Exchange's leaked code reveals intent to evade regulation, potentially aiding financial crime

In the aftermath of a politically motivated hack that drained $90 million from its wallets, an even more significant security breach hit the Iranian crypto exchange Nobitex — the public leak of its entire source code. An analysis of this code by blockchain intelligence firm TRM Labs revealed a platform built not just for trading, but as a sophisticated instrument for operating under the radar of global financial regulations.

The code revealed that Nobitex had been designed with a suite of custom anti-surveillance modules created specifically to undermine the blockchain analysis tools used by compliance teams and regulators. According to a leaked internal privacy memo, the explicit goal of these tools was to evade detection by US authorities like FinCEN by anonymizing transactions and obscuring user identities.

Here is all TRM Labs found:

• Segmented wallet infrastructure. The leaked source code revealed a multi-layered wallet architecture, separating hot and cold wallets across internally routed servers. While designed for scale, the segmentation has potential weaknesses that could be exploited by attackers.
• Integration with Iran's domestic banking system. Nobitex was deeply embedded within Iran's fiat payment ecosystem, with live API credentials for platforms like Shetab, Pay.ir, Vandar, and IDPay. This integration enables real-time fiat deposits, withdrawals, and account verification, potentially allowing users to bypass international banking sanctions.
• Privacy engineering. The exchange's developers prioritized privacy, implementing anti-surveillance modules like owshen, zpk, and incentivized mixer to undermine blockchain intelligence. These tools introduced stealth address generation, transaction batching, and real-time endpoint switching to evade detection.
• VIP user logic. Internal documentation showed that VIP users were routed through privileged logic that bypassed standard compliance checks, potentially insulating politically sensitive or sanctioned users from scrutiny.

The report concluded that the exchange’s modular design made it a forkable, “plug-and-play” blueprint for other rogue operators, raising the risk of its architecture being duplicated in other sanctioned jurisdictions.