Iranian exchange Nobitex hacked for over $81M by Israel-linked hackers

2025-06-18 18:13:33 Primitive Reading

Iran-based cryptocurrency exchange Nobitex has been hacked for more than $81 million of digital assets, according to onchain investigator ZachXBT.

The attack, disclosed in a Wednesday Telegram post, drained at least $81.7 million in assets across the Tron network and Ethereum Virtual Machine (EVM)-compatible blockchains.

ZachXBT spotted attackers using a “vanity address” to exploit the protocol, which resulted in “suspicious outflows” from multiple Nobitex-linked wallets.

A vanity address refers to a public wallet address with a specific, user-defined sequence of characters. The first $49 million was stolen through the address “TKFuckiRGCTerroristsNoBiTEXy2r7mNX.” The second address used was “0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead,” according to Tronscan.

Attacker wallet “KFucki.” Source: Tronscan

Nobitex confirmed that a portion of its hot wallets saw signs of “unauthorized access” and was immediately “suspended” upon detection.

“Users’ assets are completely secure according to cold storage standards, and the above incident only affected a portion of the assets in hot wallets,” Nobitex said in an X post, adding that “all damages will be compensated through the insurance fund and Nobitex resources.”

The Nobitex exploit “appears to stem from a critical failure in access controls, allowing attackers to infiltrate internal systems and drain hot wallets across multiple blockchains,” according to Hakan Unal, senior security operations lead at blockchain security firm Cyvers.

“Yet, surprisingly, the stolen funds remain unmoved,” Unal said.

The breach adds to a growing list of crypto industry hacks in 2025. More than $2.1 billion in digital assets have been stolen so far this year, according to blockchain security firm CertiK.

“The majority of this $2.1 billion was caused by wallet compromises, key mismanagement and operational issues,” Ronghui Gu, the co-founder of CertiK, told Cointelegraph during the Chain Reaction daily X spaces show on June 2.

He added that social engineering scams such as address poisoning are now more common than protocol-level hacks. These attacks rely on psychological manipulation to trick users into transferring assets to fraudulent wallets.

Disclaimer: This specification is preliminary and is subject to change at any time without notice. Amazon Finance assumes no responsibility for any errors contained herein.