Iran restricts crypto exchange hours after massive Nobitex exploit drains BTC, ETH, XRP

Iran’s Central Bank has enforced domestic crypto exchanges to operate only between 10 AM and 9 PM in response to a recent cyberattack that targeted Nobitex, the country’s largest crypto exchange, according to a new report from Chainalysis.

The hack, which occurred on Wednesday, resulted in the loss of over $90 million in digital assets, including Bitcoin, Ethereum, Dogecoin, XRP, Solana, TRON, and Toncoin, according to the report.

Gonjeshke Darande, also known as Predatory Sparrow, a pro-Israel hacktivist group, immediately took credit for the attack, which appears to be politically motivated rather than financially driven.

According to Chainalysis, the attacker-controlled wallets were burner addresses without private key access.

Earlier this week, Predatory Sparrow also claimed responsibility for a separate cyberattack targeting Bank Sepah, one of Iran’s largest state-owned banks. The two high-profile hacks came at a time of heightened hostility between Iran and Israel.

Nobitex, which has processed over $11 billion in total inflows compared to $7.5 billion for the next ten largest Iranian exchanges combined, issued a statement assuring users their funds were safe. The exchange has moved large amounts of Bitcoin to new cold storage wallets to enhance security, Chainalysis notes.

The new restrictions are likely part of Iranian authorities’ efforts to increase oversight of crypto trading activities. Nobitex serves as a key gateway connecting Iran’s sanctioned financial system to global crypto markets.

A number of illicit actors have previously been linked to Nobitex, including IRGC-affiliated ransomware operators and Houthi and Hamas-affiliated networks identified by Israel’s National Bureau for Counter-Terror Financing.

The platform has also facilitated transactions with sanctioned entities, including Gaza Now, a pro-al-Qaeda propaganda channel, and the Russian crypto exchanges Garantex and Bitpapa.