Beyond the stolen millions, the breach exposed a deeper truth: Iran’s crypto economy is less a market than an extension of state power. Leaked code shows surveillance built in, VIPs protected, and miners mobilized in crisis.
In a report shared with crypto.news on July 17, TRM Labs revealed how Israel-linked hackers known as Predatory Sparrow infiltrated Nobitex on June 18, siphoning $90 million in a politically charged cyberattack.
But the breach did more than drain funds; it laid bare Tehran’s hidden control over the exchange, from warrantless surveillance tools to preferential treatment for regime-linked users.
The fallout has been severe. Nobitex, Iran’s largest crypto platform, saw outflows spike 150% as users fled ahead of Israeli missile strikes. Post-hack, transaction volumes cratered by 70%, exposing a crisis of confidence.
Meanwhile, leaked source code confirmed what many suspected: the exchange was designed to serve the state, with backdoors for monitoring and VIP lanes for elites. For Iran, it seems crypto was always more about control than financial freedom.
How the Nobitex hack exposed Iran’s surveillance state
The leaked source code from the Nobitex breach reads like a blueprint for financial authoritarianism. Buried in the technical documentation were modules explicitly designed to give Iranian security agencies unfettered access to user transactions while carving out exceptions for politically connected elites.
According to TRM Labs’ analysis, the exchange’s systems included “hardcoded permissions granting state-aligned entities warrantless monitoring capabilities,” while VIP accounts routed through separate infrastructure whose code “had modules for generating stealth addresses, obfuscating transactions, and evading surveillance”, all designed to avoid scrutiny.
This two-tiered architecture allowed government agencies to monitor transactions without legal oversight while simultaneously shielding elite users. The design choice, now public, immediately undercut any pretense of decentralization or financial neutrality.
TRM analysts noted that Nobitex’s internal APIs routed transactions from high-value or politically connected accounts through separate fraud-check logic, bypassing traditional compliance protocols altogether.
The hack also triggered an unexpected crisis response from Tehran. Within 72 hours of the attack, long-dormant Bitcoin wallets linked to Iran’s mining operations began moving funds, ultimately funneling over $27 million into Nobitex’s new hot wallets.
These mining operations, concentrated in state-backed industrial parks near hydroelectric dams, have become critical to Iran’s sanctions evasion playbook. By converting subsidized energy into Bitcoin, the regime generates hard currency while obscuring revenue streams.
The Nobitex incident demonstrated how quickly these assets can be mobilized, with mining rewards untouched since 2021 suddenly liquidated to stabilize the exchange.
Yet the real damage may be irreversible. The 70% collapse in Nobitex deposits suggests ordinary Iranians are voting with their wallets, fleeing an exchange now openly exposed as an arm of the state.
Compounding the distrust, Tehran imposed overnight trading bans within days of the hack, causing USDT premiums to spike 40% on peer-to-peer markets. What began as a cyberattack has metastasized into a full-blown crisis of confidence, one that undermines Iran’s narrative of crypto as a reliable alternative to the dollar.
