“Iranian Exchange Nobitex Hit by Source Code Leak Following Multi-Network Token Theft Spanning Bitcoin, EVM, and Ripple.”

Hackers Leak Full Nobitex Code as Israel-Iran Cyber Conflict Deepens

The pro-Israel hacking group Gonjeshke Darande has unleashed a fresh blow to Iranian crypto exchange Nobitex, publishing the platform’s entire source code and critical security files just one day after a $100 million cyberattack spanning several blockchain networks.

The move has amplified concerns for Nobitex users who still have funds on the platform. The leaked materials include blockchain scripts, server details, and internal privacy configurations, exposing the exchange’s infrastructure and leaving any remaining assets at significant risk.

“Time’s up – full source code linked below. ASSETS LEFT IN NOBITEX ARE NOW ENTIRELY OUT IN THE OPEN,” the group declared Thursday on X, formerly Twitter. Gonjeshke Darande, whose name translates from Farsi as “Predatory Sparrow,” had threatened to release the data earlier this week after claiming responsibility for the initial hack.

The hackers accuse Nobitex of helping the Iranian government bypass international sanctions, branding the platform as the “regime’s favorite sanctions violation tool.”

The original attack saw more than $90 million in tokens siphoned from networks including Bitcoin, EVM-compatible blockchains, Ripple, Dogecoin, and Solana. The stolen funds were transferred to burner wallets—addresses likely created via brute-force methods to produce provocative names such as “1FuckiRGCTerroristsNoBiTEXXXaAovLX” and “DFuckiRGCTerroristsNoBiTEXXXWLW65t.” Blockchain analysts believe the attackers don’t hold the private keys to these addresses, rendering recovery of the funds impossible.

This cyber offensive coincides with intensifying geopolitical tensions. Israel launched strikes on Iranian military and nuclear sites last Friday, citing threats to national security, while Iran responded with ballistic missile attacks that sent millions scrambling for shelter.

Nobitex sought to reassure users on Thursday, stating that no further losses have occurred since the code leak. The exchange announced plans to resume services within five days, although ongoing internet disruptions across Iran could slow the process.