# Nobitex Exchange Suffers $90 Million Hot Wallet Breach ∞ Security

**Published:** 2025-09-18
**Categories:** Security

---

![The image displays a close-up of a sleek, transparent electronic device, revealing its intricate internal components. A prominent brushed metallic chip, likely a secure element, is visible through the blue-tinted translucent casing, alongside a circular button and glowing blue circuitry](https://incrypthos.com/wp-content/uploads/2025/09/secure-element-cryptographic-processor-hardware-wallet-interface.jpeg)

![The image presents an abstract, high-tech structure featuring a central, translucent, twisted element adorned with silver bands, surrounded by geometric blue blocks and sleek metallic frames. This intricate design, set against a light background, suggests a complex engineered system with depth and interconnected components](https://incrypthos.com/wp-content/uploads/2025/09/Modular-DLT-Sharding-Interoperability-Cryptographic-Mechanism-Framework.jpeg)

## Briefing

On June 18, 2025, Iran’s largest cryptocurrency exchange, Nobitex, suffered a sophisticated cyberattack, resulting in the theft of approximately $90 million in various digital assets from its hot wallets. The attack, attributed to the pro-Israel hacker [group Gonjeshke Darande](https://incrypthos.com/adoption/reliance-global-group-expands-into-digital-assets-and-tokenized-insurance/) (also known as Predatory Sparrow), was politically motivated, with the stolen funds intentionally burned and anti-regime slogans embedded in transaction addresses. This incident exposed critical vulnerabilities in Nobitex’s internal infrastructure, including a significant lapse in access controls, and led to the leakage of the exchange’s entire source code and internal documentation.

![The image displays a futuristic, angled device featuring a translucent blue lower casing that reveals intricate internal mechanisms, complemented by a sleek silver metallic top panel and a dark, reflective screen. Prominent silver buttons and a circular dial are integrated into its design, emphasizing interactive control and robust construction](https://incrypthos.com/wp-content/uploads/2025/09/transparent-on-chain-visibility-device-for-cryptographic-primitive-execution.jpeg)

## Context

Prior to this incident, the digital asset landscape for [exchanges operating](https://incrypthos.com/regulation/sec-and-cftc-clarify-spot-crypto-trading-permissibility-on-regulated-exchanges/) in sanctioned jurisdictions like Iran presented a complex security posture, often balancing operational necessity with heightened geopolitical risks. Nobitex, as a dominant player, was known to operate with a degree of privacy engineering designed to evade international sanctions and surveillance, which inherently created a unique attack surface. The prevailing risk factors included the potential for state-sponsored cyber warfare and the inherent vulnerabilities of centralized components, particularly hot wallets, which are prime targets for high-value asset concentration.

![A close-up view reveals a futuristic, high-tech system featuring prominent translucent blue structures that form interconnected pathways, embedded within a sleek metallic housing. Luminous blue elements are visible flowing through these conduits, suggesting dynamic internal processes](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-ledger-architecture-visualizing-on-chain-transaction-flow.jpeg)

## Analysis

The incident’s technical mechanics involved the infiltration of Nobitex’s internal infrastructure, leveraging a critical failure in [access controls](https://incrypthos.com/regulation/treasury-fincen-advances-mixer-rule-to-enhance-crypto-aml-controls/). Attackers gained unauthorized access to the exchange’s hot wallet system, enabling them to drain $90 million in cryptocurrencies. The compromise was not merely a financial heist; the attackers, Gonjeshke Darande, demonstrated their political intent by burning the stolen funds and embedding anti-regime messages in the transaction data. Further, the breach escalated with the leakage of Nobitex’s complete source code and infrastructure documentation, providing an unprecedented blueprint of the exchange’s operational design, including its mechanisms for sanctions evasion.

![A close-up view reveals a complex, translucent structural network, adorned with a frosty texture and embedded with reflective spheres. A prominent, metallic blue spiral element grounds the intricate connections](https://incrypthos.com/wp-content/uploads/2025/09/Blockchain-Network-Nodes-Illustrating-Cryptographic-Hashing-and-Data-Integrity.jpeg)

## Parameters

- **Protocol Targeted** ∞ Nobitex Exchange

- **Attack Vector** ∞ Internal Infrastructure Infiltration & [Access Control](https://incrypthos.com/news/access-control/) Failure

- **[Financial](https://incrypthos.com/news/financial/) Impact** ∞ $90 Million

- **Attacker Group** ∞ Gonjeshke Darande (Predatory Sparrow)

