-
On-chain analysis reveals that Iran’s Nobitex exchange employed laundering-like techniques such as peelchains and chip-off wallets to move funds months before the $90 million hack.
-
A “rescue wallet” had been quietly accumulating smaller Bitcoin amounts since October 2024, indicating premeditated fund movements rather than a reactive measure.
-
Post-hack transactions mirrored previous patterns, suggesting Nobitex maintained control and continued its standard liquidity practices despite the breach, according to blockchain intelligence firm Global Ledger.
New blockchain data reveals Nobitex’s pre-hack laundering techniques and ongoing fund movements, exposing deeper operational practices behind the $90 million breach.
Uncovering Nobitex’s Pre-Hack Fund Laundering Techniques
Detailed on-chain investigations have uncovered that Nobitex utilized peelchaining—a method where large Bitcoin amounts are split into smaller, more manageable chunks and routed through a series of short-lived wallets. This approach is widely recognized for complicating traceability and is commonly linked to money laundering activities.
Global Ledger’s forensic analysis identified a consistent pattern of BTC being moved in increments of approximately 20 to 30 coins. Additionally, Nobitex employed chip-off wallets, which are single-use deposit and withdrawal addresses designed to obfuscate the flow of funds by funneling BTC through multiple new wallets. These practices collectively created a complex web of transactions that masked the true origin and destination of user assets.
The Persistent “Rescue Wallet” and Its Role in Fund Movements
Contrary to Nobitex’s public statements that the “rescue wallet” was a new security measure post-hack, blockchain records trace its activity back to October 2024. This wallet had been systematically collecting smaller BTC transfers from internal wallets, following the same laundering-like transaction patterns observed throughout the exchange’s operations.
The wallet’s long-term activity suggests it was part of an established liquidity management strategy rather than an emergency response. Multiple transfers of 20 to 30 BTC were funneled into this wallet well before the breach, indicating a deliberate and ongoing process of fund consolidation.
Post-Hack Transactions Indicate Continued Operational Control
Following the June 18 hack, Nobitex executed a full-balance sweep of 1,801 BTC into the so-called “rescue wallet.” This movement was not an isolated incident but rather a continuation of pre-existing fund management practices. On June 19, an additional 1,783 BTC was transferred to a new wallet, aligning with Nobitex’s claims of securing assets.
These transactions demonstrate that Nobitex retained operational control over its wallets and continued to manage liquidity using the same complex layering techniques. The hack did not disrupt these processes but instead exposed them to public scrutiny.
Insights from the Gonjeshke Darande Leak
The pro-Israel hacking group Gonjeshke Darande’s leak of Nobitex’s internal wallet structure provided further context to the forensic findings. The exposed data confirmed the frequent use of peelchains and chip-off wallets, reinforcing the notion that Nobitex’s fund movements were methodical and systematic rather than chaotic or reactionary.
Repeated transfers from old wallets to new ones, often broken down into smaller BTC chunks, are consistent with standard money laundering methodologies designed to obscure asset trails and complicate forensic analysis.
Conclusion
The blockchain evidence surrounding Nobitex’s $90 million hack reveals a deeper narrative of premeditated and ongoing fund obfuscation. Rather than a sudden response to a security breach, the laundering-like activities were embedded in the exchange’s operational framework for months prior. This case underscores the importance of rigorous on-chain analysis in uncovering hidden financial behaviors within crypto exchanges and highlights the need for enhanced transparency and regulatory oversight in the sector.
