In a stunning cyber operation amid escalating Israel-Iran tensions, a pro-Israel hacker group known as Gonjeshke Darande (or Predatory Sparrow) reportedly drained over $90 million from Iran’s top crypto exchange Nobitex, only to render the stolen funds unusable by “burning” them — transferring them to inaccessible crypto addresses, reported the Economic Times.
The group claimed responsibility for the hack on June 18, just a day after announcing it had destroyed critical data at Bank Sepah, Iran’s state-owned financial institution. The targeted cryptocurrencies included Bitcoin, Ethereum, and Dogecoin, stolen from Nobitex digital wallets, which have been previously linked to Iran’s Islamic Revolutionary Guard Corps (IRGC).
According to Elliptic, a blockchain analysis firm, the hackers routed the stolen assets to addresses featuring terms like “FckIRGCterrorists*,” signaling a clear political message. These “vanity addresses” lacked private keys, making the funds permanently inaccessible.
“Predatory Sparrow would not have the private keys for the crypto addresses they sent the Nobitex funds to, and have effectively burned the funds in order to send Nobitex a political message,” said Elliptic in a statement.
Although the group’s identity remains unconfirmed, Israeli media often associates Predatory Sparrow with Israeli intelligence, though there’s no official verification of this claim. The hack appears to reflect the current volatile atmosphere, as Israel and Iran trade missile strikes and political warnings.
Nobitex, which boasts over 7 million users, has previously been accused of ties to ransomware operators connected to the IRGC and even close associates of Iran’s Supreme Leader Ayatollah Ali Khamenei.
Meanwhile, international powers are watching the developments closely. The US has indicated it will wait two weeks before intervening directly in the growing conflict, while Russia has warned Israel against striking Iran’s Bushehr nuclear facility. Former US President Donald Trump also reignited tensions, warning Iran’s leadership of “irreparable damage” if provoked.
This high-stakes digital attack underscores the growing intersection of cyber warfare and geopolitical conflict, raising concerns about the security of global financial platforms.
