A pro-Israel hacker group known as Predatory Sparrow (Farsi: Gonjeshke Darande) has reportedly stolen over $90 million in cryptocurrency—primarily Bitcoin, Ethereum, and Dogecoin—from Iran’s largest exchange, Nobitex. However, analysts now say the attackers have likely burned the funds, rendering them inaccessible, as a politically charged message in the ongoing Israel–Iran cyber conflict.
🕵️♂️ Key Details of the Heist
1. Massive $90M Crypto Transfer
The hackers drained multiple types of cryptocurrencies from Nobitex wallets on June 18. This includes BTC, ETH, DOGE, and USDT—even hitting a Tether wallet on the Tron network.
2. “Burned” in Political Statement
The stolen funds were moved to safe—but inaccessible—vanity addresses labeled with anti-IRGC messages (e.g., “F‑IRGCterrorists”), effectively destroying them as a symbolic gesture.
3. Attack Linked to Israel, Not Confirmed
Though Predatory Sparrow is widely reported to be Israel-aligned, there’s no official confirmation. Cybersecurity experts note the operation fits the profile of state-aligned attackers. coindesk
4. Part of Larger Cyber Campaign
This breach follows another attack on Iran’s state-owned Bank Sepah, and is seen as a coordinated cyber escalation in the continuing military‑cyber confrontation.
5. Nobitex Exchange Offline
Nobitex has confirmed the security breach. The exchange’s website and app went offline, and it has begun recovery efforts.
6. Links to Sanctioned Entities
Blockchain forensics show Nobitex had ties to IRGC-linked individuals and even transacted with groups like Hamas and the Houthis. The hack targeted those diplomatic and financial chains.
⚠️ Why It Matters
- Cyber warfare expands scope: Targeting Iran’s crypto infrastructure demonstrates how modern conflicts extend far beyond traditional battlefields, affecting digital economies.
- Crypto as a tool and target: Iran has increasingly used cryptocurrencies to evade sanctions and fund operations; this attack disrupts those activities.
- Diplomatic escalation: The hack underscores how cyberattacks have become central in the strategic posturing between Israel and Iran.
🔭 What’s Next?
- Will the source code be released? Predatory Sparrow threatened to publish Nobitex’s internal code—raising concerns about further system vulnerabilities.
- Recovery and investor fallout: Nobitex’s priority is regaining control, reassuring users, and surviving reputational damage.
- Cyber retaliation: Iran’s cyber units may respond in kind, escalating the digital tit-for-tat between adversaries.
✅ Final Take
This heist marks a significant development in digital geopolitics: a $90 million crypto theft used not for profit, but as a weapon of spectacle. The blending of cyber tools, cryptocurrency, and international conflict highlights vulnerabilities in digital financial systems—and underscores the strategic power of crypto-based warfare in modern statecraft.
