$90 Million Crypto Hack at Iran’s Nobitex: Israel-Linked Group Claims Responsibility

In a bold and highly targeted cyberattack, over $90 million in cryptocurrency was drained from Nobitex, Iran’s largest crypto exchange. But this wasn't a typical digital heist for profit — the attackers appear to have had something far more political in mind.

A shadowy hacker collective known as Predatory Sparrow, widely believed to have ties to Israel, has claimed responsibility for the breach. According to cybersecurity analysts and blockchain tracking firms, the group not only stole the funds but also intentionally destroyed them — transferring the assets to unusable wallets as a form of protest.

This crypto hack isn’t just about missing money. It’s part of a growing cyberwar, and it reveals how digital finance is becoming the new front line in international conflict.

What Do We Know About the Nobitex Hack?

The breach took place on June 19, 2025, and immediately sent shockwaves through Iran’s crypto community. Nobitex, which holds a dominant market share in Iran’s crypto space, suspended access to its platform and released a brief statement acknowledging the attack.

Blockchain intelligence platforms like Elliptic and TRM Labs confirmed that over $90 million in crypto assets were moved from Nobitex wallets to anonymous addresses. But instead of routing the funds through laundering channels or exchanges — a typical step in most crypto crimes — the funds were sent to “burn wallets.” These are digital wallets with no private keys, meaning the assets are effectively gone forever.

On its Telegram channel and social media platforms, Predatory Sparrow posted messages declaring the hack was not financially motivated. One message read:

“Assets left in Nobitex are now entirely out in the open. The regime will pay for its crimes.”

Who Is Predatory Sparrow?

Predatory Sparrow — or Gonjeshke Darande in Farsi — has built a reputation for launching high-impact cyberattacks on Iranian institutions. The group has claimed previous operations including:

• A 2021 attack that crippled Iran’s gas stations.
  
  

• A 2022 cyberstrike on a steel factory that triggered a fire.
  
  

• Ongoing assaults on state banks and broadcast networks.
  
  

While the group presents itself as an anti-regime Iranian faction, many experts believe it is a proxy unit for Israeli cyber-intelligence, possibly working alongside Mossad or Israel’s military cyber unit.

Their pattern is clear: target systems tied to Iran’s government, especially those associated with the Islamic Revolutionary Guard Corps (IRGC) or the country’s sanctions-evading networks.

Why Was Nobitex Targeted?

According to Elliptic and multiple intelligence analysts, Nobitex has long been suspected of playing a critical role in helping the Iranian regime bypass international sanctions.

Allegations include:

• Facilitating crypto transactions for IRGC-linked operatives.
  
  

• Acting as a financial channel for Iran-backed militant groups, including Hamas and Yemen’s Houthis.
  
  

• Enabling the movement of capital for entities affiliated with Ayatollah Khamenei’s inner circle.
  
  

In short, Nobitex wasn’t just a private crypto business — it had become a critical part of Iran’s shadow finance system.

By crippling Nobitex and publicly exposing its operations, Predatory Sparrow wasn’t just hacking a platform. They were sending a message to Iran’s leadership — and possibly the international community — about how cryptocurrency is being weaponized by state actors.

The Political Fallout

The timing of the Nobitex hack is no coincidence.

It came just 24 hours after a separate cyberattack on Bank Sepah, one of Iran’s oldest and most state-aligned financial institutions. That attack was also claimed by Predatory Sparrow, who alleged the bank was deeply entwined with IRGC operations.

Within the same 48-hour window:

• Iran’s state television was hijacked with anti-regime propaganda.
  
  

• Citizens in Tehran reported outages at ATM machines.
  
  

• Fears about wider disruption to banking and public services surged.
  
  

These back-to-back cyber offensives suggest a coordinated campaign aimed at paralyzing Iran’s digital and financial infrastructure — likely as retaliation amid ongoing military tensions between Israel and Iran.

Was This a Cyberwar Move?

While Israel has not officially acknowledged any link to Predatory Sparrow, the group’s focus, precision, and timing strongly suggest state-level support. Much like the Stuxnet worm that sabotaged Iran’s nuclear facilities in 2010, the Nobitex hack fits the profile of covert cyberwarfare.

This time, however, the battlefield is not uranium enrichment plants — it’s crypto wallets and digital finance.

Impact on Iranian Citizens

One of the most troubling aspects of this hack is its collateral damage.

Crypto has become a lifeline for many Iranians navigating a collapsing currency, inflation, and isolation from global finance. Nobitex was their gateway to stablecoins, decentralized assets, and cross-border payments.

Now, thousands of users have been locked out of their funds. Many fear their savings are gone — even if they weren’t in the hacked wallets. This breach may undermine public trust not just in Nobitex but in Iran’s entire crypto ecosystem.

As cybersecurity expert Hamid Kashfi told CNN:

“Many Iranians are banking on crypto. This kind of attack, even if politically targeted, affects everyday people trying to survive a sanctions-hit economy.”

Global Repercussions

This crypto hack is more than a national issue — it’s a warning shot for the global blockchain ecosystem.

Key takeaways for the world:

• Exchanges operating in high-risk regions need stronger oversight.
  
  

• Decentralized assets can still be politically targeted.
  
  

• Crypto regulators must re-evaluate how digital assets are being used in sanctioned environments.
  
  

• Cybersecurity for crypto firms is no longer optional — it's existential.
  
  

Final Thoughts: When Crypto Becomes a Weapon

The Nobitex hack is a stark reminder that in 2025, digital currency is more than money — it’s power, leverage, and vulnerability all at once.

When politically motivated hacker groups can erase millions with a few clicks — and do so to make a statement, not make a profit — we’ve entered a new era of digital warfare.

Whether you're an investor, a technologist, or just someone trying to understand this complex world — one thing is clear:

In the modern age, crypto is no longer just a tool for freedom — it's now a tool in the theater of geopolitical conflict.