Catenaa, Wednesday, June 25, 2025- Hackers with possible Israeli ties has reportedly drained over $90 million from Nobitex, Iran’s largest cryptocurrency exchange, in a politically motivated cyberattack, according to blockchain analytics firms.
The group known as Gonjeshke Darande, or “Predatory Sparrow,” leaked Nobitex’s source code Thursday and claimed the attack was retaliation against the exchange’s alleged role in helping Iran evade Western sanctions tied to its nuclear program and funding militant groups.
Blockchain analytics firm Elliptic said the stolen cryptocurrencies, including Bitcoin, Ethereum, and Dogecoin, were transferred to wallets that effectively burned the funds, underscoring the hackers’ intent to send a political message rather than financial gain. Nobitex confirmed the breach, temporarily shutting down its app and website to investigate unauthorized system access.
The attack comes amid heightened Israel-Iran conflict following Israeli strikes on Iranian nuclear sites last week and follows a cyberattack on Iran’s state-controlled Bank Sepah earlier in the week.
Elliptic highlighted ties between Nobitex and relatives of Iran’s Supreme Leader Ali Khamenei, as well as connections to sanctioned Revolutionary Guard operatives and Iranian allies such as Yemen’s Houthis and Hamas.
Gonjeshke Darande has claimed responsibility for previous disruptive cyberattacks against Iranian infrastructure since 2021, but Israeli authorities have not officially confirmed any link to the group.
U.S. lawmakers have expressed concern over Iran’s use of cryptocurrencies to circumvent sanctions, underscoring the growing geopolitical risks in the digital currency space.