- **Motivation** ∞ Geopolitical / Political Statement

- **Assets Affected** ∞ Bitcoin, Ethereum, Dogecoin, Ripple, Solana, Tron, Ton

- **Key Consequence** ∞ Source Code and [Infrastructure](https://incrypthos.com/news/infrastructure/) Documentation Leak

![A close-up view reveals a sophisticated, translucent blue electronic device with a central, raised metallic button. Luminous blue patterns resembling flowing energy or data are visible beneath the transparent surface, extending across the device's length](https://incrypthos.com/wp-content/uploads/2025/09/secure-hardware-wallet-biometric-authentication-for-digital-asset-management.jpeg)

## Outlook

In the immediate aftermath, Nobitex initiated a comprehensive [security](https://incrypthos.com/news/security/) overhaul, including migrating all user wallets to new addresses and advising users against depositing funds to old ones. This incident underscores the severe contagion risk of geopolitical cyberattacks on centralized crypto infrastructure, particularly for exchanges operating in high-risk environments. It will likely establish new best practices for access control, supply chain security, and incident response, especially regarding politically motivated breaches that prioritize disruption over financial gain. Protocols must re-evaluate their security postures, recognizing that advanced persistent threats can target infrastructure beyond smart contract logic.

![The image showcases a high-precision hardware component, featuring a prominent brushed metal cylinder partially enveloped by a translucent blue casing. Below this, a dark, wavy-edged interface is meticulously framed by polished metallic accents, set against a muted grey background](https://incrypthos.com/wp-content/uploads/2025/09/tamper-proof-hardware-wallet-private-key-management-system.jpeg)

## Verdict

**The Nobitex breach serves as a stark reminder that geopolitical tensions can manifest as sophisticated cyberattacks, fundamentally challenging the security and operational integrity of [digital asset](https://incrypthos.com/news/digital-asset/) exchanges, particularly those within sanctioned regimes.**

Signal Acquired from ∞ <a href="https://www.trmlabs.com/resources/blog/inside-the-nobitex-breach-what-the-leaked-source-code-reveals-about-irans-crypto-infrastructure?utm_source=incrypthos.com&utm_medium=referral&utm_campaign=noo-engine.com" target="_blank" rel="nofollow">TRM Labs</a>

## Glossary

<a href="https://incrypthos.com/adoption/reliance-global-group-expands-into-digital-assets-and-tokenized-insurance/" class="glossary-item-box">

## group gonjeshke darande 

Reliance Global Group integrates digital asset treasury with tokenized insurance-linked investments, optimizing capital efficiency and market accessibility. </a><a href="https://incrypthos.com/regulation/sec-and-cftc-clarify-spot-crypto-trading-permissibility-on-regulated-exchanges/" class="glossary-item-box">

## exchanges operating 

This joint regulatory statement provides critical clarity, enabling registered exchanges to pursue spot crypto product listings, fundamentally altering market access. </a><a href="https://incrypthos.com/regulation/treasury-fincen-advances-mixer-rule-to-enhance-crypto-aml-controls/" class="glossary-item-box">

## access controls 

The proposed FinCEN mixer rule mandates stringent reporting, fundamentally recalibrating compliance frameworks for digital asset entities to mitigate illicit finance risks. </a><a href="https://incrypthos.com/news/access-control/" class="glossary-item-box">

## access control 

Definition ∞ Access control dictates who or what can view or use resources within a digital system. </a><a href="https://incrypthos.com/news/financial/" class="glossary-item-box">

## financial 

Definition ∞ Financial refers to matters concerning money, banking, investments, and credit. </a><a href="https://incrypthos.com/news/infrastructure/" class="glossary-item-box">

## infrastructure 

Definition ∞ Infrastructure refers to the fundamental technological architecture and systems that support the operation and growth of blockchain networks and digital asset services. </a><a href="https://incrypthos.com/news/security/" class="glossary-item-box">

## security 

Definition ∞ Security refers to the measures and protocols designed to protect assets, networks, and data from unauthorized access, theft, or damage. </a><a href="https://incrypthos.com/news/digital-asset/" class="glossary-item-box">

## digital asset 

Definition ∞ A digital asset is a digital representation of value that can be owned, transferred, and traded. </a>

**Tags:** [Hot Wallet](https://incrypthos.com/news/hot-wallet/), [Asset Burning](https://incrypthos.com/news/asset-burning/), [Digital Asset Theft](https://incrypthos.com/news/digital-asset-theft/), [Exchange Security](https://incrypthos.com/news/exchange-security/), [Cyber Warfare](https://incrypthos.com/news/cyber-warfare/), [Source Code Leak](https://incrypthos.com/news/source-code-leak/)	

