Nobitex June 2025 Hack (Predatory Sparrow)
Incidents are rated for severity, not trust. The trust score is on Nobitex.
Summary
On June 18, 2025, pro-Israel cyber group Gonjeshke Darande (Predatory Sparrow) breached Nobitex, Iran's largest cryptocurrency exchange, transferring over $90 million in user assets to computationally inaccessible vanity wallet addresses embedded with anti-IRGC political statements, effectively destroying the funds rather than stealing them. The attack was explicitly framed as a political operation targeting what the group characterized as a key instrument of Iranian sanctions evasion and terrorism financing, not a financially motivated theft. The incident was followed within 24 hours by the public release of Nobitex's full source code, exposing internal privacy-evasion modules, hardcoded banking credentials, and alleged bypass logic for politically sensitive accounts.
Connected Entities
13 entities · 60 linked investigations- 1Fucki…ovLX→mentioned with→Nobitex June 2025 Hack (Predatory Sparrow)(50%)
- DFucki…W65t→mentioned with→Nobitex June 2025 Hack (Predatory Sparrow)(50%)
- TKFuck…7mNX→mentioned with→Nobitex June 2025 Hack (Predatory Sparrow)(50%)
- Amir Hossein Rad→mentioned with→Predatory Sparrow (Gonjeshke Darande)(75%)
- Amir Hossein Rad→mentioned with→Nobitex(80%)
- Predatory Sparrow (Gonjeshke Darande)→mentioned with→Nobitex(80%)
- Predatory Sparrow (Gonjeshke Darande)→mentioned with→Dogecoin(70%)
- Predatory Sparrow (Gonjeshke Darande)→mentioned with→Ethereum(70%)
- Predatory Sparrow (Gonjeshke Darande)→mentioned with→Solana(70%)
- Predatory Sparrow (Gonjeshke Darande)→mentioned with→Bitcoin(70%)
- + 26 more
Connected Through
9 shared actors · 616 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □ZachXBTorganization
- ♦Bitcointoken
- □Solanaorganization
Timeline(7 events)
13 June 2025
Israeli airstrikes targeting Iranian military assets commence, marking the start of kinetic military escalation between Israel and Iran.
SecurityWeek15 June 2025
Iran launches direct missile response to Israeli airstrikes, escalating the conflict.
SecurityWeek17 June 2025
Predatory Sparrow claims cyberattack on Bank Sepah, a state-owned Iranian bank, disrupting nationwide fuel and payment systems.
CyberScoop18 June 2025
Predatory Sparrow breaches Nobitex hot wallets via compromised private keys, transferring over $90 million across Bitcoin, Ethereum, TRON, Dogecoin, XRP, Solana, and TON to computationally inaccessible vanity addresses embedded with anti-IRGC political statements. Nobitex takes its website and app offline.
Elliptic / Chainalysis / CNBC19 June 2025
Predatory Sparrow publishes Nobitex's full source code, internal files, and server list publicly, announcing 'ASSETS LEFT IN NOBITEX ARE NOW ENTIRELY OUT IN THE OPEN.'
CoinDesk19 June 2025
TRM Labs begins analysis of leaked Nobitex source code, identifying privacy-evasion modules, hardcoded banking API credentials, and VIP account bypass logic.
TRM Labs2 June 2026
OFAC formally designates Nobitex and three other Iranian exchanges (Wallex, Bitpin, Ramzinex) for sanctions evasion, terrorist financing, and regime support. Four Nobitex executives are individually designated.
Chainalysis / EllipticDecision Log
- slot 445505714 · hash 5e9kVRjPYT6YTURo2nRph34vUr1df63GL8TosAG3NfN8
- slot 443519048 · hash 65oX7yRLeux5CN5mJh6SLAAUpAG2vz5HiQ47WLyvptNM
- slot 443519021 · hash A3frtDtppwfTL1W2nn7mv3QrJgPxjNmJkLL9x6ohStLx
- slot 429280494 · hash Hd7sVH1KP7rYxxQoFwG9MoPNHM7PvmuG4DCvy97YUJ46
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 20 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 6/27/2026, 5:21:58 PM
last updated: 8/26/2026, 5:03:44 AM
5 viewsavoid.net — verified advice for a post-truth world