Worked example · 2025-06

Nobitex — multi-chain hot-wallet key compromise drains Iran's largest exchange — EVM chains + Tron — 2025-06-18

Loss: ~$90M realised. Attackers obtained the private keys to Nobitex's hot wallets and drained crypto across multiple chains — EVM-compatible networks and Tron. The entry mechanism reported across analyses is compromised private keys that had been insecurely stored on operator systems the attackers had access to, giving them direct control of the hot wallets rather than any smart-contract or trading exploit. The realised figure (~$90M; some early counts ~$81.7M before full enumeration) is the full hot-wallet balance the attackers could reach across the affected chains.
OAK Techniques observed: OAK-T11.011 (Multi-chain Key-store Co-location — the architectural signature and the headline technique: a single operator-side compromise yielded keys for hot wallets across EVM chains and Tron, producing simultaneous multi-chain extraction from one intrusion. This is T11.011 at its canonical exchange-hot-wallet layer — the same shape as Poloniex / HTX / Phemex — where the diagnostic is large, near-simultaneous outflows across multiple unrelated chains, incompatible with several independent per-chain breaches. See techniques/T11.011-multi-chain-key-store-co-location.md). OAK-T11.012 (Server-Side Raw Private-Key Storage — the storage failure that made it possible: hot-wallet private keys were held in a form reachable from compromised operator systems rather than in HSM/MPC custody, so compromising the systems was equivalent to holding the keys. See techniques/T11.012-server-side-raw-private-key-storage.md). OAK-T15.003 (Operator-Endpoint Compromise — the entry vector: attacker access to the operator infrastructure on which those keys were stored. See techniques/T15.003-operator-endpoint-compromise.md). The chain is T15.003 (operator-system access) → T11.012 (raw keys reachable on those systems) → T11.011 (co-located across EVM + Tron → one-shot multi-chain drain) — the standard exchange-custody failure chain, independent of who the attacker was or what they did with the funds afterward.
Attribution: pseudonymous (publicly claimed / self-attributed). The pro-Israel group Gonjeshke Darande ("Predatory Sparrow") publicly claimed the attack and announced it would publish Nobitex's source code on 2025-06-18; the disposition of funds (below) and political messaging are consistent with the claim, though full on-chain confirmation of the mover was not established at the time. OAK records the actor as a publicly-claiming pseudonymous group, with motivation noted as a neutral metadata field — it does not change the incident's classification, severity, or the custody lesson.
Disposition (one-line, neutral): the stolen funds were sent to vanity addresses (slogans such as a variation of "F*ckIRGCterrorists") that are computationally infeasible to hold the private keys for, i.e. the proceeds were provably burned / made unspendable rather than laundered — so realised loss is the full ~$90M and unrecoverable. This is recorded as the fund-disposition field only; it does not make the event less of a theft and does not alter the entry-vector or prevention analysis.
Key teaching point: An exchange's whole security reduces to where its hot-wallet keys live and how much they hold — and keys reachable from compromised servers are already stolen. Nobitex lost ~$90M not to a clever protocol exploit but to the oldest exchange failure: private keys sitting where an intruder could reach them, and one key-store spanning multiple chains. The defender lessons are the standard custody controls, and they are entirely independent of attacker identity or what happened to the funds: (1) hot-wallet keys belong in HSM/MPC custody, never raw on application or operator servers — compromising a server must not equal holding a key (mitigates T11.012); (2) segregate keys per chain so no single compromise reaches EVM and Tron and others at once — co-location is what turns one intrusion into a multi-chain drain (mitigates T11.011); (3) minimise hot-wallet balances with the bulk in cold storage and automated sweeps, so the reachable-at-any-moment exposure is small; (4) monitor for mass simultaneous outflows across chains and auto-pause withdrawals — near-simultaneous cross-chain drains are the T11.011 signature and the highest-leverage runtime trip-wire. Nobitex is OAK's anchor for multi-chain exchange hot-wallet co-location with the additional, separately-logged observation that destruction-as-payload (burning to vanity addresses) is a possible fund disposition that leaves realised loss at 100% and recovery at zero.

Backfill note: this is a 2025-06-18 incident added to OAK as a previously-uncovered gap, not a June-2026 event. It is included because a ~$90M exchange hot-wallet compromise with a clean custody lesson belongs in the corpus regardless of date.

Summary

Nobitex was Iran's largest cryptocurrency exchange. On 2025-06-18, attackers gained control of its hot-wallet private keys — reported to have been insecurely stored on operator systems the attackers compromised — and drained roughly $90M in assets across EVM-compatible chains and Tron. There was no smart-contract or market exploit; the attackers simply held the keys and moved the funds.

The pro-Israel group Predatory Sparrow (Gonjeshke Darande) claimed responsibility and said it would release Nobitex's source code. Rather than launder the proceeds, the attackers sent them to vanity "burn" addresses carrying anti-IRGC slogans; because addresses with strings that long cannot have their private keys brute-forced, the funds are unspendable and unrecoverable — destroyed to send a political message. For OAK's purposes the load-bearing facts are the entry vector (server-stored hot-wallet keys, co-located across chains) and the custody controls that would have prevented or contained it; the actor's motivation and the burn disposition are recorded as neutral metadata.

