Latest news with #hack
Yahoo
a day ago
- Business
- Yahoo
Hackers say they wiped out $90 million from Iran cryptocurrency exchange
DUBAI, United Arab Emirates (AP) — Hackers with possible links to Israel have drained more than $90 million from Nobitex, Iran's largest cryptocurrency exchange, according to blockchain analytics firms. The group that claimed responsibility for the hack on Thursday leaked what it said was the company's full source code. 'ASSETS LEFT IN NOBITEX ARE NOW ENTIRELY OUT IN THE OPEN,' the group wrote on its Telegram account. The stolen funds were transferred to addresses bearing messages that criticized Iran's Revolutionary Guard, Blockchain analytics firm Elliptic wrote in a blog post. It said the attack likely was not financially motivated as the wallets the hackers had poured the money into 'effectively burned the funds in order to send Nobitex a political message.' The hackers group, Gonjeshke Darande — 'Predatory Sparrow' in Farsi — accused Nobitex of having helped Iran's government to evade Western sanctions over the country's rapidly advancing nuclear program and transfer money to militants, in a post on X claiming the attack. Nobitex appeared to have confirmed the attack. Its app and website were down as it assessed 'unauthorized access' to its systems, it said in a post on X. The theft spanned a range of cryptocurrencies, including Bitcoin, Ethereum, Dogecoin and more, said head of national security intelligence at Chainalysis Andrew Fierman. The breach is 'particularly significant given the comparatively modest size of Iran's cryptocurrency market,' he added. The hack appears to be motivated by escalating tensions in the Israel-Iran conflict, which broke out last week when Israel struck Iran's nuclear sites and military officials, drawing Tehran's response with barrages of missiles. It came after the group said it had destroyed data in a cyberattack against Iran's state-controlled Bank Sepah on Tuesday. Elliptic said that relatives of Iran's Supreme Leader Ali Khamenei were linked to the exchange and that sanctioned Revolutionary Guard operatives had used Nobitex. It shared evidence that the exchange had sent and received funds from cryptocurrency wallets controlled by Iranian allies including Yemen's Houthis and Hamas. Gonjeshke Darande has previously claimed responsibility for other high-level cyberattacks against Iran, including a 2021 operation that paralyzed gas stations and a 2022 effort against a steel mill that sparked a large fire. Israeli media have widely reported that Gonjeshke Darande is linked to Israel but the country's government has never officially acknowledged ties to the group. U.S. Senators Elizabeth Warren and Angus King last year raised concerns about Iran's use of cryptocurrencies to evade sanctions. Gabe Levin, The Associated Press Error in retrieving data Sign in to access your portfolio Error in retrieving data Error in retrieving data Error in retrieving data Error in retrieving data
Associated Press
a day ago
- Business
- Associated Press
Hackers say they wiped out $90 million from Iran cryptocurrency exchange
DUBAI, United Arab Emirates (AP) — Hackers with possible links to Israel have drained more than $90 million from Nobitex, Iran's largest cryptocurrency exchange, according to blockchain analytics firms. The group that claimed responsibility for the hack on Thursday leaked what it said was the company's full source code. 'ASSETS LEFT IN NOBITEX ARE NOW ENTIRELY OUT IN THE OPEN,' the group wrote on its Telegram account. The stolen funds were transferred to addresses bearing messages that criticized Iran's Revolutionary Guard, Blockchain analytics firm Elliptic wrote in a blog post. It said the attack likely was not financially motivated as the wallets the hackers had poured the money into 'effectively burned the funds in order to send Nobitex a political message.' The hackers group, Gonjeshke Darande — 'Predatory Sparrow' in Farsi — accused Nobitex of having helped Iran's government to evade Western sanctions over the country's rapidly advancing nuclear program and transfer money to militants, in a post on X claiming the attack. Nobitex appeared to have confirmed the attack. Its app and website were down as it assessed 'unauthorized access' to its systems, it said in a post on X. The theft spanned a range of cryptocurrencies, including Bitcoin, Ethereum, Dogecoin and more, said head of national security intelligence at Chainalysis Andrew Fierman. The breach is 'particularly significant given the comparatively modest size of Iran's cryptocurrency market,' he added. The hack appears to be motivated by escalating tensions in the Israel-Iran conflict, which broke out last week when Israel struck Iran's nuclear sites and military officials, drawing Tehran's response with barrages of missiles. It came after the group said it had destroyed data in a cyberattack against Iran's state-controlled Bank Sepah on Tuesday. Elliptic said that relatives of Iran's Supreme Leader Ali Khamenei were linked to the exchange and that sanctioned Revolutionary Guard operatives had used Nobitex. It shared evidence that the exchange had sent and received funds from cryptocurrency wallets controlled by Iranian allies including Yemen's Houthis and Hamas. Gonjeshke Darande has previously claimed responsibility for other high-level cyberattacks against Iran, including a 2021 operation that paralyzed gas stations and a 2022 effort against a steel mill that sparked a large fire. Israeli media have widely reported that Gonjeshke Darande is linked to Israel but the country's government has never officially acknowledged ties to the group. U.S. Senators Elizabeth Warren and Angus King last year raised concerns about Iran's use of cryptocurrencies to evade sanctions.
