia’s Garantex faced sanctions for facilitating illicit flows.

What’s Next for Iran’s Crypto Scene?

The Nobitex hack and subsequent curfew highlight the tightrope Iran walks between embracing crypto and managing its risks. For retail investors, the restricted hours could limit trading flexibility, while institutional players may face stricter KYC rules and mandatory cold storage requirements.

Globally, the incident serves as a wake-up call. Exchanges worldwide face mounting pressure to strengthen security, as political motives increasingly drive cyberattacks.

For Iran, the path forward involves rebuilding trust in its crypto infrastructure while navigating a hostile geopolitical landscape.