Bitcoin Forum

In the early hours of today, it was reported that a popular crypto exchange in Iran has been exploited by some group of people. Coins like Bitcoin, Tron, Doge and other Evm were moved from the exchange wallets and sent to the following vanity addresses.

• TKFuckiRGCTerroristsNoBiTEXy2r7mNX (https://tronscan.org/#/address/TKFuckiRGCTerroristsNoBiTEXy2r7mNX)
• 0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead (https://blockscan.com/address/0xffFFfFFffFFffFfFffFFfFfFfFFFFfFfFFFFDead)
• DFuckiRGCTerroristsNoBiTEXXXWLW65t (https://blockchair.com/dogecoin/address/DFuckiRGCTerroristsNoBiTEXXXWLW65t)

Source: https://x.com/nobitexmarket/status/1935222149989519671
          : https://x.com/watcherguru/status/1935232104347877422

This is all link to what's happening between Israel and Iran recent fight but do we have to involved innocent businesses and peoples money.

-Not your keys, not your funds.

The addresses starts from T, 0x and Do, that are not bitcoin addresses, bitcoin addresses start from 1, 3 or bc1. Or is there where I omitted bitcoin address?

Gonjeshke Darande hacked the exchange. Gonjeshke Darande is a pro-Israel hacker group in Israel.

I wish the escalating war is stopped.

Edit: Seen, this is the bitcoin address: 1FuckiRGCTerroristsNoBiTEXXXaAovLX

Yes, I heard this news from Cointelegraph notifications from their Telegram channels. Any exploit isn't expected, but this seems to be the result of a recent Iran and Israel war. Every war destroys either real-life things or virtual things. Also, we can see the crypto market crashed a little bit for the current war. Though these exploits don't have much effect on the crypto market, for the exchange users, the amount is big. Don't know how the exchange will recover those losses.

The exploit reminds us again about not storing our cryptocurrency in any exchange. Just exchange and move your coins to your own wallet. Otherwise, you need to be ready to lose your funds, because every exchange won't compensate for your loss. I pray to stop the war and come to a solution. War won't bring any good things; people are losing their lives and won't recover ever.

I dont know with the rules of war but this could be another tactics by the enemy of Iran, well target their plausible source fund in the matter. But honestly, does this means that attacking or stealing funds from their opponent is decent move when it comes to war? It might not be from Iran Government but the citizens of Iran also got affected by these war events.

Exactly. T is a Tron address. D is a Dogecoin address.


And it looks like they burned all of the coins. They didn't even steal them or anything.

If this group is backed by Israel, then this is a cyber war similar to a real-life war. Unfortunately, the platform users will pay the price for this war, because centralized exchanges are always vulnerable to these tensions and cyberattacks , whether it’s hacking or bankruptcy.

$80 million is not a small amount. These recurring incidents teach us an invaluable lesson: never store funds on CEXs. There are no guarantees your money will be safe long-term. Buying a hardware wallet for a few dollars is a great way to save yourself the headache.

I am just hearing about this exchange for the first time, but it is the largest cryptocurrency exchange in Iran and a lot of Iranians use their service, too bad $90m of customers funds were stolen and burned, because from what i read, the funds were sent to burner addresses, so that makes this even more crazy and painful for the victims.

Take note that the same group that took responsibility for this attack were also responsible for the attack on Iran's state-owned bank Sepah earlier in the week, so it is obvious that this group is targeting Iranian services on purpose, which is another angle to the war.

This is obviously all part of the conflict. This is why everybody should hate wars. It's actually a free-for-all violence. Civilians are killed. Private properties reduced to rubles. Money is wasted.

Many are saying Bitcoin is a way for them to protect their money in times of war because banks would be closed, ATMs unrefilled, withdrawals not allowed, stocks plunge, fiat value nosedives, and so on. Well, it's only true if it's kept in self-custody. Otherwise, it's pointless. If kept in a custodial wallet, it could end up a collateral damage, as clearly demonstrated in this case.

Now we know how weak are the security in unpopular centralized exchanges.

