What happened
Iranian exchange Nobitex reported unauthorized access to parts of its infrastructure and hot wallet on 18 June 2025. Public blockchain analysis placed the stolen assets above $90 million; many were sent to inaccessible addresses.
Technical root cause
The public record establishes infrastructure and hot-wallet access, but not the specific credential or software weakness used. Attribution to the Predatory Sparrow group is reported, not an officially proven technical root cause.
How it happened
- Nobitex detected unauthorized access and stopped affected systems.
- Attackers drained assets from hot-wallet infrastructure across several networks.
- The funds were sent to addresses that effectively burned them, while the exchange investigated and restored service.
Protocol details
Classification
Infrastructure / CeFi / Social Engineering
Protocol Type
Exploit/Access control
Protocol links
@nobitexmarket
Evidence
- report @QuillAudits_AI incident report x.com
- analysis Website reference cointelegraph.com
- analysis Website reference coindesk.com
- analysis DeFiLlama defillama.com
- analysis Hackers steal and destroy millions from Iran’s largest crypto exchange techcrunch.com
- analysis Hackers say they wiped out $90 million from Iran cryptocurrency exchange apnews.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
