TRM Labs Suggests Link Between Cyberattack and Espionage Arrests
A recent report by crypto forensics firm TRM Labs has raised the “analytical possibility” that Israeli cyber units exploited internal data obtained during a $90 million hack on Iran’s largest crypto exchange, Nobitex, to identify and arrest individuals accused of espionage for Iran.
The analysis follows the arrest of three suspects in Israel, accused of conducting intelligence-gathering and propaganda tasks for Iranian services. Two of the operatives reportedly received cryptocurrency payments for their missions.
Crypto Payments Used in Covert Espionage
TRM Labs highlighted the case of 28-year-old Dmitri Cohen, who was allegedly paid $500 in cryptocurrency per task by Iranian intelligence.
“The arrests represent a rare public case of state-sponsored espionage in which operatives were compensated using digital assets,” TRM Labs stated.
This underlines how digital currencies are increasingly used in covert operations, bypassing traditional financial systems.
Nobitex Hack Timeline Aligns With Espionage Operation
The Nobitex breach occurred on June 18, draining over $90 million from the exchange’s hot wallets across multiple networks.
Shortly after the attack, pro-Israel hacker group Gonjeshke Darande claimed responsibility.
The timeline raises questions:
- June 13: Israeli airstrikes in Syria
- June 18: Nobitex crypto hack
- June 24: Israeli government announces espionage arrests
TRM Labs emphasized that while no direct evidence links the events, “the timing and tactical profile suggest potential intelligence overlaps.”
Gonjeshke Darande: A Cyber-Intelligence Player
Gonjeshke Darande has a track record of targeting platforms tied to the Iranian regime, combining cyber sabotage with intelligence gathering. This latest attack fits a familiar pattern of operations involving deep network infiltration and data extraction.
Nobitex: Key Player in Iran’s Sanctioned Crypto Space
Onchain data firm Chainalysis pointed out Nobitex’s role as a critical infrastructure in Iran’s restricted crypto ecosystem, facilitating access to global markets amid sanctions.
Chainalysis has also tied Nobitex to:
- IRGC-linked ransomware groups
- Sanctioned Russian crypto exchanges
- Other illicit finance operations
This raises the strategic importance of Nobitex’s internal data, making it a high-value intelligence target.
Conclusion
While there is no official confirmation linking the Nobitex hack to espionage arrests, TRM Labs’ findings suggest the possibility that Israeli cyber units leveraged the breach to access critical intelligence — including wallet data and private communications — to uncover state-sponsored agents.
This incident underlines the growing intersection between cyberwarfare, cryptocurrency, and international intelligence operations in the digital age.
Disclaimer
This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.