Hackers Leak Nobitex Source Code After $100M Crypto Heist Amid Iran-Israel Conflict
The pro-Israel hacker collective Gonjeshke Darande has published the full source code and security infrastructure of Iranian cryptocurrency exchange Nobitex, just one day after executing a $100 million exploit across several major blockchain networks.
The disclosure, which includes blockchain scripts, internal privacy settings, and server lists, has left the remaining user funds on the platform highly exposed to further attacks. The incident underscores the increasing intersection of geopolitical tensions and cyber warfare as the conflict between Israel and Iran escalates.
On Thursday, the group—whose name translates to “Predatory Sparrow”—announced the leak on X:
“Time’s up – full source code linked below. ASSETS LEFT IN NOBITEX ARE NOW ENTIRELY OUT IN THE OPEN.”
This follows the hackers’ earlier claim of responsibility for the heist and their threat to release internal materials if Nobitex continued operations.
According to blockchain records, more than $90 million in digital assets, including tokens from Bitcoin, Ethereum-compatible chains, Ripple, Dogecoin, and Solana, were drained into burner addresses. The attackers labeled these wallets with politically charged names such as “1FuckiRGCTerroristsNoBiTEXXXaAovLX,” referencing the Islamic Revolutionary Guard Corps (IRGC). These addresses were likely brute-force vanity addresses without corresponding private keys, making recovery virtually impossible.
The hack occurred against the backdrop of military escalation. Israel launched airstrikes on Iranian military and nuclear sites last Friday, saying the attacks were necessary to counter Iran’s nuclear ambitions. In response, Iran fired ballistic missiles targeting Israeli cities, forcing millions of civilians into shelters.
Despite the breach, Nobitex assured users Thursday that no additional losses had occurred since the code dump. The exchange stated it intends to resume services within five days, although widespread internet disruptions in Iran could delay recovery efforts.
Gonjeshke Darande has accused Nobitex of helping the Iranian government circumvent sanctions, calling the platform the “regime’s favorite sanctions violation tool.”
The incident has amplified security fears across the region’s crypto markets, as users rush to withdraw funds before further attacks can exploit the newly published codebase.
