The pro-Israel group Gonjeshke Darande follows through on its threats, publishing the full exchange code and security files, thereby placing the remaining Nobitex assets at risk.
Updated Jun 19, 2025, 1:04 p.m. Published Jun 19, 2025, 10:34 a.m.
What to know:
- The pro-Israel hacker group Gonjeshke Darande released the full source code of Iranian crypto exchange Nobitex after conducting a $100 million exploit.
- The leak exposes users’ assets to potential theft because the public code dismantles the platform’s back-end security.
- Nobitex said it plans to restore services within five days despite internet disruptions in Iran.
The pro-Israel hacker collective Gonjeshke Darande released the full source code of Iranian crypto exchange Nobitex, just a day after orchestrating a $100 million exploit across multiple blockchains as the war between the two countries nears the end of its first week.
The move raised fresh concerns for users who have not yet withdrawn their assets from the platform because the code makes it extremely easy for nefarious actors to access and exploit.
Israel attacked military and nuclear sites in Iran on Friday saying it had to take action to prevent its enemy, which has vowed to wipe the Jewish state off the map, attaining nuclear weapons. Iran responded with ballistic missile launches targeting the entire country, sending millions into shelters at short notice.
In an X post on Thursday, the hacker group, whose name is Farsi for Predatory Sparrow, wrote: “Time’s up – full source code linked below. ASSETS LEFT IN NOBITEX ARE NOW ENTIRELY OUT IN THE OPEN.”
Time’s up – full source code linked below.
ASSETS LEFT IN NOBITEX ARE NOW ENTIRELY OUT IN THE OPEN.
بازمانده دارایی های شما در نوبیتکس هم اکنون در معرض دید و خطر هستندBut before that, lets meet Nobitex from the inside:
Exchange Deployment (1/8) pic.twitter.com/jiMfBpNXwd
— Gonjeshke Darande (@GonjeshkeDarand) June 19, 2025
The leak included blockchain scripts, internal privacy settings and a list of servers, effectively dismantling the exchange’s back-end security.
The source code dump follows through on threats issued a day earlier, when Gonjeshke Darande claimed responsibility for the hack and promised to release internal data.
The group accused Nobitex of aiding Iran in circumventing international sanctions and called the platform the “regime’s favorite sanctions violation tool.”
Over $90 million in tokens from Bitcoin, EVM, Ripple, Dogecoin, Solana and other networks were deliberately sent to burner addresses, making recovery unlikely.
Blockchain data shows that funds were moved to provocatively named wallets, such as “1FuckiRGCTerroristsNoBiTEXXXaAovLX” and “DFuckiRGCTerroristsNoBiTEXXXWLW65t,” suggesting the use of brute-force-generated vanity addresses that the attackers do not hold private keys for. The IRCG, or Islamic Revolutionary Guard Corps, is an powerful and influential branch of the Iranian military.
Nobitex responded on Thursday, stating that no additional losses occurred after the leak and that it plans to begin restoring services within five days, although ongoing internet disruptions in Iran may delay the recovery.
Shaurya Malwa
Shaurya is the Co-Leader of the CoinDesk tokens and data team in Asia with a focus on crypto derivatives, DeFi, market microstructure, and protocol analysis.
Shaurya holds over $1,000 in BTC, ETH, SOL, AVAX, SUSHI, CRV, NEAR, YFI, YFII, SHIB, DOGE, USDT, USDC, BNB, MANA, MLN, LINK, XMR, ALGO, VET, CAKE, AAVE, COMP, ROOK, TRX, SNX, RUNE, FTM, ZIL, KSM, ENJ, CKB, JOE, GHST, PERP, BTRFLY, OHM, BANANA, ROME, BURGER, SPIRIT, and ORCA.
He provides over $1,000 to liquidity pools on Compound, Curve, SushiSwap, PancakeSwap, BurgerSwap, Orca, AnySwap, SpiritSwap, Rook Protocol, Yearn Finance, Synthetix, Harvest, Redacted Cartel, OlympusDAO, Rome, Trader Joe, and SUN.