Local exchanges are prone against hack because they haven't been tested and threatened many times just like popular exchanges.

Shame on Israel, they're trying to attack in any aspect even it's illegal, they exploit and attacking financial institutions means they're also attacking the civilians.

This is not true, any centralized exchange can be hacked, Binance has been hacked in the past, Bybit was hacked recently and so many other popular exchanges have either be hacked for funds or customer data. The best recommendation is not to store funds in any centralized exchange at all.

I even believe attackers go after bigger exchanges more than the smaller ones, because they handle a lot of customers funds and the attackers have a lot to gain if they successfully attack them, either for funds or to steal data.

And I don't know if there are still people who uses this kind of exchange? I never heard of it before, so again, maybe some of us here are familiar and could have used it at one point and could have been a victim. It's very hard to comment though on the attack, on who is behind it. Maybe there is political motive behind, but we can only pray that it will stop or at least it won't be escalating into a full blow war. In any case, another proof that everyone is vulnerable, not just this low tier exchange. We have seen even high level exchange being attacked as way. So if we could only keep our on crypto in a wallet that we control, then it's a better practice for us.

Sad news for people who are already devastated by attacks from Israel.  Many of the affected users are citizens who will have to suffer at this time when they need money to evacuate. If this set of hackers didn't take responsibility and the funds were not sent to burner addresses, the media would have linked them to the North Korean Lazarus Group as usual.

The war is now multifaceted because it is not only fought on the battlefield. The exchange has made a statement that customers will get their funds since it is insured. Let's see how things will unfold.

It is very popular in Iran.

If you are not an Iranian, then you would probably not know this centralized exchange, but like i have already said, it is the largest cryptocurrency exchange in Iran, so any Iranian in the crypto industry would surely know this exchange. Take note that so many countries and services have sanctioned Iran, so i am sure a lot of Iranians use this service.
Everything is already in this thread, we know who is behind it, it is a hacker group from Israel named "Gonjeshke Darande". The crazy thing is that this hacker group have also threatened to release Nobitex's source code and internal files, so the trouble for customers of this service may be far from ending.

It's more about sending a message than stealing, as it was outlined.

Bad for the people, surely, and I wonder who would refund them something, and if there will be a refund in the first place..

What would these hackers gain for the action of theirs because it's bad to render someone poor in a state of war. This is can kill the victims very slow without been hit by a bullet or bomb since many of the victims might have their life savings kept in the exchange. Some people don't learn from others mistake and prefer to become victims.

I hope that the war will stop soon and let there be peace. When you are at war, the number of your enemies increases. I hope that those newbies using exchanges to keep their funds will learn from this and be in self custody of their funds by using a noncustodial wallet. Not your keys, not your coins.

According to a report, Gonjeshke Darande has already released the full source code of the exchange.

Services have been suspended in Nobitex. But they promised customers that operations would resume in five days, but the Internet challenges caused by the war might make their recovery longer.

https://www.tradingview.com/news/cointelegraph:4acfc8cc3094b:0-nobitex-source-code-leaked-after-100m-hack-by-pro-israel-group

My thoughts too and also for popular ones. If they are a target of a sophisticated enough hacking group any vulnerability they have will be exploited and you lose your funds. You should not have your coins in a platform you have no custody in and cannot determine the security level.

I will be really surprised if they commence activities and allow users withdraw. The stolen funds are quite large and it will be difficult for the exchange to recover

- Jay -

If it's proven beyond reasonable doubts that the hack was Israel, related then I'd say that it's very unfortunate because innocent civilians have funds in that exchange. I don't know a country or their sympathizers that will target civilian assets to cripple their enemy's strength, I'm not in the military but I doubt that it's supposed to be in the rules of engagement.

Anyway the lesson for us crypto holders regarding leaving our coins in an exchange remains the same, they're not safe to hold our cryptocurrency. Hacks and bankruptcy is not a new development with exchanges, better to avoid any regrets by embracing self custody in a none custodial wallet. Not your keys not your coins.

It is worth knowing that the exchange customers do not suffer any loss and the exchange told its customers that they will continue to operate and that only little amount of money was stolen.

