The mastermind behind the attack on Nobitex is suspected to be the Israeli hacker organization "Gonjeshke Darande".

On June 18, according to OnchainLens, the mastermind behind the hacking of the Iranian crypto trading platform Nobitex is suspected to be the Israeli hacker group “Gonjeshke Darande”. “Gonjeshke Darande” claimed responsibility for the attack, saying that “within the next 24 hours, the source code of Nobitex and its internal network will be released, and any assets within the trading platform will be at risk.” It is reported that the hacker group “Gonjeshke Darande”, which means “predator” in Persian, is known for carrying out cyberattacks on Iran’s critical infrastructure, such as gas stations, steel companies, and banks (such as Bank Sepah). While the group claims to be an independent hacking group, the technical sophistication of its attacks, as well as the targeting choices against the Iranian regime, suggest that it may have ties to the Israeli government or military, such as Unit 8200 of Israel’s military intelligence. Official Israel has maintained a vague policy on this and has never officially acknowledged its ties to the organization.