Pro-Israeli hacking group Gonjeshke Darande has published the platform’s source code
Pro-Israeli hacking group Gonjeshke Darande, which claimed responsibility for hacking the Iranian exchange Nobitex, has published the platform’s source code.
They released screenshots allegedly showing code fragments related to the exchange’s deployment, its interface, and security system elements.
On-chain investigator ZachXBT was the first to report suspicious transactions from Nobitex wallets. The exchange’s team later confirmed the breach.
According to Chainalysis, the damage exceeded $90 million in Bitcoin, Ethereum, Dogecoin, Solana, and other assets. However, platform representatives estimate the losses at around $100 million.
Nobitex Announcement No. 4 – Regarding the Security Incident
As part of Nobitex’s ongoing response to the recent security incident, we would like to inform our users that the situation is now under control. All external access to our servers has been completely severed.
If you…
— Nobitex | نوبیتکس (@nobitexmarket)
The Gonjeshke Darande hackers called Nobitex a “key instrument of the regime” for financing terrorism and circumventing sanctions.
Chainalysis analysts confirmed the political motivation behind the attack. The attackers transferred the funds to single-use wallets without access to private keys. In effect, the assets were destroyed rather than stolen for profit, experts explained.
Chainalysis noted Nobitex’s role in Iran’s sanctioned crypto economy. According to them, the exchange serves as a “critically important hub” that provides local users with access to global markets.
Experts added that previous on-chain investigations had linked Nobitex to illicit organizations. Among them: ransomware operators affiliated with the Islamic Revolutionary Guard Corps, and Russian crypto exchanges under sanctions.
In the wake of the incident, the Central Bank of Iran restricted the operating hours of all local trading platforms. They can now conduct operations from 10:00 AM to 8:00 PM. This step may indicate an attempt by authorities to strengthen control over the sector to manage systemic risks, according to Chainalysis.
In its latest statement, the Nobitex team reported that “the scope and consequences of the attack turned out to be more complex than initially anticipated.”
Follow-up on Nobitex Security Incident – the19th of June, 2025
One day after the security incident, we would like to share the latest updates and technical decisions with our valued users.
Our investigations indicate that the scope and impact of the attack are more complex than…
— Nobitex | نوبیتکس (@nobitexmarket)
However, the amount of financial losses reported in the previous statement has not changed.
“To ensure a completely secure and stable recovery, we estimate that more time will be required to resume access to Nobitex services. At this stage, we predict a phased and secure restoration of services within the next four to five days,” exchange representatives stated.
