Illustrative image | Iran flag. (Photo: Unsplash) | Computer hacker. (Photo: iStock) | Bitcoin. (Photo: Unsplash) 
In what appears to be one of the most politically motivated cryptocurrency heists in history, the pro-Israel hacker group Gonjeshke Darande (Predatory Sparrow) infiltrated Iran’s largest crypto exchange, Nobitex, making off with between R1.5-billion and R1.8-billion in bitcoin, ethereum, dogecoin, XRP and solana.
But here’s the twist: it wasn’t about the money. Instead, the hackers “burned” the stolen cryptocurrency, permanently removing it from circulation by sending it to inaccessible wallet addresses — a digital equivalent of setting cash on fire.
The attackers used provocative “vanity addresses” containing explicit anti-terrorist messages, making their political motivations crystal clear.
After the IRGC’s “Bank Sepah” comes the turn of Nobitex
WARNING!In 24 hours, we will release Nobitex's source code and internal information from their internal network.
Any assets that remain there after that point will be at risk!The Nobitex exchange is at the heart of the… pic.twitter.com/GFyBCPCFIE
— Gonjeshke Darande (@GonjeshkeDarand) June 18, 2025
“Unlike typical hacks for financial gain, the intent here appears to have been politically motivated, aiming to take funds away from the regime,” according to an analysis of the incident.
The same group also claimed responsibility for simultaneously destroying data at Iran’s state-owned Bank Sepah, which they accused of funding Iran’s military.
The sophistication of these attacks has led security experts to suggest they’re beyond the capabilities of typical activist hackers and more in line with nation-state operations.
Iran’s crypto curfew response
Iran’s central bank responded by imposing strict operating hours on domestic crypto exchanges, limiting them to 10am-8pm daily. This “crypto curfew” appears designed to prevent capital flight during periods of high geopolitical tension and assert greater control over citizens’ cross-border cryptocurrency transactions.
It’s not the first time Iran has flexed its regulatory muscles over crypto. In December, the central bank temporarily shut down all exchanges to prevent the national currency, the rial, from depreciating further.
The timing couldn’t be worse for Iranian crypto users. Chainalysis notes that Nobitex plays a critical role in Iran’s crypto ecosystem, processing more than R200-billion in total inflows, significantly more than the next 10 largest Iranian exchanges combined.
For Iranian users cut off from traditional finance due to international sanctions, it serves as a crucial gateway to global crypto markets.
Lessons for Africa
When national currencies face devaluation due to economic instability or sanctions, cryptocurrencies and stablecoins can serve as stores of value. This is particularly relevant in African countries experiencing high inflation or currency instability.
Unlike traditional financial systems that can be easily shut down or restricted by governments, cryptocurrency networks operate across borders and are more difficult to completely block, though governments can still restrict access to exchanges and on-ramps.
Iran’s crypto curfew shows how quickly governments can impose restrictions during crises. This uncertainty can affect market access and asset values.
The key is staying informed about local regulations, using reputable exchanges with strong security practices, and understanding that while cryptocurrency can provide financial flexibility during uncertain times, it’s not immune to geopolitical shocks and market volatility.
Global market meltdown
The crypto market’s reaction to escalating Middle East tensions has been swift and brutal. Following US airstrikes on Iranian nuclear facilities and President Donald Trump’s hints at potential regime change, global cryptocurrency markets shed more than R20-billion in liquidations within 24 hours.
Bitcoin crashed below the six-figure mark for the first time in 45 days. Ethereum plummeted to its lowest price since May, while solana dropped by 8%.
The Block’s GMCI30 index, tracking the top 30 cryptocurrencies, slid by nearly 10% over the week, with smaller altcoins faring even worse — small caps plunged by 17% and AI-linked tokens plummeted by 20%.
Perhaps most tellingly, Iran’s parliament urged leaders to consider closing the Strait of Hormuz, a crucial artery for global oil shipments. While Iran has never successfully closed the strait, the mere threat rattled markets and highlighted how quickly geopolitical tensions can spill over into financial markets.
The selloff challenges the narrative of bitcoin as a “safe haven” asset during geopolitical uncertainty. Instead of flocking to crypto, traders opted to cash out, suggesting that fear temporarily outweighed any safe haven appeal.
African lessons in regulatory balance
The Iranian situation offers valuable lessons for African regulators grappling with how to approach cryptocurrency regulation. Sub-Saharan Africa has the world’s highest rate of stablecoin adoption at 9.3%, with Nigeria ranking as the world’s second-largest adopter of digital assets.
But the Nobitex hack serves as a reminder of the cybersecurity risks associated with centralised exchanges. African countries and exchanges need robust security protocols, regular audits, and clear incident response plans to protect user funds and maintain trust.
Perhaps most importantly, the Iranian situation demonstrates the dangers of regulatory ambiguity. Iran’s central bank warnings conflict with the pervasive use of crypto in the country, creating uncertainty that can be exploited by bad actors or lead to poorly designed reactive policies. DM