Funds Analysis of the Theft Incident at Iran's Largest Exchange Nobitex
TechFlow Selected TechFlow Selected
Funds Analysis of the Theft Incident at Iran's Largest Exchange Nobitex
Loss of about $100 million!
Navigating Web3 tides with focused insightsAuthor: Beosin
On June 18, Iran's largest cryptocurrency exchange, Nobitex, announced it had suffered a hacking incident resulting in approximately $100 million in losses involving multiple cryptocurrencies including BTC, ETH, Doge, XRP, SOL, TRX, and Ton. A pro-Israel group named "Gonjeshke Darande" has claimed responsibility for the attack, characterizing it as a strike against Iran's cryptocurrency infrastructure. The Beosin security team promptly conducted analysis and fund tracking on this incident and shares the findings below:
Funds Flow of Stolen Assets
This attack involved multiple blockchain networks. Based on analysis by Beosin Trace, the confirmed attacker addresses are as follows:
TRON network: TKFuckiRGCTerroristsNoBiTEXy2r7mNX
Ethereum network: 0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead
Bitcoin network: 1FuckiRGCTerroristsNoBiTEXXXaAovLX
Solana network: FuckiRGCTerroristsNoBiTEXXXXXXXXXXXXXXXXXXX
Ripple network: rFuckiRGCTerroristsNoBiTEXypBrmUM
TON network: UQABFuckIRGCTerroristsNOBITEX1111111111111111_jT
Harmony network: one19fuckterr0rfuckterr0rfuckterr0rxn7kj7u
Dogecoin network: DFuckiRGCTerroristsNoBiTEXXXWLW65t
Among these, the TRON network lost 23,531 TRX and 49,439,310 USDT, amounting to approximately $49.45 million. The fund flow diagram is shown below:
Beosin Trace fund flow diagram
The Ethereum network lost 939,556 USDT, 262.87 ETH, and various Ethereum-based tokens (UNI, AXS, PEPE, MASK, MEME, AAVE, etc.), totaling approximately $8.2 million. Below is the primary flow of stolen assets on the Ethereum network:
Beosin Trace fund flow diagram
The Bitcoin network lost 18.47 BTC, valued at approximately $1.93 million. Below is the BTC network’s stolen fund flow:
Beosin Trace fund flow diagram
The Ripple network lost 373,852 XRP, valued at approximately $800,000:
Beosin Trace fund flow diagram
The Solana network lost 173 SOL, 336,067 WIF, and 31,954 RENDER, totaling approximately $400,000:
Beosin KYT fund flow diagram
The Dogecoin network lost 39,409,954 DOGE, valued at approximately $6.7 million. Losses on the Harmony and TON networks totaled around $400,000. Further investigation into additional attacker addresses is ongoing. Beosin Trace and KYT have already added the confirmed malicious addresses to their blacklist databases and will continue monitoring.
Nobitex Response Measures
Following the attack, Nobitex immediately issued a public statement confirming that the majority of its crypto assets remain securely stored in cold wallets and were unaffected. Additionally, Nobitex has taken steps to isolate the compromised systems and strengthen its overall security posture to reduce the risk of similar attacks in the future.
According to media reports, following this incident, Iran's central bank has instructed all domestic cryptocurrency exchanges to limit their operating hours from 10:00 AM to 8:00 PM, implementing stricter regulatory oversight.
Summary
Nobitex is not only Iran’s largest cryptocurrency exchange but also a key hub within Iran’s heavily sanctioned crypto ecosystem, providing users cut off from traditional finance access to global markets. This attack highlights the inherent conflict between the borderless nature of cryptocurrency and geopolitical tensions, underscoring once again the urgent need for continuous blockchain intelligence and on-chain/off-chain risk analysis across the crypto ecosystem.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
@Beosin_com
