Iranian Crypto Exchange Nobitex Source Code Leaked After $100M Hack, Exposing User Assets

Security at Iran’s largest crypto exchange, Nobitex, has been shattered after hackers released its full source code following a $100 million exploit. The unprecedented leak now puts user funds in immediate jeopardy, as the platform’s core defenses have been dismantled in the wake of escalating regional tensions.

Major Breach Orchestrated Amid Geopolitical Unrest

In an intensifying backdrop of conflict between Iran and Israel, the pro-Israel hacker collective Gonjeshke Darande—also known as Predatory Sparrow—has claimed responsibility for one of the most consequential hacks the Iranian crypto sector has witnessed. Just days after funneling over $100 million worth of assets through multiple blockchains, the group published Nobitex’s source code online, making critical backend infrastructure, privacy configurations, and server details fully accessible to the public.

Source Code Leak Exacerbates Risk for Users

By releasing the exchange’s code, the hackers have effectively torn down Nobitex’s operational security, leaving user assets highly exposed to cybercriminals. Sensitive information within the dump includes blockchain integration scripts and internal settings—resources that threat actors can leverage to launch further attacks. Gonjeshke Darande’s public statement warned that any cryptocurrency left in Nobitex wallets is entirely vulnerable, urging immediate withdrawals as the code appears online.

Key Stats & Figures

• Exploit Value: Over $100 million worth of digital assets drained in the breach.
• Funds Burned: More than $90 million in tokens (including BTC, ETH, XRP, DOGE, SOL, and others) sent to unrecoverable burner addresses.
• Source Code Released: Full backend infrastructure, privacy settings, and server lists leaked to the public.
• Planned Recovery: Nobitex aims to restore key services within five days, barring ongoing internet outages in Iran.

Hack Motivations and Response Amid Escalating Tensions

The timing of the attack coincides with surging hostilities in the region. Israel’s recent strikes on Iranian military and nuclear facilities, and Iran’s retaliatory missile launches, have amplified the volatility. Gonjeshke Darande accuses Nobitex of facilitating efforts to evade global sanctions, labeling the exchange “the regime’s favorite sanctions violation tool.” The group’s provocative actions—such as transferring stolen funds to wallets with pointed, anti-government names—escalate the message of defiance. Blockchain tracing indicates these wallets likely cannot be accessed, ensuring the stolen tokens remain permanently out of circulation.

Conclusion: What This Means for the Market

This high-profile breach sends shockwaves across the crypto security landscape, highlighting the severe risks posed by source code leaks and geopolitical cyber warfare. With Nobitex rushing to restore services and reassure users, the incident underlines the urgent need for robust security in crypto exchanges—especially in regions facing political and economic turmoil. Market watchers will closely monitor user reactions and the exchange’s recovery efforts as the fallout from this hack continues to unfold.