&w=3840&q=100)
Predatory Sparrow: The pro-Israel group that stole $90 million from Iran's biggest crypto exchange
A shadowy hacking group calling itself Predatory Sparrow has claimed responsibility for a devastating cyberattack on Iran's top crypto exchange, Nobitex, wiping out over $90 million. Allegedly linked to Israel, the group's actions come amid mounting regional tensions and follow earlier attacks on Iranian banks and steel plants read more
A hooded man holds a laptop computer as blue screen with an exclamation mark is projected on him in this illustration picture taken on May 13, 2017. Representational Image/Reuters
A hacking group calling itself Predatory Sparrow — or Gonjeshke Darande in Persian — has claimed responsibility for a cyberattack on Nobitex, Iran's largest cryptocurrency exchange.
The attack, which reportedly took place on Wednesday (June 18, 2025), led to the removal or irreversible 'burning' of roughly $90 million in digital assets.
The incident marks yet another high-profile operation by the shadowy group, believed to be connected to Israeli interests, as part of a sustained digital offensive against Iranian financial and infrastructure systems.
STORY CONTINUES BELOW THIS AD
This targeted strike on Iran's cryptocurrency backbone follows an attack a day earlier on Iran's state-run Bank Sepah, also claimed by the same group, and comes
How Nobitex was compromised
In the early morning hours of Wednesday, cryptocurrency holdings amounting to nearly $90 million were siphoned from Nobitex's systems and moved into wallets controlled by the hackers.
TRM Labs, a blockchain forensics firm, confirmed the movement of funds and reported that the wallets used to receive the stolen cryptocurrency contained messages denouncing the Islamic Revolutionary Guard Corps (IRGC).
12 hours ago
8 burn addresses burned $90M from the wallets of the regime's favorite sanctions violation tool, Nobitex.
12 hours from now
The source-code of Nobitex will be open to the public, and Nobitex's walled garden will be without walls. Where do you want your assets to be?… — Gonjeshke Darande (@GonjeshkeDarand) June 18, 2025
Soon after, the Nobitex website went offline. The company acknowledged 'unauthorised access' and stated via X that it had deactivated both its website and mobile application while investigating the breach.
Attempts to reach Nobitex through its Telegram support channel yielded no response, and the hacker group also remained silent to media queries.
An analysis from blockchain security firm Elliptic later revealed a unique twist in the operation. The group reportedly transferred the stolen crypto into wallets that they themselves would be unable to access, essentially making the funds irretrievable.
STORY CONTINUES BELOW THIS AD
Elliptic concluded: 'The hackers effectively burned the funds in order to send Nobitex a political message.'
While the exact method of the breach remains undisclosed, this act of irreversible crypto 'burning' has highlighted the symbolic rather than monetary intention behind the attack.
The goal, analysts say, appears to be damage to Iran's ability to use crypto infrastructure to circumvent sanctions, rather than personal enrichment.
What we know about Predatory Sparrow
Predatory Sparrow has developed a reputation for bold and destructive cyberattacks targeting the Iranian regime and its critical infrastructure.
The group operates under a pseudonym that is widely interpreted as a linguistic counterpoint to 'Charming Kitten,' a well-known Iranian cyber-espionage unit. The choice of name is believed to indicate a direct adversarial stance against Iranian cyber operations.
Though no nation has publicly claimed association with Predatory Sparrow, several Israeli media reports have characterised the group as being aligned with Israeli strategic interests.
The Israeli government has officially maintained ambiguity regarding the group's ties to the state, though in 2022, media leaks following a major cyberattack on Iranian steel infrastructure prompted then-Defence Minister Benny Gantz to order an internal probe into potential breaches of Israel's covert operations policy.
STORY CONTINUES BELOW THIS AD
The group has left a long trail of notable digital attacks:
June 2022 steel factory incident: Predatory Sparrow claimed responsibility for a cyber operation that disrupted three Iranian steel plants. The group released video footage purportedly showing the moment molten steel spewed from a machine, causing a fire.
CCTV footage captured factory workers evacuating the site, followed by scenes of the blaze being doused with hoses.
The hackers stated on Telegram: 'These companies are subject to international sanctions and continue their operations despite the restrictions. These cyber-attacks, being carried out carefully to protect innocent individuals.'