The pro-Israel group Gonjeshke Darande follows through on its threats, publishing the full exchange code and security files, thereby placing the remaining Nobitex assets at risk.
Updated Jun 19, 2025, 1:04 p.m. Published Jun 19, 2025, 10:34 a.m.
What to know:
- The pro-Israel hacker group Gonjeshke Darande released the full source code of Iranian crypto exchange Nobitex after conducting a $100 million exploit.
- The leak exposes users’ assets to potential theft because the public code dismantles the platform’s back-end security.
- Nobitex said it plans to restore services within five days despite internet disruptions in Iran.
The pro-Israel hacker collective Gonjeshke Darande released the full source code of Iranian crypto exchange Nobitex, just a day after orchestrating a $100 million exploit across multiple blockchains as the war between the two countries nears the end of its first week.
The move raised fresh concerns for users who have not yet withdrawn their assets from the platform because the code makes it extremely easy for nefarious actors to access and exploit.
Israel attacked military and nuclear sites in Iran on Friday saying it had to take action to prevent its enemy, which has vowed to wipe the Jewish state off the map, attaining nuclear weapons. Iran responded with ballistic missile launches targeting the entire country, sending millions into shelters at short notice.
In an X post on Thursday, the hacker group, whose name is Farsi for Predatory Sparrow, wrote: “Time’s up – full source code linked below. ASSETS LEFT IN NOBITEX ARE NOW ENTIRELY OUT IN THE OPEN.”
Time’s up – full source code linked below.
ASSETS LEFT IN NOBITEX ARE NOW ENTIRELY OUT IN THE OPEN.
بازمانده دارایی های شما در نوبیتکس هم اکنون در معرض دید و خطر هستندBut before that, lets meet Nobitex from the inside:
Exchange Deployment (1/8) pic.twitter.com/jiMfBpNXwd
— Gonjeshke Darande (@GonjeshkeDarand) June 19, 2025
The leak included blockchain scripts, internal privacy settings and a list of servers, effectively dismantling the exchange’s back-end security.
The source code dump follows through on threats issued a day earlier, when Gonjeshke Darande claimed responsibility for the hack and promised to release internal data.
The group accused Nobitex of aiding Iran in circumventing international sanctions and called the platform the “regime’s favorite sanctions violation tool.”
Over $90 million in tokens from Bitcoin, EVM, Ripple, Dogecoin, Solana and other networks were deliberately sent to burner addresses, making recovery unlikely.
Blockchain data shows that funds were moved to provocatively named wallets, such as “1FuckiRGCTerroristsNoBiTEXXXaAovLX” and “DFuckiRGCTerroristsNoBiTEXXXWLW65t,” suggesting the use of brute-force-generated vanity addresses that the attackers do not hold private keys for. The IRCG, or Islamic Revolutionary Guard Corps, is an powerful and influential branch of the Iranian military.
Nobitex responded on Thursday, stating that no additional losses occurred after the leak and that it plans to begin restoring services within five days, although ongoing internet disruptions in Iran may delay the recovery.
Shaurya Malwa
Shaurya is the Co-Leader of the CoinDesk tokens and data team in Asia with a focus on crypto derivatives, DeFi, market microstructure, and protocol analysis.
Shaurya holds over $1,000 in BTC, ETH, SOL, AVAX, SUSHI, CRV, NEAR, YFI, YFII, SHIB, DOGE, USDT, USDC, BNB, MANA, MLN, LINK, XMR, ALGO, VET, CAKE, AAVE, COMP, ROOK, TRX, SNX, RUNE, FTM, ZIL, KSM, ENJ, CKB, JOE, GHST, PERP, BTRFLY, OHM, BANANA, ROME, BURGER, SPIRIT, and ORCA.
He provides over $1,000 to liquidity pools on Compound, Curve, SushiSwap, PancakeSwap, BurgerSwap, Orca, AnySwap, SpiritSwap, Rook Protocol, Yearn Finance, Synthetix, Harvest, Redacted Cartel, OlympusDAO, Rome, Trader Joe, and SUN.