## Discover More

- 
### [Odin.fun Suffers $7 Million Bitcoin Loss via AMM Liquidity Manipulation](https://incrypthos.com/security/odin-fun-suffers-7-million-bitcoin-loss-via-amm-liquidity-manipulation/)
![A large, textured sphere, resembling a celestial body, partially submerges in dark blue liquid, generating dynamic splashes. Smaller white spheres interact with the fluid. This visual metaphorically depicts a decentralized exchange's DEX liquidity pool, where tokenomics drive asset interactions. The main sphere represents a governance token or wrapped asset undergoing smart contract execution, influencing market volatility. The liquid signifies available liquidity, while smaller spheres are other digital assets or stablecoins within the DeFi ecosystem.](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-liquidity-pool-dynamics-tokenomics-smart-contract-execution.jpeg)

A critical flaw in Odin.fun's Automated Market Maker allowed price spoofing, enabling attackers to drain significant Bitcoin liquidity.

- 
### [Venus Protocol Recovers $13.5 Million from Lazarus Group Phishing Attack](https://incrypthos.com/security/venus-protocol-recovers-13-5-million-from-lazarus-group-phishing-attack/)
![A modular white device, resembling a decentralized physical infrastructure network DePIN node, partially submerges in dynamic blue water, generating numerous bubbles and ripples. Its exposed internal mechanisms and integrated solar panels suggest off-chain data processing capabilities, actively maintaining data stream integrity. This visual metaphor encapsulates the oracle network resilience required for robust cross-chain interoperability, ensuring reliable smart contract execution even within challenging liquidity pool dynamics. The active water interaction symbolizes constant data flow and network activity.](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-oracle-node-resiliency-cross-chain-data-stream-recovery.jpeg)

A targeted phishing exploit against a high-value user's delegated account control enabled asset drain, underscoring critical off-chain vulnerability.

- 
### [Helius Medical Establishes Solana Treasury for Digital Asset Management](https://incrypthos.com/adoption/helius-medical-establishes-solana-treasury-for-digital-asset-management/)
![A gleaming, intricate structure of interlocking blue and silver metallic components forms a complex, abstract assembly. The polished surfaces reflect light, highlighting the precise engineering and modular architecture. This visual metaphor embodies the robust infrastructure of a decentralized network, where each component represents a critical element of cryptographic primitives or a smart contract. The interconnectedness signifies seamless interoperability protocols essential for cross-chain communication and digital asset security within a resilient distributed ledger technology framework.](https://incrypthos.com/wp-content/uploads/2025/09/Modular-Blockchain-Architecture-Facilitating-Interoperability-Protocols-and-Digital-Asset-Security.jpeg)

Helius Medical Technologies secures $500M to integrate Solana for treasury diversification and yield generation, optimizing capital efficiency.

- 
### [JP Morgan Pilots JPMD Deposit Token on Coinbase’s Base](https://incrypthos.com/adoption/jp-morgan-pilots-jpmd-deposit-token-on-coinbases-base/)
![A futuristic mechanical interface depicts a dynamic data transformation process. Two sophisticated cylindrical components, one metallic and one white segmented, interact at their nexus. A burst of vibrant blue, cubic digital assets or data packets explodes outwards, accompanied by a frothy dispersion of white, potentially representing raw data streams or computational noise. This visual metaphor illustrates complex cryptographic operations, such as transaction validation, data serialization, or smart contract execution, highlighting efficient protocol mechanisms transforming inputs into verifiable outputs within a DLT ecosystem.](https://incrypthos.com/wp-content/uploads/2025/09/cryptographic-hashing-protocol-data-transformation-engine-dynamics.jpeg)

JP Morgan leverages Base for JPMD deposit tokens, enabling institutional clients to achieve near-instantaneous payment settlement and enhanced capital efficiency.

- 
### [SwissBorg Partner API Breach Drains Solana Assets](https://incrypthos.com/security/swissborg-partner-api-breach-drains-solana-assets/)
![A pristine white, textured material, symbolizing raw data or unverified transaction inputs, is intricately integrated with a translucent, deep blue, structured element. This blue component, representing a robust blockchain or decentralized protocol, exhibits complex, web-like patterns indicative of cryptographic proofs and distributed network connections. The interaction visually conveys on-chain data validation, asset tokenization, or smart contract execution, where initial liquidity or digital assets are secured within an immutable ledger. This highlights the consensus mechanism's role in maintaining data integrity and network security within a Web3 ecosystem.](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-ledger-technology-securing-digital-assets-through-protocol-execution.jpeg)

A compromised third-party API allowed attackers to drain $41.3 million in Solana tokens, exposing critical supply chain risks.

