Last Updated:
The leaked files include blockchain scripts, internal privacy settings, and server lists, seriously weakening Nobitex’s cybersecurity
The leak came just a day after the group had threatened to publish the code if their demands were not met. (Image: Getty)
A pro-Israel hacker group has claimed responsibility for a major cyberattack on Nobitex, Iran’s largest cryptocurrency exchange, saying they have stolen over $90 million and exposed the company’s entire source code.
The group, Gonjeshke Darande — also known as “Predatory Sparrow” — released the data on Thursday, claiming Nobitex was helping to fund Iran’s military and bypass Western sanctions. The leak came just a day after the group had threatened to publish the code if their demands were not met.
Time’s up – full source code linked below.ASSETS LEFT IN NOBITEX ARE NOW ENTIRELY OUT IN THE OPEN.بازمانده دارایی های شما در نوبیتکس هم اکنون در معرض دید و خطر هستند
But before that, lets meet Nobitex from the inside:
Exchange Deployment (1/8) pic.twitter.com/jiMfBpNXwd
— Gonjeshke Darande (@GonjeshkeDarand) June 19, 2025
Blockchain analysis firms confirmed that the stolen funds were moved to wallets carrying messages critical of Iran’s Revolutionary Guard. Experts say the act was politically motivated, not financial. According to a blog post by analytics firm Elliptic, the hackers “effectively burned the funds” as a form of protest.
The leaked files include blockchain scripts, internal privacy settings, and server lists, seriously weakening Nobitex’s cybersecurity. The platform’s app and website went offline shortly after the leak.
In a post on X, Nobitex admitted it was investigating “unauthorised access” to its systems.
Follow-up on Nobitex Security Incident– june 19, 2025One day after the security incident, we would like to share the latest updates and technical decisions with our valued users.Our investigations indicate that the scope and impact of the attack are more complex than…
— Nobitex | نوبیتکس (@nobitexmarket) June 19, 2025
Gonjeshke Darande accused the exchange of supporting Iran’s nuclear programme and facilitating money transfers to sanctioned groups such as Hamas and Yemen’s Houthis. Elliptic also reported links between relatives of Iran’s Supreme Leader Ayatollah Ali Khamenei and the exchange, as well as evidence of use by sanctioned Revolutionary Guard operatives.
The hackers have a history of launching sophisticated attacks on Iran. In 2021, they disrupted fuel stations across the country, and in 2022, they targeted a steel mill, causing a major fire. Earlier this week, the group claimed to have destroyed data from Bank Sepah, a key Iranian state-owned bank.
The latest cyberattack comes amid rising tensions between Israel and Iran, now in the second week of direct conflict following Israeli strikes on Iranian military sites and nuclear facilities. Iran responded with missile attacks, intensifying fears of wider regional war.
While Israeli media have linked Gonjeshke Darande to the Israeli government, there has been no official confirmation. However, the scale and precision of the attack suggest possible state-level support.
(With inputs from agencies)
The News Desk is a team of passionate editors and writers who break and analyse the most important events unfolding in India and abroad. From live updates to exclusive reports to in-depth explainers, the Desk d…Read More
The News Desk is a team of passionate editors and writers who break and analyse the most important events unfolding in India and abroad. From live updates to exclusive reports to in-depth explainers, the Desk d… Read More
- First Published:
