Pro-Israel Hackers Destroy $90 Million in Iran Crypto Exchange Breach
In a significant cyberattack on June 18, 2025, the pro-Israel hacker group Predatory Sparrow, also known as Gonjeshke Darande, infiltrated Iran’s largest cryptocurrency exchange, Nobitex, and destroyed over $90 million worth of digital assets. The stolen funds were transferred to inaccessible “vanity addresses”—cryptographic wallets designed to be uncrackable due to their complex keys. These addresses contained anti-Islamic Revolutionary Guard Corps (IRGC) messages, indicating that the attack was politically motivated rather than financially driven. Blockchain analysis firms Elliptic and TRM Labs confirmed the destruction of the funds, labeling them effectively “burned” .
Predatory Sparrow claimed responsibility for the breach, accusing Nobitex of facilitating Iran’s efforts to bypass Western sanctions and fund militant activities. The group also alleged that Nobitex’s infrastructure was used to support the IRGC and other sanctioned entities. In addition to the Nobitex attack, Predatory Sparrow claimed to have destroyed data at Iran’s state-owned Bank Sepah, further escalating tensions between Israel and Iran .
Following the cyberattack, Nobitex temporarily shut down its app and website to investigate unauthorized system access. The Iranian government also imposed a nationwide internet blackout, causing a dramatic 98% drop in network traffic, which it attributed to efforts to maintain network stability amid rising cyber threats .
This incident underscores the growing role of cyber warfare in geopolitical conflicts and highlights the vulnerabilities of digital financial systems to state-sponsored cyberattacks.
