Iran Imposes Crypto Exchange Curfew After $90M Nobitex Hack

In a chilling display of cyber-political warfare, Iran’s cryptocurrency ecosystem just suffered one of its biggest shocks to date. On June 18, 2025, a devastating attack on Nobitex, the country’s largest crypto exchange, led to the loss of over $90 million—and in its aftermath, the Central Bank of Iran imposed a strict curfew on all domestic crypto trading platforms.

“This is a message,” wrote the attackers, who made no attempt to steal the funds—they simply destroyed them.

Let’s dive into how this happened, what the implications are, and why this hack could shake the future of crypto in geopolitically sensitive regions.

Nobitex Hack: What We Know

According to Chainalysis, the blockchain intelligence firm monitoring the event, attackers drained assets including:

• Bitcoin
• Ethereum
• Dogecoin
• Ripple
• Solana
• Tron
• Toncoin

But here’s the kicker: none of the stolen funds were sold, transferred to mixers, or moved for personal profit. Instead, the assets were:

• Sent to burn addresses (e.g., Ethereum’s “0x…dead”)
• Transferred to invalid checksum Bitcoin wallets
• Labeled with anti-IRGC and anti-regime slogans
• Deliberately made unrecoverable

That means the funds are gone forever—a targeted act of digital sabotage rather than financial theft.

Predatory Sparrow Strikes Again

The group behind the operation? Gonjeshke Darande (aka Predatory Sparrow), a pro-Israel cyber group with a history of state-aligned hacktivism.

Their statement made it clear: this was an act of protest designed to undermine Iran’s crypto-backed financial infrastructure, often used as a workaround for U.S. sanctions.

“The message was political. The method was absolute destruction.”

This isn’t the group’s first move. They’re allegedly tied to prior infrastructure sabotage and cyber campaigns inside Iran, but the scale and symbolic damage of this attack are unprecedented.

Iran’s Response: Crypto Curfew Begins

In reaction to the breach, Iran’s Central Bank didn’t waste time:

• All domestic crypto exchanges are now required to shut down between 8 PM and 10 AM local time.
• Nobitex has been instructed to migrate to a new security infrastructure.
• Investigations into internal vulnerabilities and foreign coordination are ongoing.

A senior official told local media the curfew is a “temporary emergency measure” aimed at preventing cascading risk to Iran’s sanctions-resistant crypto economy.

“The regime is trying to plug the leaks and reassert control over the digital rails propping up their economy,” said Chainalysis in its follow-up report.

Why Nobitex Matters to Iran

Nobitex isn’t just another exchange—it’s the beating heart of Iran’s crypto scene. Here’s why its compromise is such a big deal:

• Nobitex has processed over $11 billion in total crypto inflows.
• It reportedly handles more transaction volume than Iran’s next 10 exchanges combined.
• Acts as a primary conduit for Iranian users interacting with global crypto liquidity.
• Is linked—per Chainalysis—to wallets affiliated with sanctioned entities, including:
  • IRGC-linked ransomware groups
  • Pro-Hamas channels like Gaza Now
  • Russian exchanges like Garantex and Bitpapa

The hack not only exposed vulnerabilities in Iran’s crypto infrastructure but also its shadow financial networks.

A Geopolitical Cyber Warfront

The breach occurred just days after Israeli airstrikes inside Iran, pointing to a wider hybrid warfare strategy where cyber attacks are wielded like missiles.

Instead of targeting infrastructure, attackers struck the digital economy—and wiped millions clean from Iran’s books in the process.

As Cold War-style tensions escalate, this hack may set a dangerous precedent, blurring the lines between cyberwarfare and economic warfare.

What Nobitex Is Doing Now

In a statement, Nobitex reassured users:

• Cold wallets remain intact
• Hot wallets were emptied immediately after the breach
• The reserve fund will cover all user losses
• All operations are being migrated to new, offline wallet systems

While commendable, this response may not be enough to rebuild trust in the short term.

What This Means for Crypto in Sanctioned Countries

This attack is more than just a one-off. It shows the high-stakes vulnerabilities that crypto introduces to sanctioned states:

• Crypto isn’t just finance—it’s infrastructure.
• For regimes like Iran, it’s a lifeline.
• That makes it a target.

Countries using crypto to dodge sanctions (Iran, North Korea, Russia) may now reconsider their exposure. Meanwhile, Western cyber units and hacktivist groups may feel emboldened to strike again, knowing how much damage can be done without firing a shot.

Key Takeaways:

• $90M burned in a crypto attack, not stolen.
• Crypto exchanges in Iran now face operating hour restrictions.
• Attacker used burn addresses and irreversible wallets—no chance of recovery.
• Cyber attacks are becoming a tool of geopolitical influence.
• Nobitex is still operating but on high alert and under curfew.
• The Iranian crypto economy may now be under stricter government oversight.

What’s Next?

If you’re watching the intersection of crypto, geopolitics, and cybersecurity, this story is just beginning. Expect:

• Possible retaliation from Iran’s own cyber units.
• New regulations tightening Iran’s grip on domestic crypto infrastructure.
• A wave of audits and security overhauls across the region’s crypto platforms.
• And growing international attention on how digital assets intersect with warfare and sanctions.