Nobitex Used Money Laundering Tactics Before and After $90 Million Hack

The recent $90 million hack at Iranian exchange Nobitex was more than just a security failure, according to a new report. On-chain analysis from blockchain intelligence firm Global Ledger reveals it was also a window into the platform's long-standing and sophisticated use of money laundering tactics.

Researchers found that the exchange's fund transfer patterns were identical for months before and after the June 18 breach, suggesting the post-hack “rescue” of funds was not an emergency response, but business as usual.

The Hack and the “Rescue” Operation 

The story began on June 18, when attackers exploited Nobitex's hot wallet, stealing an estimated $90 million in assets. The pro-Israel hacking group Gonjeshke Darande quickly claimed responsibility. In response to the attack, Nobitex publicly announced it was securing its remaining funds by moving 1,801 BTC (valued at approximately $187.5 million) into what it called a “rescue wallet.”

On-Chain Analysis Reveals a Different Story

However, a report from Global Ledger tells a different story. Their investigation into this “rescue wallet” revealed a suspicious history dating back to October 2024. For eight months prior to the hack, the wallet was steadily accumulating 20-30 BTC transfers from various internal Nobitex addresses, consistently using two techniques commonly associated with money laundering: peelchaining (splitting large transfers into smaller portions) and chip-off methods (using single-use wallets to obscure the fund trail).

The smoking gun came 24 hours after the breach: a 1,783 BTC transfer from the “rescue wallet” followed the exact same pre-hack behavioral patterns. This was not a panicked, defensive move; it was routine. Global Ledger's report offers a damning conclusion: rather than scrambling to contain a hack, Nobitex was merely executing its “long-standing scheme for laundering funds.”

Read also: How Military Conflict Could Impact Bitcoin Mining in Iran