Iranian crypto exchange Nobitex begins restoring service following $90 million exploit

Iranian crypto exchange Nobitex, the largest in the country, has slowly begun restoring service to its users following the $90 million attack earlier in June allegedly perpetrated by a pro-Israel group. 

Nobitex is opening up the exchange only to users who have been verified, the company said on X, though withdrawal, deposit, and trading services remain disabled. Nobitex previously said it plans on resuming withdrawals on Monday, June 30, though the company noted its timeline may change. 

Gonjeshke Darande, the pro-Israel hacker group that claimed to be behind the attack, destroyed the stolen funds and also shared what it said was parts of the platform's source code, exacerbating the damage to Nobitex. TRM Labs speculated that Israel may have used information stolen from Nobitex to arrest Iranian agents in Israel that were paid in cryptocurrency. 

Nobitex noted in its announcement that it migrated users' wallets, likely as a result of the compromise, and that deposits to existing wallets would be invalid. 

The exchange dwarfs other Iran-based crypto exchanges, with $11 billion in total inflows compared to under $7.5 billion for the next ten largest exchanges combined, according to Chainalysis. The research firm has also tied Nobitex to a "range of illicit actors," including IRGC-affiliated ransomware operators and sanctioned Russian crypto exchanges. Crypto use in Iran, like in Russia, is often linked to evasion of international monetary sanctions. 

Nobitex's chief executive, Amir Rad, said Nobitex's investigation into the breach indicated it was supported by Israel's government, and claimed Nobitex is a private company with no affiliation to the Iranian state or Iran's military.