Pro-Israel Hackers Steal $90 Million From Iran Crypto Exchange, Leak Source Code

Last Updated:June 19, 2025, 17:24 IST

The leaked files include blockchain scripts, internal privacy settings, and server lists, seriously weakening Nobitex’s cybersecurity

The leak came just a day after the group had threatened to publish the code if their demands were not met. (Image: Getty)

A pro-Israel hacker group has claimed responsibility for a major cyberattack on Nobitex, Iran’s largest cryptocurrency exchange, saying they have stolen over $90 million and exposed the company’s entire source code.

The group, Gonjeshke Darande — also known as “Predatory Sparrow" — released the data on Thursday, claiming Nobitex was helping to fund Iran’s military and bypass Western sanctions. The leak came just a day after the group had threatened to publish the code if their demands were not met.

Blockchain analysis firms confirmed that the stolen funds were moved to wallets carrying messages critical of Iran’s Revolutionary Guard. Experts say the act was politically motivated, not financial. According to a blog post by analytics firm Elliptic, the hackers “effectively burned the funds" as a form of protest.

The leaked files include blockchain scripts, internal privacy settings, and server lists, seriously weakening Nobitex’s cybersecurity. The platform’s app and website went offline shortly after the leak.

In a post on X, Nobitex admitted it was investigating “unauthorised access" to its systems.

Gonjeshke Darande accused the exchange of supporting Iran’s nuclear programme and facilitating money transfers to sanctioned groups such as Hamas and Yemen’s Houthis. Elliptic also reported links between relatives of Iran’s Supreme Leader Ayatollah Ali Khamenei and the exchange, as well as evidence of use by sanctioned Revolutionary Guard operatives.

The hackers have a history of launching sophisticated attacks on Iran. In 2021, they disrupted fuel stations across the country, and in 2022, they targeted a steel mill, causing a major fire. Earlier this week, the group claimed to have destroyed data from Bank Sepah, a key Iranian state-owned bank.

The latest cyberattack comes amid rising tensions between Israel and Iran, now in the second week of direct conflict following Israeli strikes on Iranian military sites and nuclear facilities. Iran responded with missile attacks, intensifying fears of wider regional war.

While Israeli media have linked Gonjeshke Darande to the Israeli government, there has been no official confirmation. However, the scale and precision of the attack suggest possible state-level support.

(With inputs from agencies)

Israel

News world Pro-Israel Hackers Steal $90 Million From Iran Crypto Exchange, Leak Source Code