A shadowy hacker group known as Gonjeshke Darande or “Predatory Sparrow” has claimed responsibility for a massive cyberattack on Iran’s largest cryptocurrency exchange, Nobitex. The group alleges that the platform is being used by the Iranian regime to fund terrorism and evade international sanctions. The attack, they say, resulted in the theft of a staggering $48 billion in cryptocurrency—a potentially record-breaking figure in the world of digital finance.
Predatory Sparrow Issues Warning and Promises Data Dump
On Wednesday, Predatory Sparrow issued a public statement announcing the breach. The hackers claimed they had not only siphoned off billions in crypto assets but also gained access to Nobitex’s internal networks, including its source code and confidential operational files. They warned Iranian users:
“Collaborating with a terrorist financing infrastructure puts your assets at risk! Act before it’s too late.”
According to the group, the full scope of the data breach will be revealed within 24 hours, including the release of internal documents that could expose the exchange’s ties to high-ranking regime officials and illicit financial operations.
Nobitex Allegedly Aids Iran in Bypassing Sanctions
Nobitex is Iran’s leading cryptocurrency exchange, facilitating the trading of digital assets such as Bitcoin and Ethereum. While crypto trading is popular among Iranians due to economic instability and sanctions, the platform has long been scrutinized for operating in regulatory gray zones.
According to Predatory Sparrow, Nobitex plays a central role in helping the Iranian government circumvent global sanctions through crypto-based channels. The group further claims that funds flowing through Nobitex are used to support the Iranian Revolutionary Guard Corps (IRGC) and affiliated terrorist organizations abroad.
Though these allegations have not been independently verified, the potential implications could be significant, especially as international regulators monitor cryptocurrency’s role in illicit finance.
Cyberattack on Sepah Bank Adds to Escalation
The Nobitex breach followed another high-profile cyberattack earlier this week targeting Sepah Bank, a financial institution directly controlled by the IRGC. On Tuesday morning, Sepah Bank’s online services were paralyzed, disrupting not only banking operations but also services at many of Iran’s gas stations, which are tied to the bank’s digital payment systems.
Fars News Agency, the media outlet closely aligned with the IRGC, confirmed the attack but did not name those responsible. However, Predatory Sparrow promptly took credit, stating that they had successfully “destroyed” Sepah Bank’s data and crippled its operational infrastructure.
Israel Allegedly Linked to Hacker Group
While Predatory Sparrow is an independent entity, several cybersecurity analysts and intelligence sources have suggested possible links to Israel. The group has previously carried out cyber operations targeting Iranian infrastructure, including energy plants and railways.
Neither Israeli authorities nor any other official government representatives have confirmed involvement in the recent breach. Still, the sophisticated nature of the attack—alongside its political overtones—has led many to suspect state-level backing or coordination.
A New Era of Financial Cyber Warfare?
The magnitude of the alleged $48 billion theft—if verified—marks one of the largest cyber-heists in history. It also represents a significant shift in cyber warfare, where attacks are no longer limited to espionage or sabotage but are now directly targeting state finances.
Cybersecurity experts warn that this type of operation may become more common as cryptocurrency continues to be adopted globally, particularly in nations under heavy sanctions. Digital finance, they argue, has created new vulnerabilities for regimes attempting to shield their economies from international oversight.
What Comes Next for Iran’s Crypto Sector?
Iran’s government has not yet issued an official response to the Nobitex breach or the claims of Predatory Sparrow. However, if the promised data dump materializes, it could result in severe reputational damage for Nobitex and further expose the Iranian regime’s financial dealings to global scrutiny.
With the Iranian economy already under intense pressure, the fallout from these cyberattacks could ripple through the country’s digital infrastructure and beyond—possibly prompting new international sanctions, investigations, or retaliatory cybermeasures.
