Crypto Market Faces Another Heist: Hacker Group Steals ~$100M in Assets from Iranian Exchange
On Wednesday, the Iranian cryptocurrency exchange Nobitex was hit by a cyberattack. According to Nobitex’s fourth announcement, the estimated total value of stolen assets is approximately $100 million, but the situation is now under control, and user assets are fully protected by the reserve fund, ensuring no financial losses for users.
A hacker group linked to Israel, Gonjeshke Darande (Persian for “Predatory Sparrow”), claimed responsibility for the Nobitex asset theft. The day before, the group also claimed to have destroyed data belonging to Iran’s state-owned Sepah Bank.
Consulting firm Elliptic stated that the hackers appear to have destroyed the stolen Nobitex funds by storing them in vanity addresses without corresponding keys, rendering them inaccessible.
Elliptic’s co-founder Tom Robinson further explained that creating a cryptographic key pair to match a vanity address would take billions of years with current computing technology.
The Predatory Sparrow group also stated it has targeted Nobitex and plans to release its source code and additional internal information. This action raises speculation, as the stolen funds were not actually utilized by the hackers, suggesting their motives may be more political in nature.
Potentially Linked to Israel-Iran Conflict
The Predatory Sparrow group has long been suspected of ties to Israel, though its identity and nationality have not been officially confirmed. Elliptic noted that, while there is no direct evidence, this cyberattack may be related to recent tensions between Israel and Iran.
Rafe Pilling, Director of Intelligence at cybersecurity firm Sophos, stated there is no conclusive evidence linking Predatory Sparrow to a specific country, but the group exhibits all the characteristics of a state-backed entity using false identities. It specifically targets Iran’s digital sector, logistics entities, transportation infrastructure, and other strategic sectors for disruptive operations.
He added that, while no close technical ties between Israel and Predatory Sparrow can be verified, the group’s actions align closely with Israel’s regional priorities, and it’s difficult to identify another country in the region capable of executing such attacks.
The day prior, Predatory Sparrow posted on X that it destroyed Sepah Bank’s data because the bank funds Iran’s military.
This breach further extends the list of victims of crypto industry hacks in 2025. According to blockchain security firm CertiK, over $2.1 billion in digital assets have been stolen so far in 2025.