Skip to main content
AVOID.NET
Sign in

Nobitex June 2025 Hack (Predatory Sparrow)

avoid.net/nobitex-june-2025-hack-predatory-sparrow→10/100·91% conf.
[VERIFIED]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·4bjsjU…6iWm

Summary

On June 18, 2025, pro-Israel cyber group Gonjeshke Darande (Predatory Sparrow) breached Nobitex, Iran's largest cryptocurrency exchange, transferring over $90 million in user assets to computationally inaccessible vanity wallet addresses embedded with anti-IRGC political statements, effectively destroying the funds rather than stealing them. The attack was explicitly framed as a political operation targeting what the group characterized as a key instrument of Iranian sanctions evasion and terrorism financing, not a financially motivated theft. The incident was followed within 24 hours by the public release of Nobitex's full source code, exposing internal privacy-evasion modules, hardcoded banking credentials, and alleged bypass logic for politically sensitive accounts.

Connected Entities

13 entities · 60 linked investigations
Organizations
□Amir Hossein Rad0□Ethereum64□Nobitex June 2025 Hack (Predatory Sparrow)□Nobitex□Solana□Predatory Sparrow (Gonjeshke Darande)□ZachXBT□Nobitex / Wallex / Bitpin / Ramzinex
Tokens
♦Dogecoin♦Bitcoin
Wallets
◇1Fucki…ovLX◇DFucki…W65t◇TKFuck…7mNX
Relationships
  • 1Fucki…ovLX→mentioned with→Nobitex June 2025 Hack (Predatory Sparrow)(50%)
  • DFucki…W65t→mentioned with→Nobitex June 2025 Hack (Predatory Sparrow)(50%)
  • TKFuck…7mNX→mentioned with→Nobitex June 2025 Hack (Predatory Sparrow)(50%)
  • Amir Hossein Rad→mentioned with→Predatory Sparrow (Gonjeshke Darande)(75%)
  • Amir Hossein Rad→mentioned with→Nobitex(80%)
  • Predatory Sparrow (Gonjeshke Darande)→mentioned with→Nobitex(80%)
  • Predatory Sparrow (Gonjeshke Darande)→mentioned with→Dogecoin(70%)
  • Predatory Sparrow (Gonjeshke Darande)→mentioned with→Ethereum(70%)
  • Predatory Sparrow (Gonjeshke Darande)→mentioned with→Solana(70%)
  • Predatory Sparrow (Gonjeshke Darande)→mentioned with→Bitcoin(70%)
  • + 26 more
Also appears in
Iranian Crypto Exchanges OFAC Designation — Nobitex, Wallex, Bitpin, Ramzinex (June 2026)·0Amir Hossein Rad·0Ethereum·64Nobitex / Wallex / Bitpin / Ramzinex·0Lendf.me·30Levyathan·18Jump Trading·42StableMagnet·2Shibarium·28Bankr·18+ 50 more

Connected Through

9 shared actors · 628 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Nobitex June 2025 Hack (Predatory Sparrow)?

Timeline(7 events)

13 June 2025

Israeli airstrikes targeting Iranian military assets commence, marking the start of kinetic military escalation between Israel and Iran.

SecurityWeek

15 June 2025

Iran launches direct missile response to Israeli airstrikes, escalating the conflict.

SecurityWeek

17 June 2025

Predatory Sparrow claims cyberattack on Bank Sepah, a state-owned Iranian bank, disrupting nationwide fuel and payment systems.

CyberScoop

18 June 2025

Predatory Sparrow breaches Nobitex hot wallets via compromised private keys, transferring over $90 million across Bitcoin, Ethereum, TRON, Dogecoin, XRP, Solana, and TON to computationally inaccessible vanity addresses embedded with anti-IRGC political statements. Nobitex takes its website and app offline.

Elliptic / Chainalysis / CNBC

19 June 2025

Predatory Sparrow publishes Nobitex's full source code, internal files, and server list publicly, announcing 'ASSETS LEFT IN NOBITEX ARE NOW ENTIRELY OUT IN THE OPEN.'

CoinDesk

19 June 2025

TRM Labs begins analysis of leaked Nobitex source code, identifying privacy-evasion modules, hardcoded banking API credentials, and VIP account bypass logic.

TRM Labs

2 June 2026

OFAC formally designates Nobitex and three other Iranian exchanges (Wallex, Bitpin, Ramzinex) for sanctions evasion, terrorist financing, and regime support. Four Nobitex executives are individually designated.

Chainalysis / Elliptic
Provenance & Audit Trail
Anchored on SolanaVerify on-chain20 Wayback Archives

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (4 events). 20 of 20 cited source URLs have an Internet Archive snapshot.

Fact-checked 2026-09-0626 claims checked2 corrections pending0 applied⛓ anchoredSee findings →
full audit log →version history →

model: claude-code-investigator

generated: 6/27/2026, 5:21:58 PM

last updated: 8/26/2026, 5:03:43 AM

5 views

avoid.net — verified advice for a post-truth world