Nobitex source code leaked after hacker attack diverted US$100 million

• Hacker group leaked code from Nobitex broker on X
• Hack exposes security risk and Iran-Israel conflict
• Over $100 million worth of cryptocurrency stolen

Pro-Israeli hacker group Gonjeshke Darande has claimed responsibility for the recent attack on Iran’s largest cryptocurrency trading platform Nobitex and released what it claims is the exchange’s full source code. The screenshots posted on the social network X include code snippets relating to the user interface, privacy and trading tools.

$90M drained from Iranian exchange Nobitex in a hack claimed by hacktivist group, Gonjeshke Darande.

This wasn't just theft. It was a message.

Blockchain is now a geopolitical front line.
Visual of the hack distribution from Merkle Science's Tracker 👇 pic.twitter.com/7BT3t1nRYJ

— Merkle Science (@MerkleScience) June 19, 2025

“The assets left on Nobitex are now fully exposed,” the group stated in its post. The exposure of the code could represent additional vulnerabilities for the platform, whose losses already exceed US$ 100 million in crypto assets, as confirmed by the brokerage itself in a statement.

According to on-chain researcher ZachXBT, suspicious outflows were observed on the Tron and EVM networks shortly after the incident, which would indicate planned movements by the hackers. Nobitex reported that the assets were quickly moved and later destroyed by the attackers.

To justify the attack, the group claimed that the brokerage was a “fundamental tool of the [Iranian] regime” with the aim of “financing terrorism and circumventing sanctions.” The incident comes amid escalating tensions between Iran and Israel, which have seen military clashes and diplomatic accusations in recent months.

In an analysis released after the attack, Chainalysis pointed out that Nobitex is not just a local exchange, but rather a strategic conduit for Iran’s sanctioned cryptocurrency ecosystem. The exchange would allow users to bypass the traditional financial system to access international markets.

The company also revealed that previous investigations have linked Nobitex to illegal operations, including ransomware activities linked to the Iranian Revolutionary Guard Corps and Russian exchanges under international sanctions. In response to the breach, the Iranian government has ordered all local exchanges to operate only between 10 a.m. and 20 p.m.

Nicholas Smart, vice president of Crystal Intelligence, called the attack “reckless” and warned that it is not possible to know whether the stolen funds belonged to Iranian government agents. According to him, Nobitex is among the largest exchanges in the country, alongside Bitpin and AbanTether.