Israel-Linked “Predatory Sparrow” Hackers Drain Nearly $90M from Iran’s Nobitex Crypto Exchange

A sophisticated cyberattack by the hacker group Predatory Sparrow (Farsi: Gonjeshke Darande) has targeted Nobitex, Iran’s largest cryptocurrency exchange, leading to the loss of nearly $90 million in crypto assets. The attackers, believed to be affiliated with Israeli intelligence, sent the stolen funds—including Bitcoin, Ethereum, Dogecoin, and USDT—to irretrievable vanity addresses displaying anti-IRGC slogans, effectively destroying them.

In a statement on X (formerly Twitter), the group framed the attack as part of a broader mission to disrupt Iran’s use of crypto to bypass international sanctions. They warned of releasing Nobitex’s internal data and source code if the assets remained unreturned—although the act appears primarily symbolic, not financially motivated.

This cyberstrike came shortly after a similar assault on Iran’s state-run Bank Sepah, which disrupted banking operations nationwide.

Elliptic, a blockchain forensics firm, validated the scale and scope of the attack, also noting Nobitex’s ties to sanctioned groups such as the IRGC, Hamas, and the Houthis.

This incident reflects the evolving nature of cyberwarfare, where crypto infrastructure has become a strategic battleground in global conflicts. With exchanges and banks under digital siege, the geopolitical dimensions of crypto are growing ever more complex.