Iranian Crypto Exchange Nobitex Hacked for $47M and Source Code Leaked by Pro-Israel Group

According to the source, the Iranian cryptocurrency exchange Nobitex has suffered a major security breach, resulting in the theft of nearly $47 million in assets. An Israeli-linked hacking group known as Gonjeshke Darande, or Predatory Sparrow, has claimed responsibility for the attack. The group stated the attack was politically motivated, accusing Nobitex of being a 'core part of the regime’s terror financing network' used to evade international sanctions. The stolen funds, which included tokens from Bitcoin (BTC), EVM-compatible chains, Ripple (XRP), Dogecoin (DOGE), and Solana (SOL), were reportedly sent to burner addresses, making recovery highly improbable. Compounding the issue for traders, the hackers followed through on their threat and released the full source code for the exchange, including internal privacy settings and server lists. This leak exposes any remaining user assets to extreme risk from other malicious actors. Nobitex confirmed the attack and stated it plans to restore services, but faces a severe credibility crisis and potential further losses for its users.
SourceAnalysis
The cryptocurrency market is once again grappling with the intersection of digital asset security and intense geopolitical conflict. Nobitex, Iran's largest cryptocurrency exchange, has been targeted in a sophisticated cyberattack, with the pro-Israeli hacking group Gonjeshke Darande (Predatory Sparrow) claiming responsibility. The incident, which unfolded amidst heightened military tensions between Iran and Israel, has resulted in substantial financial losses and a severe blow to the exchange's operational integrity. Initial reports from on-chain analyst ZachXBT on Wednesday flagged suspicious outflows of approximately $48.65 million, primarily in Tron's TRX tokens. However, the hackers themselves later claimed a much larger exploit, suggesting over $90 million in various assets were compromised and deliberately sent to burner addresses, rendering them unrecoverable.
Geopolitical Cyber Warfare Spills into Crypto
The attack on Nobitex was not merely a financially motivated exploit; it was a politically charged act of cyber warfare. In a post on the social media platform X, Gonjeshke Darande explicitly linked the attack to their prior cyber operations against Iranian state-owned entities, stating, “After Bank Sepah, it was Nobitex's turn.” The group accused Nobitex of being a “core part of the regime’s terror financing network” and a tool for evading international sanctions. This narrative was reinforced by the on-chain evidence, where stolen funds were directed to wallets with provocative vanity addresses like "TKFuckiRGCTerroristsNoBiTEXy2r7mNX" and "1FuckiRGCTerroristsNoBiTEXXXaAovLX," directly referencing the Islamic Revolutionary Guard Corps (IRGC). This method of sending funds to addresses for which no private key exists is a definitive act of destruction, not theft for profit, underscoring the political motivations behind the breach.
Source Code Leak Escalates the Threat
A day after the initial breach, the situation escalated dramatically when the hackers followed through on their threat and released Nobitex's complete source code. This dump included critical backend components, blockchain scripts, internal privacy settings, and a list of servers. The public release of this proprietary code represents an existential threat to the exchange, making it incredibly vulnerable to further exploits by any malicious actor. The hackers' message was stark: “ASSETS LEFT IN NOBITEX ARE NOW ENTIRELY OUT IN THE OPEN.” For traders, this is a critical development. It moves beyond a one-time loss of funds to a complete compromise of the platform's security infrastructure. Nobitex has since confirmed the attack and stated it aims to restore services, but the source code leak creates a profound crisis of confidence that will be difficult to overcome.
Trading Implications in a Volatile Market
While this targeted attack has not caused a systemic crash, it introduces a significant layer of geopolitical risk that traders must factor into their strategies. Looking at current market data, the broader market appears relatively stable. For instance, the BTC/USDT pair shows a slight gain of 0.52% to around $107,909, while ETH/USDT is up 1.14% to $2,454.20. Interestingly, Solana (SOL) has shown notable strength, with SOL/USDT rising 3.22% to $151.73 and the SOL/BTC pair gaining 2.32%. This could suggest that while major assets are holding steady, capital may be rotating into large-cap altcoins perceived to have strong near-term narratives. However, the Nobitex hack is a stark reminder of the vulnerability of centralized exchanges, especially those operating in politically volatile regions. The assets targeted spanned a wide range, including Bitcoin, EVM-compatible tokens, Ripple (XRP), Dogecoin, and Solana. For traders, this event powerfully reinforces the argument for self-custody. Relying on centralized platforms carries inherent counterparty risk, which is magnified exponentially when those platforms become targets in international conflicts. Traders should monitor geopolitical developments closely, as sudden escalations could trigger unpredictable market volatility, overriding standard technical and fundamental analysis.
Fox News
@FoxNewsFollow America's #1 cable news network, delivering you breaking news, insightful analysis, and must-see videos.