October 2021 fuel system hack: The group claimed responsibility for taking down Iran's national fuel payment infrastructure.
They also hacked into roadside digital billboards to display the message: 'Khamenei, where is our fuel?' — a direct reference to Iran's Supreme Leader, Ayatollah Ali Khamenei.
Iranian emergency services were reportedly warned in advance to mitigate chaos.
Railway system disruption: In another public operation, hackers caused significant delays and confusion by tampering with Iran's national train station displays.
STORY CONTINUES BELOW THIS AD
Information boards were hijacked to inform passengers of delays and cancellations and suggested they contact Khamenei directly.
Code similarities with Indra: Cybersecurity firm Check Point found that some of the malware used by Predatory Sparrow contained code resembling that of another anti-Iranian group, Indra, which conducted a July 2021 attack on Iranian train systems.
These incidents suggest that Predatory Sparrow may be a tightly regulated and disciplined team of military-grade hackers.
Their actions appear to involve careful planning, timing and in some cases, even forewarning of emergency services to avoid civilian casualties — characteristics often associated with state-sponsored operations.
Why Nobitex was targeted
The crypto platform has been under scrutiny for its alleged role in helping the Iranian government and IRGC-affiliated actors launder funds and evade international sanctions.
Nobitex's reported financial transactions have shown linkages to cryptocurrency wallets operated by organisations such as Hamas, Palestinian Islamic Jihad and Yemen's Houthis — all entities hostile to Israel.
A 2022 investigative report by Reuters highlighted Nobitex's links to these groups and its use as a platform for Iran's illicit financial operations.
Representations of cryptocurrency Binance are seen in front of displayed Nobitex logo and Iran flag in this illustration taken November 3, 2022. Representational Image/Reuters
In May 2024, US Senators Elizabeth Warren and Angus King raised concerns in a letter addressed to the Biden administration, calling for scrutiny over the platform's role in helping Iran bypass sanctions. The senators cited the Reuters report as supporting evidence.
STORY CONTINUES BELOW THIS AD
Andrew Fierman, who heads national security intelligence at Chainalysis, confirmed in an email to Reuters that 'the value of the attack was roughly $90 million and that it was likely geopolitically motivated, given that the money was burned.'
He added that Chainalysis had 'previously seen IRGC-affiliated ransomware actors leveraging Nobitex to cash out proceeds, and other IRGC proxy groups leveraging the platform.'
This growing body of financial and technical evidence suggests that the recent cyberattack on Nobitex was not an isolated incident but part of a long-standing effort to disable or expose the digital infrastructure underpinning Iran's shadow economy.
What we know about the Bank Sepah attack
Just a day prior to the Nobitex breach, Predatory Sparrow also claimed responsibility for another major operation — this time targeting Iran's Bank Sepah. The group claimed to have erased key data from the bank's systems.
They posted on X: 'This is what happens to institutions dedicated to maintaining the dictator's terrorist fantasies.'
Destruction of the infrastructure of the Islamic Revolutionary Guard Corps 'Bank Sepah'
We, 'Gonjeshke Darande', conducted cyberattacks which destroyed the data of the Islamic Revolutionary Guard Corps' 'Bank Sepah'.
'Bank Sepah' was an institution that circumvented… pic.twitter.com/1r4XyDmXcJ — Gonjeshke Darande (@GonjeshkeDarand) June 17, 2025
STORY CONTINUES BELOW THIS AD
Customers in Iran reportedly faced serious disruptions in accessing accounts, withdrawing funds, and using bank cards.
Iranian media outlets warned that these problems could ripple out to the country's fuel distribution systems, which depend on Bank Sepah for processing transactions.
This assault marked a rare instance of a cyberattack affecting core financial infrastructure in the middle of a regional conflict, raising concerns about the cyber front of the ongoing Israel-Iran standoff.
Bank Sepah was sanctioned by the US Treasury Department in 2018 for aiding Iran's Ministry of Defense and Armed Forces Logistics.
Experts have noted that while hackers often exaggerate their impact, the consequences of the attack on Bank Sepah appear to be both real and widespread.
Former NSA official Rob Joyce commented on X: 'Disrupting the availability of this bank's funds, or triggering a broader collapse of trust in Iranian banks, could have major impacts there.'