- 
### [JPMorgan Launches JPMD for Institutional Digital Cash Settlement](https://incrypthos.com/adoption/jpmorgan-launches-jpmd-for-institutional-digital-cash-settlement/)
![Close-up reveals interconnected white and blue modular components, symbolizing a robust distributed ledger technology architecture. These units suggest sharding implementation, where individual modules represent network nodes facilitating parallel transaction processing. The metallic interfaces highlight secure cross-chain interoperability, essential for scalable Web3 infrastructure. This physical representation evokes efficient data flow and cryptographic security within a decentralized ecosystem, crucial for high-throughput blockchain operations.](https://incrypthos.com/wp-content/uploads/2025/09/cryptographic-sharding-modules-enabling-secure-cross-chain-interoperability.jpeg)

JPMD digitizes commercial bank deposits on-chain, enabling instant settlement and enhancing collateral mobility for institutional clients.

- 
### [SEC Withdraws Coinbase Enforcement Action Signaling Regulatory Shift](https://incrypthos.com/regulation/sec-withdraws-coinbase-enforcement-action-signaling-regulatory-shift/)
![The image displays an intricate, glowing blue network structure resting on a dark, metallic, futuristic base. This complex formation, resembling interconnected nodes and pathways, abstractly visualizes a decentralized network's internal operations. It suggests the dynamic flow of on-chain data and transaction throughput within a blockchain architecture. The underlying metallic platform evokes robust Web3 infrastructure, supporting cryptographic primitives and smart contract execution. This abstract representation highlights the intricate consensus mechanism and node synchronization essential for distributed ledger technology's integrity and scalability solutions.](https://incrypthos.com/wp-content/uploads/2025/09/decentralized-network-topology-visualizing-blockchain-protocol-execution.jpeg)

The SEC's withdrawal of its Coinbase lawsuit necessitates a re-evaluation of compliance frameworks, underscoring a strategic pivot towards regulatory clarity.

- 
### [Nemo Protocol Suffers $2.6 Million Exploit from Unaudited Code](https://incrypthos.com/security/nemo-protocol-suffers-2-6-million-exploit-from-unaudited-code/)
![White, modular, metallic components connect in a chain-like fashion, forming a futuristic processing unit. Vibrant blue liquid or energy vigorously flows and splashes within an open central segment, propelled by internal mechanisms. This represents a high-performance distributed ledger technology DLT system, where transaction throughput is optimized. The dynamic blue flow symbolizes liquidity pools and on-chain data streams being processed by validator nodes within a modular blockchain architecture. It highlights efficient smart contract execution and cross-chain interoperability, essential for robust DeFi protocols and scalable Web3 infrastructure, underpinned by secure cryptographic primitives across a decentralized network.](https://incrypthos.com/wp-content/uploads/2025/09/modular-protocol-engine-executing-high-velocity-liquidity-pool-transactions.jpeg)

A publicly exposed flash loan function and state-modifying query vulnerability allowed unauthorized asset drainage, posing a critical risk to protocol integrity.

- 
### [Moby Options Protocol Suffers Private Key Compromise, $1 Million Lost](https://incrypthos.com/security/moby-options-protocol-suffers-private-key-compromise-1-million-lost/)
![A sleek, translucent blue hardware wallet device rests on a dark grey surface. Its modular, clear blue-tinted casing suggests a secure element for cryptographic key storage. A prominent raised section on the left likely functions as a secure input for seed phrase entry or multi-signature confirmation. On the right, a black knob with a white top controls firmware updates or device settings. This tamper-proof unit is engineered for cold storage, facilitating offline transaction signing and safeguarding digital assets within a distributed ledger technology ecosystem.](https://incrypthos.com/wp-content/uploads/2025/09/secure-element-hardware-wallet-for-decentralized-private-key-management.jpeg)

A compromised private key enabled a malicious smart contract upgrade, allowing an attacker to drain Moby protocol funds, underscoring critical administrative key risks.

