'Predatory Sparrow' Pulls Off $90M Iranian Crypto Heist

An Iranian cryptocurrency exchange has been relieved of tens of millions of dollars from its coffers, and a group linked to Israel is now claiming responsibility for the hack. On Wednesday, Gonjeshke Darande (which translates to "Predatory Sparrow") said it had breached the Nobitex exchange, with the Elliptic consultancy reporting that about $90 million was diverted from the exchange by hackers to "vanity addresses" without crypto keys, meaning they can't be accessed, per the Guardian. On Wednesday, Predatory Sparrow warned online that it would also release Nobitex's "source code and internal information," and it appeared to do just that early Thursday, per the AP.

"The Nobitex exchange is at the heart of the regime's efforts to finance terror worldwide, as well as being the regime's favorite sanctions violation tool," the group wrote on X. Just hours before the Nobitex hack, the group claimed it had also eradicated data at Iran's state-run Bank Sepah, noting on X that "this is what happens to institutions dedicated to maintaining the dictator's terrorist fantasies." A source in Tehran told CNN that at least 10 area ATMs over the past couple of days have either not been working or have been out of cash, and the Fars news agency warned that gas station transactions may also be affected.

Elliptic isn't yet acknowledging that Predatory Sparrow was behind the Nobitex hack, noting only that "the hack appears to be motivated by the recent escalation of tensions between Israel and Iran," per the Guardian. Nobitex, meanwhile, said in a Thursday X post that it was looking more into the "security incident" and that "the scope and impact of the attack are more complex than initially estimated."

story continues below

Axios notes that this appears to be the first big cyberattack on crucial infrastructure in Israel's attack on Iran, detailing Predatory Sparrow's "long history of destructive attacks on Iranian infrastructure." The outlet also predicts we haven't seen the last of this type of hack: "Both Iran and Israel are cyber superpowers in their own right. Don't expect the cyberattacks in the ongoing conflict to stop here."