The central bank of Iran has reportedly imposed strict operating hours on its domestic crypto exchanges following a $100 million exploit on Nobitex by a pro-Israel hacker group.
In a blog post on Wednesday, Chainalysis cited reports saying domestic crypto exchanges in Iran are now limited to operating hours between 10 am and 8 pm.
Chainalysis’s head of national security intelligence, Andrew Fierman, told Cointelegraph the curfew is likely an attempt to stay on top of any further attacks, because “incidents are easier to triage if they’re not happening in the middle of the night.”
Nobitex was hacked on Wednesday morning, according to the exchange.
“Secondly, while the people of Iran leverage cryptocurrency exchanges to facilitate cross-border transactions, the Iranian regime may want to assert more control over their citizens’ transactions,” he said.
“This is especially the case during times where geopolitical tensions are high and capital flight from Iran is possible.”
Iran’s central bank has imposed restrictions on exchanges before. In December, it ordered a temporary shutdown of all crypto exchanges to prevent its national currency, Rials, from being exchanged and depreciating further.
Israel launched multiple strikes inside Iran on June 13. The two countries have been trading blows ever since.
Nobitex hackers burned the stolen crypto
Nobitex was exploited for at least $100 million in assets based on current estimates, spanning a range of crypto, including Bitcoin (BTC), Ether (ETH), Dogecoin (DOGE), XRP (XRP) and Solana (SOL).
Pro-Israel hacker crew Gonjeshke Darande has claimed responsibility for the exploit after allegedly infiltrating Nobitex’s internal systems and draining its hot wallets.
The Chainalysis team said in the report that it appears the attacker-controlled wallets were burner addresses lacking private key access, “making them irretrievable.”
“While hacks historically have almost always been for financial gain, this event stands out given the intent appears to have been politically motivated to take funds away from the regime,” Fierman said.
Burning tokens means they are permanently removed from circulation. Generally, this is achieved by sending them to an inaccessible wallet address.
Nobitex says situation “under control”
Following the hack, Nobitex severed all external access to its servers, the communication team said in a statement to X on Wednesday.
“As part of Nobitex’s ongoing response to the recent security incident, we would like to inform our users that the situation is now under control,” they said.
At the moment, user access is still unavailable, but the exchange said the Nobitex Reserve Fund will cover all assets lost in the hack.
The Nobitex technical team is also emptying the exchange’s online hot wallets and sending them to offline cold storage devices to prevent further exploits and losses.
“In addition, the internet disruptions and blocked access to external servers may result in a longer-than-usual timeline for restoring user access to the platform,” the Nobitex communication team said.
Nobitex is a critical hub in Iran’s crypto ecosystem
Chainalysis said it tracked Nobitex’s total inflows and found it has well over $11 billion, compared to just under $7.5 billion for the next ten largest Iranian exchanges combined.
It is the go-to platform for Iranian users seeking access to global crypto markets and is a central pillar of the country’s digital asset ecosystem, according to Chainalysis.
Related: Bitcoin, crypto dip as Trump says Iran’s leader an ‘easy target’
“Nobitex isn’t just a local exchange; it serves as a critical hub within Iran’s heavily sanctioned crypto ecosystem, enabling access to global markets for users cut off from traditional finance,” Chainalysis said.
The exchange also has links to a range of groups considered terrorists in the Western world, such as the Houthi rebels in Yemen, a pro-al-Qaeda propaganda channel, and sanctioned Russian crypto exchanges, Garantex and Bitpapa.
Magazine: Bitcoin’s invisible tug-of-war between suits and cypherpunks
