In an unusual breach that diverges from the standard motives of profit-seeking cybercrime, over $90 million in several digital assets, including Bitcoin, Ethereum, XRP, Dogecoin, Solana, and TRX, was drained from Iran’s largest cryptocurrency exchange, Nobitex.
While the scale of the exploit spans multiple blockchains, the attacker’s actions reveal this was no ordinary theft. According to blockchain intelligence firm Chainalysis, the funds were not laundered or moved to cashout services but instead sent to vanity addresses designed to burn the assets.
No Recovery Possible for Thousands of XRP Stolen
Chainalysis noted that this tactic effectively burned the stolen crypto, as these custom addresses are presumed to have no known private keys, making recovery of the assets impossible.
XRPScan, the XRP Ledger tracker, weighed in on X, revealing that the stolen XRP (373,852 tokens) was also sent to a vanity address with no private key, effectively lost forever.
XRP funds from the recent Nobitex hack were sent to a vanity address with (presumably) no known private key. It is highly likely that the funds are now effectively burned: https://t.co/fUcbrjzvsE https://t.co/app93ztapk
— XRPScan (@xrpscan) June 19, 2025
This news excited some in the XRP army, as the massive token burn contributes to the asset’s deflationary model, creating scarcity and potentially increasing its price. However, this has yet to affect its price, as the asset is trading at $2.14, down 1.05% from yesterday.
Funds Burned Through Politicized Vanity Addresses
While 2025 has seen some notable crypto scams and thefts, this attack was different. It unfolded across various chains on June 18, 2025, with transactions traced from Nobitex to addresses embedded with overtly political messages. A visual flowchart released by Chainalysis illustrates how digital assets left Nobitex and were dispersed into multiple receiving wallets.
We are on X, follow us to connect with us :- @TimesTabloid1
— TimesTabloid (@TimesTabloid1) June 15, 2025
This incident adds to the growing list of significant crypto breaches in 2025, including the $1.46 billion ByBit hack that occurred in February. However, this theft was not about making money. These destinations were carefully crafted addresses that contained parts of the hacker’s ideological message.
One address, created on the Bitcoin blockchain, started with the string “1FuckiRGCTerroristsNoBiTEXXXaAovLX,” (Fuck iRGC Terrorists NoBiTEX) a direct political statement about the Islamic Revolutionary Guard Corps, also known as the Iranian Revolutionary Guards, embedded in the destination of the funds.
Rising Tensions and More Threats to Asset Holders
Israel launched Operation Rising Lion on June 13, targeting over 100 Iranian nuclear and military sites. In response, Iran has engaged in sustained missile and drone barrages against Israeli targets, resulting in hundreds of casualties on both sides.
The hackers have been identified as Predatory Sparrow, a hacktivist group, who have threatened to release the exchange’s source code and warned that all assets on the exchange are “entirely out in the open.” Given the current situation, Nobitex may have trouble securing loans, such as Bybit.
Disclaimer: This content is meant to inform and should not be considered financial advice. The views expressed in this article may include the author’s personal opinions and do not represent Times Tabloid’s opinion. Readers are advised to conduct thorough research before making any investment decisions. Any action taken by the reader is strictly at their own risk. Times Tabloid is not responsible for any financial losses.
Follow us on X, Facebook, Telegram, and Google News
