The fallout from the Nobitex hack is still unfolding, and it may no longer be just about the missing funds as new reports point to a possible link between the breach and the recent arrests of three Israeli citizens.
According to the blockchain intelligence platform TRM Labs, Israeli authorities have arrested three individuals accused of spying for Iran.
The suspects, aged between 19 and 28, were allegedly recruited by Iranian handlers to carry out intelligence-related tasks in exchange for cryptocurrency. Their activities ranged from surveillance and photographing military sites to tagging pro-Iran graffiti and tracking high-profile officials.
Details of the arrests surfaced on June 24, coming just days after the June 18 Nobitex hack. The breach, which resulted in losses exceeding $90 million, was carried by Gonjeshke Darande, the pro-Israel hacking collective known for targeting Iranian-linked infrastructure.
Per TRM Labs, the cyberattack may have done more than just drain wallets. While no direct link between the two events has been confirmed, the analysis suggests that data obtained during the Nobitex breach may have played a role in identifying the recently arrested suspects.
From hacks to handcuffs?
Both Israeli cyber defense teams and Gonjeshke Darande, also known as Predatory Sparrow, have a history of using cyber tools for intelligence gathering. In this case, they may have accessed internal data such as wallet information, KYC records, or private communications, which potentially aided the identification of the Iranian handlers or tracing payments to operatives.
That possibility is supported by the leak of Nobitex’s sensitive data just a day after the breach, suggesting the hackers had deep access into the exchange’s infrastructure.
The arrested suspects were reportedly paid thousands of dollars for various operations, with funds delivered through anonymized channels. Israeli authorities said these payments were traceable on-chain and formed part of the evidence used in the investigation.
Meanwhile, the Nobitex hack also revealed suspicious fund movements by the exchange dating back several months, tied to illicit activity and potential money laundering. A separate investigation pointed to quiet, structured fund transfers, and the use of stealth tactics to obscure their trail.
In some cases, those funds were linked to wallets associated with malicious actors, and the emergence of the potential ties to espionage raises further questions about Nobitex’s transparency and operations.
