In a bold escalation of cyberwarfare tactics, Iranian crypto exchange Nobitex suffered a double blow this week after hackers stole tens of millions of dollars in crypto assets and then published the platform’s full source code and internal security configurations.

The attack was carried out by Gonjeshke Darande ("Predatory Sparrow"), a pro-Israel hacking group known for politically motivated cyber operations. The group claimed responsibility for draining Nobitex wallets of assets across multiple blockchain networks—including Bitcoin, Ethereum, Ripple, Solana, and Dogecoin—before following through on threats to leak the exchange’s backend code and infrastructure files. This move now places any remaining Nobitex assets and systems at even greater risk.

Rather than attempting to launder or profit from the stolen crypto, the hackers burned the funds, transferring them to wallet addresses embedded with anti-IRGC messages like “FuckIRGCterrorists.” This strongly suggests the motivation was to cripple a key part of Iran’s financial tech stack, which the group accuses of helping the Iranian regime bypass sanctions and fund militant activities.

Blockchain analytics firms Elliptic and Chainalysis confirmed the scope of the attack, estimating that $90 million or more was permanently destroyed. They also linked Nobitex to addresses associated with Iran’s elite military units and sanctioned entities like Hamas and the Houthis, reinforcing Western concerns about Iran’s use of cryptocurrency for illicit financing.

In response, Nobitex took its services offline and promised to relaunch within days. However, the leak of its complete source code—including wallet infrastructure, transaction handlers, and API keys—leaves the platform exposed to follow-up attacks by cybercriminals and state-level actors. The incident also triggered immediate regulatory repercussions, with Iran’s central bank imposing time restrictions on crypto exchange operations nationwide.

This breach highlights a growing reality in global cybersecurity: cryptocurrency platforms are now frontlines in geopolitical conflict. For exchanges operating in high-risk jurisdictions, the Nobitex incident is a warning that political entanglements can turn their platforms into targets—not just for profit-driven criminals, but for nation-state-backed digital warfare.