Pro-Israel Hackers Escalate Attack on Nobitex, Reveal Exchange Full Source Code

Key Insights:

• Gonjeshke Darande claims all remaining Nobitex assets are now publicly exposed and vulnerable.
• The hacker group released Nobitex’s full source code and began leaking internal deployment data.
• Iran has imposed a curfew on Exchanges following the Nobitex Hack.

A day after breaching Iran’s largest cryptocurrency exchange, hacker group Gonjeshke Darande escalated its campaign by releasing what it claimed to be Nobitex’s full source code. The group warned that any user assets left on the platform were now fully exposed.

Nobitex Assets Declared Public and Vulnerable

In a multilingual post shared across social media, Gonjeshke Darande stated that remaining Nobitex assets were “out in the open.” The message, written in both Persian and English, appeared to target local users and urged them to withdraw their funds immediately.

In addition, the hackers claimed to be a pro-Israel group and positioned their actions as a calculated play against the Iranian financial systems. Blockchain analysis based on data shows that the stolen cryptocurrencies, including Bitcoin, Ethereum, Ripple, Dogecoin, Tron, Ton, and Solana, were not laundered and transferred to mixers.

Instead, they were moved to irreversible burn addresses, including Ethereum’s known “0x…dead” wallet and an invalid Bitcoin address. This pointed to a calculated decision to destroy the funds rather than profit from them.

The Hacker Group Released Nobitex’s Full Source Code

After initially hacking Nobitex, Gonjeshke Darande published screenshots of the exchange’s internal architecture and said that they began to publish infrastructure information in a series of droppers. The posts began with what the group labeled “Exchange Deployment,”.

More so, other additional exposés followed. The group shared files labeled Nobitex Privacy, Metal Servers, Servers List, and finally, one labeled Nobitex Full Source Code.

According to the group, the purposes of the attacks were to reveal weaknesses and internal mechanisms of Nobitex to the general user. Cybersecurity observers are worried that this action may lead to secondary attacks or leak-code abuse.

Nobitex Users Face Renewed Risks

Nobitex, which reportedly handles the majority of Iran’s on-chain activity, confirmed that all hot wallets were emptied shortly after the attack and user funds had been migrated to cold storage. The company also stated that its reserve fund would cover the $90 million in losses, citing a commitment to secure platform continuity.

However, with staged insider revelations now underway, users may continue to face exposure if new vulnerabilities are disclosed. Gonjeshke Darande warned users to remove their funds, and the group’s ongoing content releases could increase pressure on the exchange’s technical systems and user confidence.

The attackers had previously threatened to publish Nobitex’s internal data if demands were not met.

Iran’s top crypto exchange added,

“Nobitex’s technical and security teams continue to investigate the root cause of the incident and are actively working on implementing a secure and efficient recovery plan.”

Iran Has Imposed a Curfew on Exchanges

In the wake of the breach, the Central Bank of Iran ordered restricted hours for all domestic crypto exchanges. Local platforms are now limited to operating between 10 a.m. and 8 p.m., as part of broader measures to control systemic risk.

According to reports, this restriction may be part of a larger strategy by authorities to tighten oversight in a crypto market that has become increasingly vital due to global financial sanctions. Nobitex, with over $11 billion in total inflows, serves as the backbone of Iran’s digital asset ecosystem.

Furthermore, the same report linked the platform to a variety of sanctioned actors, including wallets associated with ransomware operators tied to the Islamic Revolutionary Guard Corps.

The crypto exchange was also linked to media outlets such as Gaza Now, and Russian exchanges Garantex and Bitpapa. The breach occurred days after reported Israeli airstrikes in Iran, deepening concerns over cyber and military tensions between the two nations.

Apart from the Nobitex hack, in a recent report, Meta Pool confirmed a failed $27M exploit that resulted in only $132K in stolen funds. According to blockchain analysts, low liquidity and rapid response efforts prevented deeper losses across affected pools.

Disclaimer

This article is for informational purposes only and provides no financial, investment, or other advice. The author or any people mentioned in this article are not responsible for any financial loss that may occur from investing in or trading. Please do your research before making any financial decisions.