Pro-Israel hackers take credit after $90 million stolen from Iran's largest crypto exchange
Hackers stole the equivalent of roughly $90 million from Iran's largest cryptocurrency exchange on Wednesday, according to multiple independent crypto-tracking firms.
A skilled pro-Israel hacking group known as 'Predatory Sparrow' took credit for the cyberattack, which appeared to be aimed at further weakening Iran amid Israeli's military strikes on Tehran.
In a post in Farsi on X, the hackers said that they had hit Iranian crypto exchange Nobitex, claiming that Iran used the exchange to skirt international sanctions. And in an extraordinary move, the hackers may have effectively thrown the stolen crypto away by transferring it to digital 'wallets' that they don't have control over, according to multiple cybersecurity experts.
Nobitex acknowledged the incident in a statement on its website on Wednesday, saying that access to the crypto exchange had been 'suspended,' as a precaution, until further notice. Crypto-tracking firms Elliptic and TRM Labs confirmed the crypto was stolen and sent to 'wallets' or crypto accounts, with an expletive that referenced Iran's Islamic Revolutionary Guard Corps (IRGC).
In a separate hack on Tuesday, Predatory Sparrow said it had destroyed data at Iran's state-owned Bank Sepah, claiming IRGC members used the bank's services as a justification for the action. Iran's state-affiliated Fars news agency warned of potential disruptions to bank services at gas stations.
A source in Tehran told CNN they have gone to about 10 ATM machines over the course of Tuesday and Wednesday and found all of them either non-functional or out of cash.
The pair of stunning cyberattacks mark an escalation in Israel and Iran's years-long shadow war in cyberspace, where the arch-enemies — or their supporters — have conducted digital spying and data-destroying attacks for tactical advantage.
In yet another hack, Iran's state-owned TV broadcaster was targeted on Wednesday, with the hackers airing footage calling for a public uprising against the Iranian government. There was no immediate claim of responsibility for the hack.
Predatory Sparrow has emerged in the last five years to claim spectacular cyberattacks that have previously disrupted an Iranian steel mill and payments at Iranian gas stations. The hackers cast themselves as anti-government Iranian hacktivists but are widely suspected among cybersecurity experts of having ties to Israel.
Hamid Kashfi, a Farsi-speaking cybersecurity expert, told CNN that the Predatory Sparrow hack of Nobitex could affect ordinary Iranians despite the hackers' claims to just be targeting the IRGC assets. In the current war with Israel and with shrinking access to financial resources, 'many Iranians are banking on crypto,' Kashfi said.
Much of the cyber activity in recent days, as Israel and Iran trade missile strikes, appears aimed at sowing panic in the two countries. Israelis, for example, have received mass text messages impersonating authorities that claim that bomb shelters aren't safe.
The Iranian government, meanwhile, has warned citizens not to use the WhatsApp messaging service out of fear that Israel was collecting information from those chats. A spokesperson for Meta, which owns WhatsApp, has called those claims false and underscored that WhatsApp messages are end-to-end encrypted.
CNN's Muhammad Darwish contributed reporting.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Yahoo
28 minutes ago
- Yahoo
Iranian missile slams into the main hospital in southern Israel, causing extensive damage
Separate Iranian strikes also hit a high-rise apartment building in Tel Aviv and other sites in central Israel. Authorities in Israel said at least 40 people were wounded. (AP video shot by: Alon Bernstein)
33 minutes ago
Voice of America and Radio Farda's Persian services cover Israel-Iran conflict despite cutbacks
In the early days of Israel's attack on Iran, U.S.-operated Radio Farda, which broadcasts in the Persian language in Iran, debunked a state media report that an Israeli pilot had been shot down and captured. Its journalism has continued despite the Trump administration's threat to its future, along with a Persian-language television outlet run by Voice of America. Radio Farda, a branch of Radio Free Europe/Radio Liberty and based in Prague, has continued broadcasting even though its managing editor estimated that more than half of its staff had been furloughed. VOA's Persian staff, ordered to go on administrative leave in March, were suddenly ordered back to work last Friday afternoon. 'We've been giving information to Iranians minute by minute about the conflict,' said Golnaz Esfandiani, managing editor of Radio Farda. That includes explanatory stories about Iran's nuclear program and short videos posted on social media, she said. Several Iranians have contacted the radio network to express appreciation for reporting that they do not get on Iranian state media, she said. At the same time, families in Iran of five Radio Farda staff members have been pressured by people in the government who want to see the broadcasts stopped, she said. Through the U.S. Agency for Global Media, the Trump administration has sought to dismantle or sharply curtail the government-funded outlets that provide news reports to countries where there isn't a tradition of free press. The administration says these services operate with a liberal bias. Both Voice of America and Radio Free Europe/Radio Liberty are fighting the efforts in court. Employees at Voice of America's Persian service were notified in an email last Friday from Crystal Thomas, USAGM's human resources director, that they were being recalled and needed to report to work immediately. Kari Lake, who is running USAGM, told Fox News that 'we are ramping up — as we've always planned to do — to meet this historic moment.' One person who got that email was at the office within three hours and worked until midnight, helping to put out a one-hour broadcast, said the employee, who spoke on condition of anonymity because the person was not authorized to speak to the press. About 50 people have returned to work. Voice of America is banned in Iran, but many of its citizens find ways through the internet to bypass the ban. Voice of America's broadcasts — and social media posts — have become a challenge to produce because the administration has canceled subscriptions to news services like The Associated Press, Reuters and Agence France-Presse, said a second employee, who also spoke on condition of anonymity. For the employees, it's a stressful time, putting out urgent news reports without any sense of how long — or whether — they will continue to have a job. 'I'm grateful they've brought back our Persian service to continue their role as a trusted voice covering the region for the Iranian people,' said Patsy Widakuswara, VOA's White House correspondent, who is a plaintiff in the court fight to keep the agency alive. 'But why smash a working system only to cobble it back together when you realize you need it?' Widakuswara asked. 'And how many crises would it take for them to realize that all VOA language services are important — before, after and during breaking news?' During video reports posted online this week, a Voice of America anchor explained where Iranian counterattacks were landing in Israel, and how Iranians were trying to send out information about what is happening through social media. The danger for a service like VOA, having been off the air and off social media for more than two months, is that Iranian citizens will become accustomed to looking elsewhere for news, said Tom Kent, a media consultant and former president of Radio Free Europe/Radio Liberty. 'You would hope that people would learn from this that international broadcasting cannot be turned on and off like a light bulb,' said Kent, also a former AP editor. Despite an Israeli airstrike on its headquarters Monday while the Republic of Iran News Network was broadcasting live, the state-run news service is still operating. Radio Farda has stayed on the air despite cutbacks. It also continues to have access to news services like the AP, but those contracts will expire at the end of the month, Esfandiani said. Three people have been brought back from furlough to help cover the war, she said. She said she hopes the conflict lets people who question the service's existence know its value. 'It's an information war, absolutely,' Esfandiani said. 'These countries — Iran, Russia and China — would be very happy if we were gone.' One of the VOA employees called back to work said they have not been told how long it will be for. Despite evidence this week that someone in the administration saw value in what they do, might they still lose their job eventually? 'I don't want to think about that,' the person said.