STORY CONTINUES BELOW THIS AD
Also Watch:
With inputs from agencies
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Time of India
27 minutes ago
- Time of India
The 20 second trick that once cost US its prized stealth fighter; can Iran learn it to hunt Israeli jets?
While the Israeli Air Force (IAF) fighters continue to pound targets after targets in Iran, the latter has been claiming to have downed at least four F-35I Adir fifth generation stealth combat aircraft. Iran also boasts of having captured two Israeli fighter pilots with one being a woman. There has been no independent confirmation of the Iranian claims with Israel, too, terming the reports of the F-35 shoot-downs as "fake news". Soon after Iranian media on June 14, 2025, reported that the country's defense forces had shot down two F-35I Adirs, Israel Defense Forces International spokesperson Lieutenant Colonel Nadav Shoshani took to social media to issue a clarification. "Fake News Detector: Iran didn't shoot down any Israeli fighter jets. They are trying to create a fake victory narrative and it's not going very well," the IDF officer posted on X. According to Islamic Revolutionary Guard Corps (IRGC), one of the arms of Iranian Armed Forces , the long-range surface-to-air missile (SAM) system Bavar-373 was used to bring down the F-35 fighters. If Iran's claims are true, it would mark the first-ever combat loss for a fifth generation stealth fighter. by Taboola by Taboola Sponsored Links Sponsored Links Promoted Links Promoted Links You May Like Tan Dinh: Unsold Furniture Liquidation 2024 (Prices May Surprise You) Unsold Furniture | Search Ads Learn More But a stealth ground attack aircraft, although not belonging to the fifth generation, was indeed shot out of the sky more than 25 years back. The amazing military feat took place with the first prototype of what would eventually become the F-35 more than a year away from its first test flight, and many years away from entering active service. It was achieved not by employing advanced technologies, but a military officer who was daring, innovative and willing to employ unconventional strategies in pursuit of his mission. Live Events You Might Also Like: Iran claims to have hit Mossad training facility in Herzliya; Israel kills top Iranian military officer What happened with US F-117A Nighthawk stealth attack jet During the Yugoslav civil war in 1999, a North Atlantic Treaty Organization ( NATO ) air patrol come under fire with one US F-117A Nighthawk falling to the ground after a missile hit. Another stealth aircraft was hit during the same campaign and later declared a loss after managing to somehow reach its airbase. The F-117A was world's first stealth combat aircraft. A single pilot, twin-engine jet, the Nighthawk flew only subsonic and was developed as a ground attack aircraft. Deployed in a combat for the first time during the US invasion of Panama in 1989, the F-117A played a big role in the 1991 Gulf War, hitting hundreds of target in Iraq. Its next major deployment was during the Yugoslav civil war in the 1990s when NATO announced its forces were ready to assist in peacekeeping operations and enforce no-fly zones in the conflict-afflicted regions. As part of the deployment, NATO jets carried out bombing campaign against the then Federal Republic of Yugoslavia during the Kosovo War from March 24, 1999, to June 10, 1999. US Air Force 's F-117As also took part in these bombing runs. You Might Also Like: Iran claims it shot down Israeli F-35 stealth fighter but can the undetectable be hit? The truth may shock you How a Yugoslav Army officer tracked and shot down the F-117A US Air Force Lieutenant Colonel Darrell Patrick "Dale" Zelko, taking off from Italy's Aviano airbase on March 27, 1999, was carrying out a bombing run in his F-117A. His call sign was "Vega-31" and the aircraft serial number 82-0806. During his mission, he flew over Belgrade. On the ground, a few miles away from his location, was a unit of the Yugoslavian Army tasked with protecting the ground assets against NATO attacks. Lt. Col Zoltán Dani of the then existing Yugoslav army was in command of the air defense unit which had Soviet Isayev S-125 Neva/ Pechora missile system (NATO reporting name SA-3 Goa) in its arsenal. Yugoslav spies had informed Lt. Col Dani that US F-117As were in the vicinity. And, he was ready for them. Locking on to the stealthy F-117A and then firing a missile to shoot it down was at that time considered next to impossible. The Yugoslav officer was also well aware of the fatal risk of NATO targeting his radars and missile systems. Lt Col Dani goes for the kill He ordered his fellow soldiers to switch on the P-18 radar and emit lower frequencies to find out where the F-117As were. Even though the P-18 radar could not