You are currently viewing Israel-Linked Hacker Group Predatory Sparrow Destroys $90M in Iranian Crypto Heist

Israel-Linked Hacker Group Predatory Sparrow Destroys $90M in Iranian Crypto Heist

Prime Highlights

  • Israel-linked hacker group Predatory Sparrow stole $90 million from Iran’s Nobitex crypto exchange.
  • The funds were routed into useless “vanity addresses,” as it is not possible to recover and was a symbolic act.

Key Facts

  • The funds were not withdrawn but burned in IRGC-opposition slogans on addresses.
  • Nobitex reported an intrusion and is currently activating recovery procedures.

Key Background

It was during June 2025 that there was a cyberattack, conducted by the Israeli pro-hackers Predatory Sparrow, where approximately $90 million in cryptocurrency was stolen from Iran’s largest digital asset exchange, Nobitex. The group later took responsibility and described how the stolen money was not stored for profit but rather transferred into vanity blockchain addresses—purses containing bespoke anti-Iran messages and are technically unusable, effectively destroying the money.

Blockchain specialists confirmed that the crypto wallets were programmed with slanderous slogans targeting Iran’s Islamic Revolutionary Guard Corps (IRGC). The addresses are coded without private keys being issued, making any recovery of the cryptocurrency computationally impossible—a step that would require billions of years, experts indicate.

The breach is part of a wider campaign, as Predatory Sparrow also claimed to have hacked and breached data systems at Iran’s largest state-owned bank, Bank Sepah. The disruption occurred on the same day as an internet disruption across the country, which Iranian officials attributed to “technical upgrades,” though observers believe it may be a response to the breach.

While Israel has not yet acknowledged involvement, the political messaging and tactics of the operation are in line with previous cyber activity that has been attributed to Israeli interests. The experts of cybersecurity companies opine that the motive is not mere economic sabotage but goes beyond to exploit platforms used by Iran to circumvent sanctions and clandestinely make dollars.

This case points to the growing role of cryptocurrency exchanges as battlegrounds for geopolitical cyber conflict, particularly between long-standing competitors like Israel and Iran. It also represents a shift in cyberattacks—from economically motivated ransomware to ideologically motivated economic disruption through the sabotage of digital assets.