A major Iranian cryptocurrency exchange, Nobitex, suffered a devastating cyberattack on Wednesday, resulting in the destruction of nearly $90 million in digital assets, according to reports from blockchain analytics firms and cybersecurity researchers.
The cyberattack was claimed by a group known as Gonjeshke Darande (also known as “Predatory Sparrow”), which is widely believed to have ties to Israel, though no official confirmation has been made by Israeli authorities. The group has a history of politically motivated cyber operations targeting Iranian infrastructure.
Predatory Sparrow Claims Responsibility for Crypto Hack
This marks the second major attack by Predatory Sparrow in as many days. Just a day earlier, the group claimed to have wiped critical data from Iran’s state-owned Bank Sepah, intensifying fears of a broader cyberwarfare campaign amid rising tensions between Iran and Israel.
According to blockchain intelligence firm TRM Labs, the attackers moved nearly $90 million worth of various cryptocurrencies into hacker-controlled wallets. However, analysts believe that these wallets were deliberately designed to be inaccessible, effectively burning the funds as a symbolic political attack.
“The hackers effectively destroyed the funds in order to send Nobitex a political message,” stated Elliptic, a blockchain forensics company, in a blog post.
Ties to IRGC and Hostile Groups Cited
Elliptic’s analysis also revealed that Nobitex had previously interacted with wallets linked to groups hostile to Israel, including
- Palestinian Islamic Jihad
- Hamas
- Houthi rebels in Yemen
This revelation adds a geopolitical layer to the attack, suggesting that the hackers may have targeted Nobitex not for financial gain but to expose and disrupt Iran’s alleged crypto ties to proxy groups in the Middle East.
Crypto Funds Irrecoverable, Says Elliptic
Unlike traditional cyber heists where attackers move stolen funds into mixers or off-ramps for laundering, this attack was strategically designed to destroy the stolen crypto assets.
Elliptic noted that the structure of the attacker wallets indicates the funds are unrecoverable, meaning that no profit was made by the hackers, only a clear political statement.
Crypto Industry on High Alert
The incident has sent shockwaves through the global crypto industry, highlighting how cryptocurrencies can become tools in geopolitical conflicts. Security experts warn that politically motivated groups may increasingly turn to blockchain-based sabotage, especially in regions with volatile geopolitical dynamics. Nobitex has not yet issued a public statement regarding the breach or its response plans.
Background on Predatory Sparrow
Gonjeshke Darande rose to prominence in recent years for its cyberattacks on Iranian infrastructure, including incidents affecting rail systems, power grids, and government agencies. Though Israel has never formally confirmed its link to the group, Israeli media and analysts consistently refer to Predatory Sparrow as Israel-affiliated.
Their recent operations appear to be part of a broader cyber retaliation campaign as hostilities escalate across the Middle East.
The attack on Nobitex is a sobering reminder of the intersection between cybersecurity, geopolitics, and blockchain technology. With $90 million in crypto assets intentionally destroyed, the incident highlights how digital finance can be weaponised in conflicts and how critical it is for crypto platforms to invest in robust cyber defences and geopolitical risk assessments.