paint the stealth jet accurately, it had the capability to find out the aircraft's location approximately. Just after 20 seconds the radar was switched off as it failed to locate the jet. This was also deliberate strategy as the soldiers knew anything longer and the US jets would be able to find them out. The American High-speed Anti-Radiation Missile (HARM) and smart bombs were a big threat for the air defense unit. A few minutes later, the radar came online again, and this time too for 20 seconds. Again., no success for Lt Col Dani and his soldiers. Unaware of the Yugoslav air defense unit on the ground, Lt Col Zelko was on his way back to Aviano airbase. The two adversaries had no idea what was in store for them in the next few seconds. With Lt Col Zelko's plane a few miles away, the Yugoslav soldiers switched on the radar once again as they knew that up there somewhere in the skies, the US stealth jets were flying for their mission. It was the third time and once again Lt Col Dani's men had the radar scanning the sky for only 20 seconds. But those 20 seconds proved to be fateful as the F-117A lit up their radar screen at 8:15 pm local time. The weather was poor, the F-117A was about 14 miles (23 km) away but well within range, and there were no fighter escorts. Lt Col Dani was also helped by the fact that NATO jets had been using the same route for their missions since its start three days ago. There was no SEAD (Suppression of Enemy Air Defenses) support for the F-117A, and most importantly, Lt Col Zelko was flying very low. Seeing the enemy jet on his radar screen led Lt Col Dani to order another soldier, Lt Col Dorde Anicic, to fire the S-125 Neva/ Pechora missiles. Within seconds two missiles were in air, chasing the F-117A which was taken by surprise. The 1961 vintage Pechoras with a range of 8 miles (13 km) raced towards the F-117A. Lt Col Zelko was able to perform an evasive maneuver as the one of the Pechoras closed in. The first missile missed the jet but the F-117A was not so lucky with the second. The detonation of the second missile led to shrapnel damaging the aircraft, and along with the shockwaves resulted in the fighter falling to the earth. It was the first-ever combat loss of a stealth aircraft, and a little more than a month later on April 30, 1999, another F-117A was hit by a Yugoslav air defence missile. The plane survived but was never flown again after it managed to land at Spangdahlem Air Base in Germany.
Time of India
30 minutes ago
- Time of India
Israel's deadly trap: How top Iranian military chiefs were lured and eliminated — including the Army chief
The plan of how the Israel Air Force trapped and assassinated the Iranian military's wartime chief of staff, Major General Ali Shademani , along with other senior Islamic Revolutionary Guard Corps officers on Monday, has been revealed, as per The Jerusalem Post. How Did Israel Carry Out the Operation? After Israel launched its attack on Iran, Shademani and dozens of other senior Islamic Revolutionary Guard Corps officers had fled from their main headquarters in Tehran to a secret compound in the mountains outside of Tehran, according to the report. While, they thought hiding in that location was safe, the Israeli Air Force (IAF), were actually waiting for them to move to the 'secret' location and then killed them all at the same time, reported The Jerusalem Post. by Taboola by Taboola Sponsored Links Sponsored Links Promoted Links Promoted Links You May Like Indonesia: New Container Houses (Prices May Surprise You) Container House | Search ads Search Now Undo Just a few days before that the IDF killed Shademani, it had also assassinated his predecessor, Major general Gholam Ali Rashid , at Khatam-al Anbiya Central Headquarters on June 13, as per the report. ALSO READ: Barron Trump's $40 million crypto windfall? Inside the shocking profits from his father's digital coin empire Live Events Who Was Ali Shademani? After Rashid's death, Shademani had taken over his position and was made Iran's "War-Time Chief of Staff, the most senior military commander, and the closest figure to Iranian Supreme Leader Ali Khamenei," according to The Jerusalem Post. IDF said that Khatam al-Anbiya is "responsible for managing combat operations and approving Iran's firepower plans. In his various roles, he directly influenced Iran's operational plans targeting the State of Israel," quoted The Jerusalem Post. FAQs Why did they flee Tehran? They feared that Tehran's military headquarters had become too dangerous after Israel's earlier attacks, especially following the assassination of Rashid. Did the officers think they were safe? They believed the remote mountain compound was secure. That belief tragically cost them their lives when the IAF struck after they had all gathered.
