Introduction
Iran’s largest cryptocurrency exchange, Nobitex, was hacked on June 18, 2025. Over $90 million in cryptocurrencies were stolen and deliberately destroyed by the hacking group Predatory Sparrow (Gonjeshke Darande), suspected to be linked to Israel. This attack marks a major escalation in the use of cryptocurrency as a weapon in geopolitical cyber warfare.
Who Are Predatory Sparrow?
Predatory Sparrow has a track record of highly sophisticated cyberattacks targeting Iranian infrastructure. Previously, they disrupted Iran’s gas stations (2021) and steel mills (2022), causing severe offline damage. The group has now turned its focus toward the crypto sector, claiming responsibility for Nobitex’s breach.
Read detailed reporting here: Reuters coverage of Nobitex hack.
The Attack in Detail
- Attackers drained approximately $90 million from Nobitex.
- Funds were transferred into vanity blockchain wallets featuring anti-IRGC messages.
- These wallets were constructed so attackers could not retrieve the funds, effectively destroying them.
- Nobitex’s website and mobile app were taken offline following the breach.
According to AP News analysis, this strategic burning of funds was designed to send a message against Iran’s Islamic Revolutionary Guard Corps (IRGC).
Sanctions Evasion Ties
Blockchain forensics firms Elliptic and Chainalysis have previously documented Nobitex’s links to sanctioned groups including Hamas, Palestinian Islamic Jihad, the Houthis, and Iranian proxies. By targeting Nobitex, Predatory Sparrow struck at one of Iran’s alleged crypto-based sanctions evasion mechanisms.
Read more: The Guardian’s full report on geopolitical implications.
Expert Opinions
- Elliptic: Confirmed the burning of funds was intentional to damage state actors financially.
- Chainalysis: Identified IRGC ransomware operations previously leveraging Nobitex to cash out illicit funds.
- TRM Labs: Tracked transaction flows and confirmed the sophisticated use of vanity addresses.
Crypto Warfare: A New Frontier
This attack underscores a rising trend: nation-state-aligned hackers using crypto markets not for theft, but as political leverage. The use of “vanity addresses” ensured funds would be permanently destroyed, rather than stolen for profit. This makes cryptocurrency an increasingly potent domain for hybrid warfare.
Global Reactions
U.S. senators had already raised concerns about Nobitex’s role in enabling Iranian sanctions evasion prior to this attack. The breach may further intensify global regulatory scrutiny of crypto exchanges facilitating illicit finance activities across borders.
Conclusion
The Nobitex hack is a dramatic reminder that crypto networks are now entangled in global conflicts. Exchanges like Nobitex are likely to face heightened oversight as political and financial warfare merge in cyberspace.