To people that are holding money on an exchange, it is highly wrong.

But about Iranians being the people that are suffering for it, that is how war is. Properties can be destroyed and lives can be lost. Anything bad can happen during war. We should not pray for one.

This should always be the lesson that no one should leave their funds on centralized exchanges. We'll never know how and when hackers will come to fetch their funds there. Despite that there are exchanges promising and guaranteeing that funds are safu, still, your only way to be safe is through making yourself safe by avoiding depositing that much on them.

All of these addressee are vanity address if you look at them. The message is also very clear on the addresses as well.

I doubt it is a task of any hacker group or an individual hacker. 90 million is a tempting amount to take and run. It's most likely done by some government supported groups. That is the only explanation why such a huge amount of cryptos were burnt and lost forever.

Unfortunate and absolutely furious to see so many cryptos are taken out of circulation. These could have been donated to some good causes.

Israel has a Mosad, probably one of the best intelligence. I'm still shocked about what they did to Hezbollah, they concealed explosives inside batteries of pagers and these batteries were from Taiwan and Hungary. The influence of Israel over the United States is huge too. Perfect, they are just perfect at doing what they do, they know how to spy, gather intelligence and do some other manipulations.

To my mind, that's not the only thing in this case and I'd say that the lesson of this accident is different. This exchange has access to their own keys, right? But they still lost over $80 million. So, even when keys belong to you, you have to take care of it, just holding a key doesn't mean everything.

FuckiRGTTerrorists

Individuals can also do it on behalf of the government in order to implicate them ;D

If you donate the coins for some good causes, the government will track it and get those involved arrested and maybe shutdown a few non KYC exchanges and mixers.

Indirectly they actually do not want money but just want to inform that some sites in Iran are easy to hack and this can also be a form of psychological attack carried out in the midst of critical conditions due to geopolitics that occur considering that if you look at some of the news that is happening now hackers are a group that is indeed pro-Israel.

But even so, I think this is an action that does not reflect something good because in the end we know that in the exchange there must be a lot of funds from innocent civilians and even have no interest whatsoever even though in this case their goal may be to show dominance but if in the end this is still related to the geopolitics of Iran and Israel then the steps taken I think are not very commendable.

Such reassuring statements are very familiar whenever an exchange suffers a breach. One has to take them with a pinch of salt.

In this case, the real situation might be much grimmer than what's made to appear in public. Interestingly, the figures are getting bigger. The earlier was $48 million. It grew to $81.7 million. The second to the last official announcement mentioned $100 million. That's not a "little amount of money".

Moreover, there's also a noticeable shift in the announcements, from "the situation is now under control" in the 4th update to "the scope and impact of the attack are more complex than initially estimated" in the 5th update.

Everyone has heard the bad news and now the war between Israel and Iran is over, thank God.
But what caught my attention were the addresses to which the stolen assets were sent. It was clear that they contained a message directed towardIran and the Iranian exchange Nobitex.

If we remove the first two letters from the first address, it becomes:
"FuckiRGCTerroristsNoBiTEX" which clearly means:
"Fuck-iR-GC-Terrorists-NoBiTEX"

The last address is exactly the same. I wonder how they were able to create these custom addresses containing these targeted messages? Are there wallets that allow user to create such custom addresses?

It's very simple to create a burner address that says whatever you want. Just calculate the checksum of the address and add it at the end, like in Bitcoin. If my memory serves me correctly.

Nevertheless, hacking private institutions like this is illegal and does virtually nothing to impede the country they are trying to hurt. It only hurts innocent people who have their money there.

This is what hurts me too. Unfortunately, innocent people are often the victims.
These people whose accounts were hacked and whose assets were stolen most likely had nothing to do with this conflict, and a large portion of them may be fundamentally against the Iranian regime.

As you mentioned, such operations harm innocent people while harming the Iranian regime, because these senior officials would most likely not use such exchanges to deposit their money. Nor does it harm the Iranian economy. They simply believe they have dealt a major morale blow to their enemy.