Iran’s Nobitex Crypto Exchange Faces New Crisis as Hackers Leak Entire Source Code

The pro-Israel hacker group Gonjeshke Darande has escalated its cyber assault against Iranian crypto exchange Nobitex, publicly releasing the platform’s full source code and sensitive security files. The leak comes just a day after the group carried out a $100 million exploit spanning multiple blockchains, amid the intensifying conflict between Israel and Iran, now nearing the end of its first week.

The code exposure has heightened fears among Nobitex users who still hold funds on the platform, as the detailed release of blockchain scripts, server lists, and internal privacy configurations leaves remaining assets vulnerable to further attacks.

In a post on X (formerly Twitter) on Thursday, Gonjeshke Darande—whose name translates from Farsi as “Predatory Sparrow”—declared:

“Time’s up – full source code linked below. ASSETS LEFT IN NOBITEX ARE NOW ENTIRELY OUT IN THE OPEN.”

This follows the group’s earlier threats, issued after they claimed responsibility for the initial hack. The hackers accused Nobitex of assisting Iran in evading international sanctions, branding the exchange the “regime’s favorite sanctions violation tool.”

The original attack saw over $90 million in tokens siphoned from networks including Bitcoin, EVM-compatible chains, Ripple, Dogecoin, and Solana. Much of the stolen crypto was sent to burner addresses—irretrievable wallets—often given provocative names like “1FuckiRGCTerroristsNoBiTEXXXaAovLX” and “DFuckiRGCTerroristsNoBiTEXXXWLW65t.” Such vanity addresses suggest the hackers generated them using brute force and likely do not possess the private keys, meaning the funds cannot be recovered. The references to the IRGC (Islamic Revolutionary Guard Corps) highlight the political undercurrent behind the attacks.

Meanwhile, geopolitical tensions continue to escalate. Israel launched strikes on Iranian military and nuclear facilities last Friday, citing threats posed by Iran’s nuclear ambitions. Iran retaliated with ballistic missile attacks, prompting widespread sheltering of civilians.

Nobitex issued a statement on Thursday asserting that no further funds have been lost following the leak. The exchange plans to begin restoring services within five days, though recovery efforts may be hindered by ongoing internet disruptions across Iran.