Politico
43 minutes ago
- Politico
Iranian missile hits main hospital in southern Israel as strikes wound dozens
TEL AVIV, Israel — An Iranian missile slammed into the main hospital in southern Israel early Thursday, wounding people and causing 'extensive damage,' according to the medical facility. Israeli media aired footage of blown-out windows and heavy black smoke. Another missile hit a high-rise building and several other residential buildings in at least two sites near Tel Aviv. At least 40 people were wounded in the attacks, according to Israel's Magen David Adom rescue service. Israel, meanwhile, carried out strikes on Iran's Arak heavy water reactor, in its latest attack on the country's sprawling nuclear program, on the seventh day of a conflict that began with a surprise wave of Israeli airstrikes targeting military sites, senior officers and nuclear scientists. Iran has fired hundreds of missiles and drones at Israel, though most have been shot down by Israel's multi-tiered air defenses, which detect incoming fire and shoot down missiles heading toward population centers and critical infrastructure. Israeli officials acknowledge it is imperfect. The missile hit the Soroka Medical Center, which has over 1,000 beds and provides services to the approximately 1 million residents of Israel's south. A hospital statement said several parts of the medical center were damaged and that the emergency room was treating several minor injuries. The hospital was closed to all new patients except for life-threatening cases. It was not immediately clear how many were wounded in the strike. Many hospitals in Israel activated emergency plans in the past week, converting underground parking to hospital floors and move patients underground, especially those who are on ventilators or are difficult to move quickly. Israel's military said its fighter jets targeted the Arak facility and its reactor core seal to halt it from being used to produce plutonium. 'The strike targeted the component intended for plutonium production, in order to prevent the reactor from being restored and used for nuclear weapons development,' the military said. Israel separately claimed to have struck another site around Natanz it described as being related to Iran's nuclear program. Iranian state TV said there was 'no radiation danger whatsoever' from the attack on the Arak site. An Iranian state television reporter, speaking live in the nearby town of Khondab, said the facility had been evacuated and there was no damage to civilian areas around the reactor. Israel had warned earlier Thursday morning it would attack the facility and urged the public to flee the area. Iran has long maintained its program is for peaceful purposes. However, it also enriches uranium up to 60%, a short, technical step away from weapons-grade levels of 90%. Iran is the only non-nuclear-weapon state to enrich at that level. Israel is the only nuclear-armed state in the Middle East but does not acknowledge having such weapons. The strikes came a day after Iran's supreme leader rejected U.S. calls for surrender and warned that any military involvement by the Americans would cause 'irreparable damage to them.' Israel had lifted some restrictions on daily life Wednesday, suggesting the missile threat from Iran on its territory was easing. Already, Israel's campaign has targeted Iran's enrichment site at Natanz, centrifuge workshops around Tehran and a nuclear site in Isfahan. Its strikes have also killed top generals and nuclear scientists. A Washington-based Iranian human rights group said at least 639 people, including 263 civilians, have been killed in Iran and more than 1,300 wounded. In retaliation, Iran has fired some 400 missiles and hundreds of drones, killing at least 24 people in Israel and wounding hundreds. The Arak heavy water reactor is 250 kilometers (155 miles) southwest of Tehran. Heavy water helps cool nuclear reactors, but it produces plutonium as a byproduct that can potentially be used in nuclear weapons. That would provide Iran another path to the bomb beyond enriched uranium, should it choose to pursue the weapon. Iran had agreed under its 2015 nuclear deal with world powers to redesign the facility to relieve proliferation concerns. In 2019, Iran started up the heavy water reactor's secondary circuit, which at the time did not violate Tehran's 2015 nuclear deal with world powers. Britain at the time was helping Iran redesign the Arak reactor to limit the amount of plutonium it produces, stepping in for the U.S., which had withdrawn from the project after President Donald Trump's decision in 2018 to unilaterally withdraw America from the nuclear deal. The International Atomic Energy Agency, the United Nations' nuclear watchdog, has been urging Israel not to strike Iranian nuclear sites. IAEA inspectors reportedly last visited Arak on May 14. Due to restrictions Iran imposed on inspectors, the IAEA has said it lost 'continuity of knowledge' about Iran's heavy water production -- meaning it could not absolutely verify Tehran's production and stockpile.
