TEHRAN, Iran — Hackers linked to the pro-Israel group “Predatory Sparrow” have stolen an estimated $90 million from Nobitex, Iran’s largest cryptocurrency exchange, in a sweeping cyberattack that underscores the intensifying digital warfare between Iran and Israel.
The incident, which unfolded on Wednesday, June 18, 2025, was confirmed by multiple blockchain analysis firms including Elliptic and TRM Labs.
The firms reported that the stolen funds were routed to cryptocurrency wallets bearing profane labels referencing Iran’s Islamic Revolutionary Guard Corps (IRGC).
In a statement posted in Farsi on the social media platform X, Predatory Sparrow claimed responsibility for the breach, accusing Iran of using Nobitex to evade international sanctions.
Cybersecurity analysts noted that the hackers appear to have intentionally moved the stolen digital assets into wallets that no one, including themselves, can access — effectively rendering the funds useless.
Nobitex confirmed the breach in a statement on its website, saying operations had been “suspended” as a precaution while internal investigations continue.
The exchange gave no timeline for when services might resume.
Predatory Sparrow also claimed responsibility for a separate cyberattack on Tuesday, June 17, 2025, targeting Iran’s state-owned Bank Sepah, where they allegedly wiped sensitive data.
The group said its justification stemmed from the bank’s alleged ties to IRGC operatives.
Following the attack, Iran’s Fars news agency warned of disruptions at bank-linked services, including petrol stations across the country.
A source in Tehran told CNN that over the course of two days, they attempted to withdraw cash from ten ATM machines but found all of them either out of service or empty.
On Wednesday, June 18, 2025, hackers also infiltrated Iran’s state-run television broadcast network, airing anti-government content and urging public uprising.
There was no immediate claim of responsibility for the broadcast breach.
These coordinated cyberstrikes represent a major escalation in the covert technological hostilities that have long defined the Israel-Iran rivalry.
Over the past five years, Predatory Sparrow has claimed responsibility for attacks that crippled an Iranian steel plant and paralysed petrol distribution nationwide.
While the group presents itself as an Iranian anti-regime faction, cybersecurity analysts broadly suspect Israeli involvement.
Speaking to CNN, cybersecurity expert Hamid Kashfi warned that the Nobitex attack could have repercussions for ordinary Iranians.
“Many Iranians are banking on crypto,” he said, noting the growing financial desperation amid sanctions and conflict.
“This could seriously impact those with no ties to the regime.”
As tensions rise, so too does the volume of disinformation and cyber-psychological operations.
Israeli citizens have reportedly received mass text messages mimicking government alerts, falsely warning that bomb shelters are unsafe.
The Iranian government has, in turn, warned against using WhatsApp, alleging the platform is being used for Israeli surveillance — a claim Meta has denied, reaffirming that its messaging services are end-to-end encrypted.