NDTV
30 minutes ago
- NDTV
Will Israel-Iran Conflict Impact India's Oil Reserves? What Minister Said
New Delhi: The conflict between Israel and Iran has reached an unprecedented level, with verbal threats and aerial engagement with ballistic, cruise missiles, and drones. The 2025 conflict is the third direct engagement between the two arch-rivals and the most expansive. Oil - A vital natural resource found and produced in abundance in the Middle East is facing a direct impact from the conflict, with a fear of shortage. India's Petroleum and Natural Gas Minister, Hardeep Singh Puri, has assured that there is "No reason to worry about energy count and we have sufficient energy reserves to last for weeks." 'India's Diversified Sources' In an exclusive interview with NDTV, Mr Puri spoke about India's oil reserves and whether the country will face an immediate impact due to the ongoing battle between Iran and Israel. The minister said, "We are constantly monitoring the situation. No reason to worry about energy count. India has sufficient energy reserves to last for weeks." Mr Puri said India has strategically diversified its energy sources and the "global oil supply is much more than ever," adding that "we are monitoring the prices." "For a country dependent over 85% or 85% on crude oil imports for its requirements, yes, the situation as it unfolds globally will impact us, without a doubt. A country that depends 50% on imports for its natural gas requirements will be equally impacted, but having said that, let me say two things. Firstly, there is more oil available on the global market than at any point in research history. Production, new producers are coming to the market. I am not referring just to Guyana. It still has to come on stream, but a big find has been made. More suppliers in the western hemisphere," he said. "The United States is the largest producer, with 13 million barrels produced per day. They are going to add another 1.5 million barrels. Canada, Brazil, etc. So there is more oil coming to the market," he added. India is getting oil from Brazil, Guyana, Canada, the US and others too. Strait Of Hormuz Speculations over an Iranian blockade of the Strait of Hormuz continue, especially after a former Iranian minister suggested oil tankers and LNG shipments passing through the Strait should go only with Tehran's authorisation. Mr Puri responded and said, "India has options even if Iran seals the Strait of Hormuz." The Strait lies between Oman and Iran and links the Gulf north of it with the Gulf of Oman to the south and the Arabian Sea beyond. Whether the change in oil prices impacts consumers, Mr Puri said, "On the price side, the Prime Minister has already demonstrated that if a government is conscious of the needs of its consumers, on three occasions, he has brought the central excise down. I am talking about November 2021, May 2022, and March 2024. The central government reduced its excise, and the BJP states also reduced their a result of the central government's action, the price came down by Rs 13 and Rs 16, respectively, for petrol and tensions escalate, will the route be closed, the Straits of Hormuz? Frankly, people agonise about that. But as far as I am aware, in the last 50 years of our history, of the history of this region, the Strait of Hormuz has never been closed." Only one-third of India's oil supply comes from it. Around 38% of India's oil imports come from Russia at roughly 5.6 million barrels a day, and only 1.2 million barrels come through the Strait of Hormuz. The minister said that if the supply from the Strait of Hormuz is impacted, then "India will increase its domestic production, and will not export," adding that it will "also buy from other sources." Mr Puri said the US President has repeatedly said "Drill baby, drill"; he is keen on increasing production to bring oil prices down. The US would not want the strait to be closed; it's not even in China's interest, either. About a fifth of the world's total oil consumption passes through the strait. Between the start of 2022 and last month, roughly 17.8 million to 20.8 million barrels of crude, condensate and fuels flowed through the strait daily, according to data from Vortexa. OPEC members Saudi Arabia, Iran, the United Arab Emirates, Kuwait and Iraq export most of their crude via the strait, mainly to Asia. The UAE and Saudi Arabia have sought to find other routes to bypass the strait. Iran has threatened over the years to block the strait but has never followed through. Mr Puri explained that the insurance price is going up, which means there will be some additional cost. "In India, 67 million people go to the petrol station for different forms of energy: petrol, diesel, CNG. It's the cost of production of a barrel outside, the cost of freight. Yes, it stands to reason that if any supply route is closed and you have to re-route your supplies, then the cost of freight would go up. The cost of insurance has gone up because insurance companies would like to cover their risk. So far, merchant shipping has not been hit," Mr Puri said.
