Michaela
Global Ledger, a blockchain intelligence firm, has revealed that long before the recent $90 million hack on Iranās top crypto exchange Nobitex, the platform had been routinely shifting user funds using patterns typically linked to money laundering operations.
According to Global Ledgerās investigation, on-chain data shows that the crypto exchange employed a method called peel chaining. This involves breaking large sums of cryptocurrency into smaller, hard-to-trace transactions through a series of wallet transfers.
Each transfer peels off a portion of the funds, sending the rest to a new address in a long chain of seemingly innocuous movements.
Global Ledger uncovered a recurring pattern in which Bitcoin (BTC) was cycled in steady batches of 30 BTC, an activity pointing to deliberate obfuscation.
Related: Industry Celebrates the New $70M Domain Mogul But His Crypto Shadows Linger
Their investigation also revealed that Nobitex relied on temporary deposit and withdrawal addresses, a tactic known as āchip-offā transactions. These single-use wallets funnel funds into new destinations, effectively masking liquidity flows and complicating efforts to trace movement on-chain.
In the aftermath of the hack, Nobitex transferred 1,801 BTC, valued at $187.5 million. The exchange described the move as a precautionary step aimed at securing remaining assets.
Despite Nobitex labeling it a newly created ārescue wallet,ā on-chain analysis shows the address had been active since October 2024āwell before the hack. Blockchain data reveals it had been steadily receiving 20ā30 BTC transfers consistent with laundering-style activity, long before the exchange claimed it was used as a post-attack safeguard.
āWhile Nobitex’s past wallet behavior raises concerns due to repeated use of peelchain-like structures, the current flows confirm that the platform retains substantial reserves post-hack,ā the report wrote.
Related: Crypto Titans Bunker Down Now: Vitalik’s Austerity Vow, Binance $1B Bitcoin Shield
The technique obscures the final destination of funds, mirroring tactics often used to conceal crypto transactions. Rather than prompting a shift in Nobitexās handling of assets, the hack appeared to expose ongoing behind-the-scenes practices.
On-chain behavior suggests the exchange had been using these methods well before the breach, and continued afterward, implying it may have been part of routine operations.
Read More
- 16 Billion Stolen Login Credentials Expose Crypto Wallets to Hacker Attacks
- Lazarus Group Blunder Reveals Crypto Hackersā Hidden Trail
- Coinbase Hack Triggers DOJ Probe Into $400M Data Breach
MICHAELA
Michaela is a news writer focused on cryptocurrency and blockchain topics. She prioritizes rigorous research and accuracy to uncover interesting angles and ensure engaging reporting. A lifelong book lover, she applies her passion for reading to deeply explore the constantly evolving crypto world.