Yahoo
a day ago
- Business
- Yahoo
Pro-Israel group hacks Iranian crypto exchange for $90 million—but throws away the money
Geopolitical tensions in the Middle East have spilled over into the crypto industry. On Tuesday, Nobitex, the largest crypto exchange in Iran, was hacked for more than $90 million, according to the crypto analytics firm Elliptic. A group that calls itself Gonjeshke Darande, or 'Predatory Sparrow,' claimed responsibility for the hack. 'These cyberattacks are the result of Nobitex being a key regime tool for financing terrorism and violating sanctions,' Predatory Sparrow wrote on X. Instead of pocketing the $90 million of Bitcoin, Dogecoin, and more than 100 different cryptocurrencies that they raided, the hacking group decided to destroy ('burn' in crypto parlance) the funds instead so as to send a political message, according to Elliptic. Blockchain addresses, or locations in a database that record how much money someone has, are randomly generated and typically consist of a garbled string of numbers and letters. For this operation, though, Predatory Sparrow sent the hacked funds to addresses that included the phrase 'F***iRGCTerrorists.' (IRGC refers to the Islamic Revolutionary Guard Corps, a branch of the Iranian army.) 'To generate addresses with so many specific terms inside it would require so much computing power that you're not going to do it within any reasonable lifetime,' Arda Akartuna, a lead crypto threat researcher at Elliptic, told Fortune. 'So, it seems to have been more of a symbolic hack, as opposed to one where the intention is financial.' Social media accounts for both Nobitex and Predatory Sparrow did not immediately return a request for comment. 'The vast majority of assets are stored in cold wallets and were not impacted,' Nobitex wrote on X after the hack. 'I've never seen a hack that has occurred in the way that this one has,' said Akartuna. The exploit of Nobitex follows days of violent conflict between Israel and Iran. After a United Nations–backed nuclear watchdog said on Thursday that Iran was not complying with prohibitions against the development of a military nuclear program, Israel launched a series of missiles against the Islamic Republic. Iran retaliated with its own strikes, and the two countries have traded blows over the past six days. On Tuesday, Predatory Sparrow, which Elliptic's Akartuna says has repeatedly been linked to Israeli operatives, claimed responsibility for the hack of Iran's Bank Sepah and destruction of the financial institution's data. The hackers said the bank repeatedly circumvented international sanctions. Predatory Sparrow made the same claims of sanctions evasions against Nobitex, which primarily caters to Iranian users. In 2022, the U.S. sanctioned Iranian nationals who used the crypto exchange to launder proceeds from cyberattacks, according to Chainalysis, another crypto analytics firm. This story was originally featured on
Yahoo
a day ago
- Business
- Yahoo
Iranian Crypto Exchange Nobitex Hacked for $90M by Suspected Israeli Group
Iranian crypto exchange Nobitex has been hacked for $90 million by Israel-linked hacking activist group Gonjeshke Darande, according to a blog post from blockchain security firm Elliptic. The group said in an X post: 'After Bank Sepah, it was Nobitex's turn,' referencing their Tuesday cyberattack on Iran's state-owned lender. They warned that Nobitex's internal data and source code would be released within a day, and any assets left on the exchange would be 'at risk.' On-chain sleuth ZachXBT first flagged suspicious outflows totaling $81.7 million in Tron's TRX TRX, bitcoin BTC, dogecoin DOGE and other tokens in his Telegram channel on Wednesday. The stolen funds were traced to a wallet using a provocative vanity address: TKFuckiRGCTerroristsNoBiTEXy2r7mNX. Estimates