**Tags:** [Access Control](https://incrypthos.com/news/access-control/), [Asset Burning](https://incrypthos.com/news/asset-burning/), [Crypto Forensics](https://incrypthos.com/news/crypto-forensics/), [Cyber Warfare](https://incrypthos.com/news/cyber-warfare/), [Digital Asset Theft](https://incrypthos.com/news/digital-asset-theft/), [Exchange Security](https://incrypthos.com/news/exchange-security/), [Geopolitical Risk](https://incrypthos.com/news/geopolitical-risk/), [Hot Wallet](https://incrypthos.com/news/hot-wallet/), [Infrastructure Compromise](https://incrypthos.com/news/infrastructure-compromise/), [Source Code Leak](https://incrypthos.com/news/source-code-leak/)

---

## Raw Schema Data

```json
{
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
        {
            "@type": "ListItem",
            "position": 1,
            "name": "Home",
            "item": "https://incrypthos.com"
        },
        {
            "@type": "ListItem",
            "position": 2,
            "name": "Security",
            "item": "https://incrypthos.com/security/"
        },
        {
            "@type": "ListItem",
            "position": 3,
            "name": "Nobitex Exchange Suffers $90 Million Hot Wallet Breach",
            "item": "https://incrypthos.com/security/nobitex-exchange-suffers-90-million-hot-wallet-breach/"
        }
    ]
}
```

```json
{
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "http://incrypthos.com#organization",
    "name": "Incrypthos",
    "url": "http://incrypthos.com",
    "description": "Incrypthos Crypto News Engine is a proprietary language model designed specifically for the cryptocurrency domain. It operates 24/7 to ingest, analyze, and synthesize information from hundreds of global sources. Its core function is to discern the signal from the noise, reconstructing complex news and research into structured, objective summaries. Every article is generated by this engine and includes a direct link to the original source to ensure full transparency.",
    "email": "info@incrypthos.com",
    "logo": {
        "@type": "ImageObject",
        "url": "https://incrypthos.com/wp-content/uploads/2025/09/Incrypthos.svg"
    }
}
```

```json
{
    "@context": "https://schema.org",
    "@type": "Article",
    "mainEntityOfPage": {
        "@type": "WebPage",
        "@id": "https://incrypthos.com/security/nobitex-exchange-suffers-90-million-hot-wallet-breach/"
    },
    "headline": "Nobitex Exchange Suffers $90 Million Hot Wallet Breach \u221e Security",
    "description": "A critical failure in access controls allowed politically motivated attackers to drain $90 million from Nobitex's hot wallets, exposing systemic infrastructure vulnerabilities. \u221e Security",
    "url": "https://incrypthos.com/security/nobitex-exchange-suffers-90-million-hot-wallet-breach/",
    "datePublished": "2025-09-18T05:53:06+00:00",
    "dateModified": "2025-09-18T05:53:13+00:00",
    "articleSection": [
        "Security"
    ],
    "author": {
        "@id": "http://incrypthos.com#organization"
    },
    "publisher": {
        "@id": "http://incrypthos.com#organization"
    },
    "image": {
        "@type": "ImageObject",
        "url": "https://incrypthos.com/wp-content/uploads/2025/09/secure-hardware-wallet-biometric-authentication-for-digital-asset-management.jpeg",
        "caption": "A close-up view reveals a sophisticated, translucent blue electronic device with a central, raised metallic button. Luminous blue patterns resembling flowing energy or data are visible beneath the transparent surface, extending across the device's length. This advanced hardware module is engineered for high-level digital asset security, functioning as a secure enclave for private key storage and cryptographic operations. The integrated metallic interface likely serves as a biometric authentication sensor, enabling secure access control for cryptocurrency transactions and decentralized identity verification. Its robust design supports cold storage solutions, crucial for protecting substantial blockchain holdings from online vulnerabilities. The internal blue luminescence could symbolize active network participation, such as proof-of-stake validation or real-time oracle data feeds within a decentralized autonomous organization DAO. This device exemplifies next-generation infrastructure for managing digital assets, facilitating secure smart contract execution, and ensuring the integrity of decentralized finance DeFi liquidity pools, providing a critical layer of trustless security in the Web3 ecosystem."
    },
    "keywords": [
        "Access Control",
        "Asset Burning",
        "Crypto Forensics",
        "Cyber Warfare",
        "Digital Asset Theft",
        "Exchange Security",
        "Geopolitical Risk",
        "Hot Wallet",
        "Infrastructure Compromise",
        "Source Code Leak"
    ]
}
```


---

**Original URL:** https://incrypthos.com/security/nobitex-exchange-suffers-90-million-hot-wallet-breach/
