12 days of war: how the Iranian Nobitex exchange recovered after the hack

In June, Israel, together with the United States, struck Iranian nuclear facilities. The active stage of the armed conflict lasted 12 days, after which the parties agreed to a truce. GetBlock AML Research explains how the military action affected the regional cryptocurrency market.

Nobitex hack

On June 18, one of the most high-profile events of the Iran-Israel standoff took place: the Iranian crypto exchange Nobitex lost more than $80 million as a result of a hacker attack. The hack of the trading platform was realized by the pro-Israeli hacker group Predatory Sparrow.

How Iran’s Nobitex exchange lost more than $80 million. Chronology of the hack

The trading platform was hacked by the pro-Israeli hacker group Predatory Sparrow

Read more

Mass withdrawals

A week before the Israeli attack on Iran, there were mass withdrawals of cryptocurrency from Nobitex and other Iranian cryptocurrency platforms. It is likely that Iranian crypto investors anticipated the onset of the conflict and the economic instability that followed, so they rushed to move digital assets to more reliable platforms.

Visualization: TRM Labs

Cryptocurrency withdrawals from Iranian crypto exchanges and services

Source code

As a result of the attack on Nobitex, hackers gained access to the source code of the exchange and published it in free access. Analysis of the source code shows that Nobitex, as Iran’s main crypto platform, skillfully combined modern methods of concealing transactions and financial flows with full oversight and control by Iranian government agencies.

Technically, Nobitex was built in such a way that global regulatory bodies (such as FATF or FinCEN), as well as analytical services, could not monitor the exchange’s financial flows. Nobitex used modules to generate hidden addresses and proprietary asset-mixing technologies.

In parallel with the functions of hiding the flow of funds, Nobitex created an API to connect government services that could monitor the exchange’s transactions in real time. They could use the Nobitex infrastructure for their own purposes without the restrictions and limits imposed on ordinary users of the platform.

New chapter

In July, Nobitex announced a full recovery of operations. The exchange has completely revamped its technical infrastructure. This is indicated by the fact that Nobitex warned users about the inactivity of old deposit addresses. The exchange resumed trading on July 9. According to TRM Labs, the trading platform managed to recover quickly thanks to BTC reserves.

Despite the resumption of activity, users are in no hurry to return to Nobitex. On-chain data shows that incoming transaction volumes on Nobitex in early July 2025 (after the hack) dropped by more than 70% compared to the same period in 2024.

Iranian authorities reaction

Following the Nobitex hack, Iranian authorities imposed severe restrictions on cryptocurrency services. Iranian crypto exchanges were banned from trading at night (from 20:00 to 10:00). The restriction on trading provoked the fluctuation of the USDT exchange rate to the Iranian rial. The ban on trading crypto assets at night is still in effect today.