Iran's largest cryptocurrency exchange, Nobitex, was hacked on June 18, resulting in the theft of digital assets, with estimates ranging from $73 million to over $100 million.
The attack was claimed by Gonjeshke Darande, a pro-Israel hacking group with a history of targeting Iranian infrastructure amidst escalating tensions between the two countries.
Nobitex, with over 7 million users, has been linked to the IRGC, Iranian government figures, and sanctioned entities like Hamas, Palestinian Islamic Jihad, and the Houthis.
The hackers exploited vanity blockchain addresses containing anti-IRGC messages, suggesting a geopolitical motive rather than purely financial gain.
Blockchain analysis indicates that the hackers may not have access to the stolen funds, implying a politically motivated hack.
The use of anti-IRGC messages in the addresses aims to weaken Iran's position amid the conflict.
The hack disrupted Nobitex's services and targeted the exchange due to its alleged role in evading sanctions and financing geopolitical strategies.
Iran has restricted internet access following the hack as a precaution against further cyberattacks.
The stolen funds have not been moved from the original wallets, supporting the theory of a politically driven attack.