Timeline (UTC)

When	Event	OAK ref
Pre-2025-06-18	Nobitex hot-wallet private keys for EVM chains + Tron held in a form reachable from operator systems (not HSM/MPC), co-located across chains	T11.012 + T11.011 standing surface
2025-06-18	Attackers access the operator systems and obtain the hot-wallet keys	T15.003 entry
2025-06-18	~$90M drained across EVM chains and Tron in near-simultaneous multi-chain outflows	T11.011 execution
2025-06-18	Predatory Sparrow / Gonjeshke Darande claims the attack; funds sent to unspendable vanity "burn" addresses; group says it will publish Nobitex source code	(claim + disposition)
2025-06 onward	Nobitex resumes service in stages; incoming volumes fall sharply	(recovery / aftermath)

What defenders observed

Pre-event (key custody + co-location). Hot-wallet keys reachable from compromised systems, and one key-store spanning EVM + Tron, are the two standing failures. Controls: HSM/MPC custody (no raw keys on servers, mitigating T11.012) and per-chain key segregation (mitigating T11.011). There is no on-chain signal for this; the exposure lives entirely in custody architecture.
At-event (simultaneous multi-chain outflows). The decisive on-chain signature is large, near-simultaneous withdrawals across multiple unrelated chains — the T11.011 diagnostic, inconsistent with independent per-chain intrusions and a high-confidence indicator of co-located key material. A cross-chain mass-outflow monitor with automated withdrawal-pause is the highest-leverage runtime control.
At-event (destination = unspendable vanity addresses). Outflows to addresses encoding human-readable slogans (vanity addresses) whose keys are computationally infeasible are an unusual but recognisable signature of destruction rather than laundering; it does not aid recovery (the funds are gone) but it is a strong corroborating signal of the claim and motivation.
Post-event (resumption). Nobitex's staged resumption and the sharp drop in inbound volume are aftermath signals; the security lesson is upstream, at custody.

Public references

[elliptcnobitex2025] — Elliptic, "Iranian crypto exchange Nobitex hacked for over $90 million by pro-Israel group" (2025-06-18; >$90M across multiple chains; Predatory Sparrow / Gonjeshke Darande claim; vanity-address burn, funds unrecoverable): https://www.elliptic.co/blog/iranian-crypto-exchange-nobitex-hacked-pro-israel-group
[halbornnobitex2025] — Halborn, "Explained: The Nobitex Hack (June 2025)" (compromised-private-key root cause; insecurely stored keys on compromised systems; hot-wallet drain across EVM + Tron): https://www.halborn.com/blog/post/explained-the-nobitex-hack-june-2025
[trmnobitex2025] — TRM Labs, "Inside the Nobitex Hack" (multi-chain drain; hot-wallet compromise; context and aftermath): https://www.trmlabs.com/resources/blog/inside-the-nobitex-hack-how-the-iran-israel-conflict-exposed-tehrans-grip-on-its-crypto-services
[zengononbitex2025] — Tal Be'ery (Zengo), "The Vanity Address Affair: The Iranian Crypto Exchange Hack" (vanity addresses brute-forced for slogans; private keys computationally infeasible; funds effectively burned/locked forever): https://medium.com/zengo/the-vanity-address-affair-the-iranian-crypto-exchange-hack-a6047259f268
[bleepingnobitex2025] — BleepingComputer, "Pro-Israel hackers hit Iran's Nobitex exchange, burn $90M in crypto" (~$90M; hot-wallet theft; burn-to-vanity disposition; source-code release threat): https://www.bleepingcomputer.com/news/security/pro-israel-hackers-hit-irans-nobitex-exchange-burn-90m-in-crypto/

Discussion

Nobitex is a textbook T11.011 exchange-hot-wallet case and a useful 2025 backfill anchor alongside Poloniex/HTX/Phemex: one operator-side compromise produced simultaneous EVM + Tron extraction, which is the co-location signature, and the storage failure (T11.012) is what made server access equivalent to key possession. The custody lesson — HSM/MPC, per-chain segregation, minimal hot balances, cross-chain outflow monitoring with auto-pause — is the entire transferable content and is identical regardless of who the attacker was or what they did with the money.

Two metadata facts are recorded but deliberately kept out of the load-bearing analysis. First, motivation: the attacker was a politically-motivated group, not a profit-seeker; OAK logs this neutrally and does not treat it as a different class of incident — a drained exchange is a drained exchange. Second, disposition: the proceeds were burned to unspendable vanity addresses rather than laundered. That is an unusual disposition worth noting as a recognisable signature (and it pins realised loss at 100% with zero recovery), but it changes nothing about the entry vector or the prevention. Contributors should resist letting either fact reframe the case: the reason Nobitex is in OAK is the multi-chain hot-wallet key-custody failure, and that is where the defensive value lives.