Iran-based cryptocurrency exchange Nobitex has reportedly been hacked, resulting in the loss of $81 million in digital assets. The incident was revealed by blockchain security analyst ZachXBT.
According to the expert, the attackers used a "fake address" trick to exploit the protocol, leading to suspicious outflows from several wallets linked to Nobitex.
The first $49 million was drained through a wallet address labeled "TKFuckiRGCTerroristsNoBiTEXy2r7mNX". The second address used was "0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead", as noted on Tronscan.
Nobitex confirmed signs of "unauthorized access" on some of its hot wallets, which were immediately suspended after detection.
“User assets remain fully protected in accordance with our cold storage standards. The incident only affected a portion of hot wallet holdings. All losses will be covered through Nobitex’s insurance fund and internal resources,” the company stated.
Hakan Unal, a senior security expert at Cyvers, commented that the exploit appears to be linked to a critical flaw in Nobitex’s access control system.
“Strangely, the stolen funds remain untouched,” added Unal.
Responsibility for the exploit was promptly claimed by Gonjeshke Darande ("Predatory Sparrow"), a pro-Israeli hacker group. The group accused Nobitex of aiding the Iranian government in evading sanctions and funding terrorism, and warned that they would leak internal platform data and source code within 24 hours.
