{"id":4442,"date":"2025-06-30T04:52:14","date_gmt":"2025-06-30T04:52:14","guid":{"rendered":"https:\/\/bitunikey.com\/news\/nobitex-exchange-begins-restoring-service-after-90m-exploit-by-pro-israel-hacker-group\/"},"modified":"2025-06-30T04:52:18","modified_gmt":"2025-06-30T04:52:18","slug":"nobitex-exchange-begins-restoring-service-after-90m-exploit-by-pro-israel-hacker-group","status":"publish","type":"post","link":"https:\/\/bitunikey.com\/news\/nobitex-exchange-begins-restoring-service-after-90m-exploit-by-pro-israel-hacker-group\/","title":{"rendered":"Nobitex exchange begins restoring service after $90M exploit by pro-Israel hacker group"},"content":{"rendered":"

<\/p>\n

\n

Nobitex exchange, Iran\u2019s largest cryptocurrency platform, has begun restoring wallet access to users following a major exploit that resulted in more than $90 million in losses.<\/p>\n

The company issued an update<\/a> on June 29 via X, outlining a phased recovery process starting with verified users. According to the statement, only spot wallets are being unlocked initially, with other wallet types to follow once identity verification is completed. <\/p>\n

Users are being asked to wait for confirmation before attempting to access their balances, which will be displayed gradually as the security checks proceed.<\/p>\n

\n
\n
\n

Follow- up on Nobitex Security Incident, Step-by-step wallet access has begun, 29 June 2025 <\/p>\n

Please note:<\/p>\n

1. This process is being carried out gradually, starting with verified users and initially for spot wallets, followed by other types of wallets.<\/p>\n

2. The identity\u2026<\/p>\n

\u2014 Nobitex | \u0646\u0648\u0628\u06cc\u062a\u06a9\u0633 (@nobitexmarket) June 29, 2025<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n

\u201cOnce the accuracy and security of all information is confirmed, Nobitex will begin displaying wallet balances in phases,\u201d the exchange wrote. Nobitex expects the process to finish by mid-week but noted that timelines could shift based on technical and security considerations.<\/p>\n

The exploit, carried out on June 18, was claimed by Gonjeshke Darande, a pro-Israel group also known as Predatory Sparrow. Blockchain investigators say roughly $90\u2013100 million in digital assets were drained from hot wallets across Ethereum (ETH) and Tron (TRX), including Bitcoin (BTC), ETH, and Dogecoin (DOGE).<\/p>\n

<\/p>\n

As part of its post-attack response, Nobitex is migrating to a new wallet system. The firm warned users not to deposit funds into previously used addresses, noting that any deposits to old wallets may result in permanent loss. <\/p>\n

\u201cIf your old deposit address is connected to a mining rig or saved as a default withdrawal address in a blockchain service, make sure to delete it an,\u201d the update advised, stressing the risk of sending funds to invalid wallets.<\/p>\n

The hackers reportedly accessed the platform using employee credentials compromised earlier via infostealer malware. The breach exposed parts of Nobitex\u2019s internal systems, including source code and server data, which were later leaked online.<\/p>\n

Nobitex, which has processed more than $11 billion in inflows to date, holds a dominant position among Iran-based exchanges. Chainalysis has previously linked<\/a> it to illicit activities by ransomware groups affiliated with Iran\u2019s Islamic Revolutionary Guard Corps and sanctioned Russian entities.\u00a0<\/p>\n

With user access gradually resuming and trading features still disabled, the exchange is working to stabilize operations and restore trust. \u201cWe are working to resume withdrawal, deposit, and trading services for verified users with minimal delay,\u201d the exchange said.<\/p>\n

Full platform functionality is expected to return in the coming days, though Nobitex has warned that the timeline may be revised depending on the results of ongoing system checks.<\/p>\n

<\/p><\/div>\n