of funds stolen was later updated to over $82 million, with funds stolen across Bitcoin, Dogecoin and EVM chains from addresses including"0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead," "1FuckiRGCTerroristsNoBiTEXXXaAovLX," and "DFuckiRGCTerroristsNoBiTEXXXWLW65t."The group called Nobitex a 'core part of the regime's terror financing network,' accusing it of helping Iran evade international sanctions by enabling crypto-based payments. Nobitex, Iran's largest exchange, confirmed the attack in an X post but did not mention or confirm stolen funds. The hack also does not appear to be financially motivated, Elliptic said. The funds were sent to vanity addresses created through "brute force" methods - involving the creation of large numbers of cryptographic key pairs until one contains the desired text. "But creating vanity addresses with text strings as long as those used in this hack is computationally infeasible. This means that Predatory Sparrow would not have the private keys for the crypto addresses they sent the Nobitex funds to, and have effectively burned the funds in order to send Nobitex a political message," Elliptic said. At the time of writing, it is unclear what attack method was used by Gonjeshke Darande to conduct the exploit. The hack comes amid a flurry of cyber and physical attacks between Iran and Israel. Gonjeshke Darande, believed by cybersecurity analysts to have ties to Israeli intelligence, has previously claimed responsibility for coordinated infrastructure attacks on Iranian steel factories and gas stations. With the source code leak looming, Nobitex now faces not only financial loss but a full-blown credibility crisis — and users who haven't yet moved funds may stand to lose everything, per the hacking group's followup threats. UPDATE (Jun. 18, 08:34 UTC): Updates headline and text with new information. UPDATE (Jun. 18, 11:56 UTC): Adds details from the Elliptic blog.
TechCrunch
2 days ago
- Business
- TechCrunch
Hackers steal and destroy millions from Iran's largest crypto exchange
Iran's largest crypto exchange, Nobitex, said Wednesday that it was hacked and funds have been drained from its hot wallet. In a statement on its website translated by TechCrunch, Nobitex said it detected unauthorized access to its infrastructure and hot wallet, in which the company stores a portion of its customers' cryptocurrency. The company said it was investigating the incident, and that its website and app would be unavailable for the foreseeable future. Public records show the hackers stole at least $90 million of the company's assets over multiple transactions. Blockchain analysis firm Elliptic said the hackers 'burned' the stolen funds by sending the crypto to inaccessible wallets, effectively taking the money out of circulation. Nobitex has more than 10 million customers, according to an archived copy of Nobitex's website from last week. Pro-Israel hacking group Predatory Sparrow (also known in Farsi as 'Gonjeshke Darande') took credit for the cyberattack. In a post on X, the group said it targeted Nobitex for allegedly financing terrorism for the Iranian regime and evading international sanctions. A day earlier, the hacking group also claimed responsibility for a hack on Iran's Bank Sepah resulting in widespread outages at ATMs across the country. News of the cyberattacks comes as Israel and Iran attack each other's cities. It's not clear who is behind Predatory Sparrow, which first appeared in 2021, but the hacking group has targeted Iranian organizations with destructive cyberattacks in the past, and broadly appears aligned with Israeli interests. Iranian news outlet IRIB said Tuesday that amid the ongoing military conflict, Israel had 'launched a massive cyber war against [Iran's] digital infrastructure to disrupt the process of providing services.'
