TRM Labs: Nobitex hack may have helped Israel arrest Iranian spies

TRM Labs analysts have hypothesized a possible link between the June hack of Iranian crypto exchange Nobitex and recent arrests in Israel in a case of spying for Iran. The report notes that three suspects were detained by Israeli authorities, two of whom were rewarded in cryptocurrencies – in one case up to $500 per task.

The hacking of the platform, for which the pro-Israeli group Gonjeshke Darande claimed responsibility, occurred just days before the arrests. According to analysts, the coincidence in timing may indicate that Israeli intelligence services used the data obtained from the cyberattack. It could be about wallets, IP-logs and correspondence history of users.

While Israeli authorities have not officially confirmed the connection, TRM Labs emphasizes that such an operation is in line with the known tactics of Israeli cyber entities and the nature of Gonjeshke Darande’s actions. The group also published the platform’s source code, adding pressure on Nobitex, a key element of Iran’s crypto infrastructure, according to Chainalysis.

Analysts note that Nobitex plays a central role in the country’s sanctioned crypto economy, and any compromise of the platform carries strategic risks for the entire Iranian digital sector.