Overview
- On June 18, the group Gonjeshke Darande seized control of Nobitex wallets, extracting between $82 million and $90 million in Bitcoin, Dogecoin and tokens across TRON and EVM chains.
- Blockchain analytics firm Elliptic identified the funds routed to anti-IRGC vanity addresses likely beyond hacker control, indicating a symbolic destruction of assets rather than theft for profit.
- Gonjeshke Darande accused Nobitex of acting as a “terror-financing tool” for Iran’s Islamic Revolutionary Guard Corps by facilitating crypto-based sanctions evasion.
- The hacking collective threatened to release Nobitex’s internal data and source code within 24 hours, putting any remaining user funds and platform integrity at risk.
- The incident follows a separate Gonjeshke Darande attack on state-owned Bank Sepah and comes as missile exchanges between Israel and Iran heighten regional tensions.