Iran's top cryptocurrency exchange, Nobitex, confirmed a major cyberattack that led to the loss of more than $90 million in digital assets. The hacking group Predatory Sparrow claimed responsibility and said it carried out the attack as a politically motivated move.

The breach took place on June 18. Nobitex publicly acknowledged it the following morning. The company said attackers gained unauthorised access to part of its infrastructure, including its hot wallet, which held cryptocurrency used for fast transactions. After discovering the breach, Nobitex disabled access to its app and website. It launched a full investigation.

Nobitex, which reportedly had over 10 million users, experienced its most serious security breach. Blockchain analytics firm Elliptic analysed the incident and reported that the hackers stole over $90 million through multiple transactions. However, unlike most financially motivated crypto hacks, the stolen funds were not moved to typical private wallets.

The hackers transferred the funds to wallet addresses known as “vanity addresses,” which contained anti-Iranian regime messages. These addresses were generated in a way that made the assets nearly impossible to access again. In effect, the hackers destroyed the funds and didn’t attempt to keep or use them.

Elliptic said that the vanity addresses included messages targeting Iran’s Islamic Revolutionary Guard Corps (IRGC). The firm added that generating such addresses required significant computing resources, which made it unlikely that anyone, including the attackers, could recover the funds. The act appeared symbolic and aimed to inflict financial damage while delivering a strong message.

Predatory Sparrow made its announcement on social media. The group accused Nobitex of helping the Iranian government bypass sanctions and finance certain operations. It also threatened to release internal company data, including source code, within 24 hours if certain conditions were not met.

One day before the Nobitex hack, the same group claimed to have attacked Bank Sepah, a state-run Iranian bank, disrupting ATM operations across the country.

These two cyberattacks came during a period of heightened tensions between Iran and Israel. Iranian media accused Israel of carrying out coordinated cyberattacks to damage Iran’s digital infrastructure.