A powerful cyberattack has targeted Nobitex, one of Iran’s largest cryptocurrency exchanges, wiping out nearly $90 million worth of digital assets in what appears to be a politically motivated strike.
The hacking group Gonjeshke Darande, or “Predatory Sparrow,” claimed responsibility for the breach early Wednesday, marking its second major operation in two days. The group, which analysts believe may have ties to Israel, also claimed Tuesday’s attack on state-owned Bank Sepah.
In a post on social media, Predatory Sparrow accused Nobitex of facilitating sanctions evasion and supporting Iran’s foreign operations, including alleged financial links to groups such as Hamas, Palestinian Islamic Jihad, and Yemen’s Houthis. The group also threatened to release Nobitex’s source code.
Nobitex confirmed “unauthorized access” and said it had voluntarily taken down its website and app to investigate the breach. The platform remained offline as of Wednesday, and company representatives did not respond to inquiries via Telegram.
According to blockchain analysis firms TRM Labs and Elliptic, the hackers transferred roughly \$90 million in various cryptocurrencies to wallets they control. However, the wallets were structured in such a way that even the attackers cannot retrieve the funds—effectively destroying them.
“This was clearly a political message,” said Elliptic in a blog post, noting that burning the funds rather than stealing them signals a deliberate effort to damage Iran’s cyber-financial infrastructure. Chainalysis, another blockchain analytics firm, confirmed the estimated value of the destroyed assets and highlighted past use of Nobitex by Iranian groups tied to the Islamic Revolutionary Guard Corps.
Predatory Sparrow has a history of sophisticated cyberattacks targeting Iranian infrastructure, including a 2021 operation that crippled the country’s gas stations and a 2022 attack on an Iranian steel mill that caused physical damage. While Israel has not officially claimed involvement, Israeli media frequently describes the group as operating with state-level support.
U.S. lawmakers, including Senators Elizabeth Warren and Angus King, recently raised concerns about Nobitex’s role in enabling sanctions evasion in a letter to the Biden administration, citing previous investigative reporting.
The attack underscores rising tensions in the Middle East’s digital and geopolitical arenas, where cyber warfare is increasingly being used as a tool of statecraft.
