In mid-June 2025, an anonymous hacking group calling itself Gonjeshke Darande—Farsi for “Predatory Sparrow”—claimed responsibility for a devastating cyberattack on Iran’s biggest cryptocurrency exchange, Nobitex, wiping out $90 million of digital assets in a single blow . The funds, including Bitcoin, Ethereum, and Dogecoin, were sent to special “vanity” addresses and effectively burned, locking them forever out of circulation.
What Really Happened?
The Breach: On June 18, hackers breached Nobitex’s hot wallets and transferred over $90 million into on-chain addresses without private keys, rendering the coins unrecoverable .
Political Messaging: The criminals embedded anti-Revolutionary Guard messages in the addresses—“F*ckIRGCterrorists”—signaling a political rather than financial motive .
Internet Blackout: Concurrently, Iran’s government imposed a near-total internet shutdown, officially to “maintain network stability,” though analysts suspect it was also to stifle public panic and hinder forensic investigations .
Who Is Predatory Sparrow?
While Israeli media and cybersecurity experts note the operation’s sophistication fits a state-linked actor, there is no official confirmation of Israeli government backing. Security firms describe Predatory Sparrow as an “unusually destructive” group with a history of hitting Iranian infrastructure—from gas stations to banks—underscoring its cyber-war capability .
Example for Clarity: Think of a digital arsenal: instead of just stealing money, these hackers “scorched the earth,” burning the assets to send a message—akin to smashing a rival’s warehouse rather than stealing its goods.
Why It Matters
Escalation of Cyber-War: This attack marks a clear escalation from traditional espionage to openly destructive cyber-warfare, targeting civilian finance to pressure Iran’s regime.
Market Shockwaves: Nobitex immediately took its platform offline, freezing hundreds of thousands of users out of their funds and stoking fears that no exchange is safe—spurring a brief sell-off across regional crypto markets.
Political Leverage: By destroying (not cashing out) the funds, Predatory Sparrow amplifies the political sting—tying crypto directly into geopolitics and sanction-evasion debates.
Is It True?
Yes. Multiple independent sources—including Reuters, AP News, and The Guardian—have corroborated the $90 million figure, the method of “burning” assets via vanity addresses, and the timing alongside Iran’s internet blackout . While the group’s exact sponsorship remains unconfirmed, its own statements and blockchain-forensics reports leave little doubt that Predatory Sparrow’s cyber-onslaught is real—and represents the sharp end of an emerging crypto-infused shadow war.
Bottom Line:
The Nobitex hack isn’t just a headline-grabbing theft—it’s a politically charged cyber-attack that obliterated $90 million on-chain and underscored cryptocurrencies’ new role as both targets and weapons in modern state conflict. As Israel-Iran tensions simmer, expect more cross-border digital strikes testing the resilience—and neutrality—of the crypto ecosystem.