On June 18, 2025, Iran’s largest cryptocurrency exchange, Nobitex, suffered a massive cyberattack that resulted in the theft of approximately $90 million in assets.
The group responsible, a pro-Israel cyber unit known as “Predatory Sparrow,” claimed responsibility via X (formerly Twitter), alleging that Iran was using Nobitex to evade international sanctions.
In most cybercrimes, stolen crypto assets are laundered or sold off. However, this case showed a highly unusual tactic.
Blockchain analysis firms like Elliptic and TRM Labs reported that the stolen funds were sent to so-called “burn addresses” inaccessible even to the attackers. This technically destroys the assets and is seen as a politically and psychologically symbolic act rather than one of financial gain.
Part of the stolen funds was transferred to wallets containing messages insulting Iran’s elite military force, the Islamic Revolutionary Guard Corps (IRGC).
Additionally, Predatory Sparrow claimed to have launched a destructive attack on Iran’s state-owned bank “Sepah” on June 17. The bank is known to have close ties to the IRGC, suggesting it was also a deliberate political target.
Iranian state media reported temporary broadcast disruptions and the airing of anti-government footage, confirming that information infrastructure had also been attacked.
A resident in Tehran told CNN that he visited over 10 ATMs on June 17 and 18, none of which were functioning or had cash. The cyberattack has clearly impacted ordinary citizens’ access to financial services.
This is especially serious for Iranians who use Bitcoin and other cryptocurrencies to bypass government-imposed financial restrictions. For them, the attack represents not only asset loss but a violation of their economic freedom.
Cybersecurity researcher Hamid Kashfi commented that “this type of attack represents a new form of military conflict between states, involving psychological warfare that affects civilians directly.”
Many experts suspect that Predatory Sparrow has unofficial ties to Mossad, Israel’s intelligence agency. Modern cyberwarfare has evolved into a tool for cross-border operations, operating invisibly yet devastatingly.
This incident exposes the vulnerability of cryptocurrency infrastructure to nation-state cyberattacks and highlights the geopolitical risk embedded in digital assets today.
The Iranian government has reportedly suspended access to Nobitex and is reviewing its national financial cybersecurity protocols. Meanwhile, individuals and businesses must reinforce their crypto security practices.
Globally, there is growing urgency to develop legal frameworks and international agreements that can prevent and respond to cyberattacks, reshaping the landscape of financial security.
Stay updated on cyber threats, cryptocurrency trends, and geopolitical risk at the official FIXIO blog.
Iran’s largest crypto exchange Nobitex suffered a cyberattack, with $90 million in assets stolen and burned. Pro-Israel hacker group claims responsibility, signaling an escalation in the shadow war.
Superior trade execution & trading conditions with the NDD method.
The online FX industry provides a platform for investors worldwide to engage in the buying and selling.
Subscribe to our daily newsletter and get the best forex trading information and markets status updates
Trade within minutes!
Comment (0)