Cybersafetyconnections July 7, 2025 vol#226
- From Konbrieing, there was a cyberattack on an Iranian based crypto exchange Nobitex last month.
- Assets across the Tron network and Ethereum Virtual Machine (EVM)-compatible blockchains were impacted and $81.7 was drained.
- This cyberattack happaned as a result of failure in access control and maybe a political statement.
- The pro Isreal hacker group that called “Gonjeshke Darande” claimed responsibility for the Nobitex hack.
- Here is how Nobitex mitigated loss from the cyberattack.
What happened?
According to cointelegraph Iran-based cryptocurrency exchange Nobitex suffered a hack that resulted in the theft of over $81 million in digital assets, as reported by on-chain investigator ZachXBT.
The blockchain security firm CertiK reported that this year alone, the crypto industry has lost about 2.1 billion from cyberattacks mostly through wallet compromise,key mismanagement and operational issues.
A bigger threat is social engineering were attackers psychological manipulate users to transfer crypto into fraudulent wallets.
Who was impacted?
As reported on a Telegram post, the attack drained at least $81.7 million in assets across the Tron network and Ethereum Virtual Machine (EVM)-compatible blockchains.
How did it happen?
Cointelegraph reports Hakan Unal of Cyvers stated the hack highlighted critical failures in access controls that allowed hackers to gain access to internal systems to drain hot wallets across multiple blockchains.
Attackers used vanity address to exploit protocols and drain assets from multiple Nobitex linked wallets.
From google.com a vanity address is a customized cryptocurrency wallet address that contains a specific, user-defined sequence of characters, like a name, brand, or phrase.
Instead of a typical, seemingly random string of characters, a vanity address is designed to be more memorable and recognizable, often chosen for its personal or professional significance.
The first $49 million was stolen through the address “TKFuckiRGCTerroristsNoBiTEXy2r7mNX.” The second address used was “0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead,” according to Tronscan.
Which cybercriminal Group claimed responsibility for the attack?
The pro-Israel hacker group “Gonjeshke Darande” has claimed responsibility for the breach and stated that they would release the exchange’s source code and internal files within 24 hours.
They characterized Nobitex as a key tool for the Iranian regime to finance terrorism.
This attack happened within 5 days of the Israel-Iranian conflict.
How did Nobitex mitigate loss from the cyberattack?
OWASP Threat and Safeguard Matrix
Nobitex confirmed unauthorized access to its hot wallets and
- Immediately suspended the portion of the hot wallet impacted.
- Nobitex stated that users’ cold storage assets are secure.
- Nobitex also assured customers that damages would be compensated through their insurance fund.
- Nobitex frequently migrates their hot wallets, the 90 percent drop in value may not reflect actual situation.
From my Digital assistant COPILOT:
Nobitex, Iran’s largest crypto exchange, took several swift and strategic actions to mitigate losses after the politically motivated cyberattack that drained over $90 million from its hot wallets:
🛡️ Immediate Containment
- Suspended affected hot wallets as soon as unauthorized access was detected.
- Took the platform offline temporarily to prevent further breaches and assess the damage.
🔐 Asset Protection & Recovery
- Confirmed cold storage assets remained secure, limiting the scope of the breach.
- Migrated all wallet addresses, rendering old ones invalid to prevent further misuse.
- Restored wallet access gradually, prioritizing verified users and spot wallets.
💰 Customer Assurance
- Activated their insurance fund to compensate affected users, reinforcing trust.
- Issued public warnings urging users not to deposit into old wallet addresses due to the migration.
🔍 Security Enhancements
- Implemented advanced multi-factor authentication and 24/7 monitoring.
- Reviewed and upgraded internal infrastructure, especially around wallet segregation and credential isolation.
🧩 Strategic Lessons
- The breach exposed weaknesses in wallet credential segregation and internal routing, which allowed lateral movement once attackers gained access.
- Nobitex’s privacy engineering tools, originally designed to evade surveillance, may have complicated post-breach forensics.
Conclusion
This incident underscores the importance of resilient architecture, proactive communication, and layered security—especially for exchanges operating in geopolitically sensitive regions.
Subscribe to get the lates blog post.
