Government Moves to Restrict Crypto Trading Amid Escalating Tensions

In the wake of the devastating $100 million cyberattack on Nobitex, Iran’s largest cryptocurrency exchange, the country’s central bank has since imposed strict new operating hours on domestic crypto platforms.

As of Wednesday, all Iranian crypto exchanges are limited to business between 10 a.m. and 8 p.m., a move analysts say is designed to both prevent further attacks and tighten the regime’s control over cross-border capital flows.

Andrew Fierman, head of national security intelligence at blockchain analytics firm Chainalysis, explained to Cointelegraph that the curfew is likely an attempt to “stay on top of any further attacks, because incidents are easier to triage if they’re not happening in the middle of the night.”

He added, “while the people of Iran leverage cryptocurrency exchanges to facilitate cross-border transactions, the Iranian regime may want to assert more control over their citizens’ transactions.

"This is especially the case during times where geopolitical tensions are high and capital flight from Iran is possible.”

A Politically Motivated Strike

Pro-Israel hacker group Gonjeshke Darande has claimed that they were the people responsible for the Nobitex hacking.

The group infiltrated Nobitex’s internal systems and instead of pocketing the stolen funds to thier own crypto wallets, the hackers sent them to a burner addresses with no private key access, effectively locking the digital asset away with no way of making them retrievable.

The drained wallet contained a range of cryptocurrencies-including Bitcoin Ethereum, Dogecoin, XRP, and Solana, which had a total worth of at least $100 million.

While most crypto hacks are financially motivated, this incident stands out for its political intent.

“This event stands out given the intent appears to have been politically motivated to take funds away from the regime.”

The Nobitex hack comes after a series of Israeli airstrikes inside Iran, as part of an ongoing and escalating military conflict between the two countries.

Following the hack, Nobitex severed all external access to its servers and assured users that the situation is now “under control.”

The exchange’s communication team stated on X that, while user access remains temporarily unavailable, all assets lost in the hack will be covered by the Nobitex Reserve Fund.

The Nobitex technical team is also emptying the exchange's online hot wallets and sending them to offline cold storage devices to prevent further exploits and losses.

However, ongoing internet disruptions and blocked access to external servers mean that restoring full user access to the platform may take longer than usual.

A Critical Hub in Iran’s Crypto Ecosystem

Nobitex is not just Iran’s largest crypto exchange—it is the backbone of the country’s digital asset ecosystem.

Chainalysis data shows that Nobitex has processed over $11 billion in total inflows, significantly more than the combined inflows of the next ten largest Iranian exchanges.

The platform serves as a vital gateway for Iranian users seeking access to global crypto markets, and is a central pillar of the country's digital asset ecosystem.

"Nobitex isn't just a local exchange; it serves as a critical hub within Iran's heavily sanctioned crypto ecosystem, enabling access to global market for users cut off from traditional finance."

Beyond its domestic role, Nobitex also has close association with a range of sanctioned and illicit actors, including the Houthi rebels in Yemen, pro-al-Qaeda propaganda channels, and sanctioned Russian crypto exchanges Garantex and Bitpapa.