Amid rising military and cyber tensions between Israel and Iran, a major Iranian crypto exchange has suffered one of the largest digital heists in the country’s history. On June 18, hackers stole and destroyed approximately $90 million worth of digital assets from Nobitex, Iran’s largest crypto trading platform. The attackers, reportedly linked to a pro-Israel cyber group known as “Predatory Sparrow,” transferred the funds to vanity wallet addresses—a move interpreted not as a profit motive, but as a deliberate attempt to eliminate the assets.
The hackers also embedded anti-IRGC (Islamic Revolutionary Guard Corps) messages in the transaction metadata, directly accusing Nobitex of serving as a channel for funding groups like Hamas and Hezbollah. Blockchain forensics firm Elliptic, which analyzed the attack, confirmed that the funds were rendered irretrievable, effectively burned on-chain, and not sold or laundered. This method of destruction signals a shift in cyberattack motivations—from financial gain to geopolitical messaging.
This was not an isolated incident. Just days before the crypto breach, Iran’s state-owned Bank Sepah also came under cyberattack, disrupting online services and exposing data vulnerabilities. These attacks appear to be part of a broader campaign to cripple Iran’s financial and digital infrastructure, coinciding with the latest flare-up in the ongoing Israel-Iran conflict.
A new frontier in warfare
The $90 million crypto theft is being seen as a highly strategic cyber offensive carried out in tandem with escalating military tensions in the region. While Israel has not officially claimed responsibility, cybersecurity experts and regional analysts point to patterns and tactics previously attributed to Israeli-linked groups, including the 2021 and 2022 attacks on Iranian steel plants and fuel stations.
By targeting a major crypto platform instead of just state systems, the attackers have expanded the battleground to include decentralized finance (DeFi) and digital assets—sectors increasingly used by sanctioned nations for cross-border transactions and sanctions evasion. The attack sends a clear message: financial technology is not off-limits in modern conflict.
Iran’s domestic internet services were briefly throttled following the breach, reportedly as a protective measure to contain digital fallout and prevent further compromise. Nobitex remains offline, and authorities have yet to confirm the full extent of user losses or if customer wallets were affected. However, the symbolic loss of crypto reserves is already being interpreted as a serious blow to Iran’s emerging digital economy.
Cybersecurity experts have warned that this incident could trigger retaliatory cyber strikes, and global financial institutions are being advised to strengthen their digital defenses, especially in light of possible spillover effects.
In the evolving landscape of geopolitical tension, the Nobitex attack highlights how cryptos are no longer just financial tools—they are now targets and weapons in cyber warfare. With digital finance intertwined with national security, the distinction between digital assets and critical infrastructure is rapidly dissolving.
