- calendar_today September 3, 2025
Once again, the Middle Eastern digital battlefield flared out. And this time, the financial structure of Iran was the bullseye. Long suspected to have links to Israeli intelligence, the hacker group Predatory Sparrow took responsibility for two synchronized cyberattacks this week. The goals are Sepah Bank, a strong institution tightly linked to the military operations of the government, and Nobitex, Iran’s biggest bitcoin exchange.
Your typical cyber theft was not this one. No calls for a payment of ransom. Not one stolen password suitable for sale. Rather, it was determined to be sabotage.
Predatory Sparrow burned more than $90 million worth of digital money, according to Elliptic, a blockchain tracking company. From Nobitex, they moved money into addresses beginning with terms like “FuckIRGCterrorists,” sometimes referred to as vanity wallets. There is no recovery from these addresses. Once the money leaves, it disappears forever.
“The crypto they stole has essentially been burned,” said co-founder of Elliptic Tom Robinson. “The hackers quite obviously have political rather than financial motives.”
The group made no secret about their goals. In a statement sent to X, they claimed Nobitex funded terrorism and helped the Iranian government violate sanctions. They cited the claimed links of the exchange to the IRGC, Hamas, the Houthi insurgents, and Palestinian Islamic Jihad. Elliptic backed up the allegation with reference to blockchain research showing money moves between wallets linked to approved groups and Nobitex.
For their part, Nobitex turned quiet. Its website vanished, and users haven’t heard anything since. The silence is deafening for an exchange handled in millions of volumes.
Predatory Sparrow was still unfinished, though.
Later that same day, the group started yet another attack, this one aimed at Sepah Bank, a long-standing Iranian financial institution closely associated with Iran’s military. The hackers claimed to have deleted all of the bank’s internal records and sent papers allegedly proving financial transactions between Sepah and Iran’s armed forces.
“Note: Care; Your long-term financial situation suffers when you associate with the tools of the government for avoiding sanctions and funding their ballistic missiles and nuclear program. Who’s next?
The public website of Sepah Bank returned promptly online. But Hamid Kashfi, an Iranian cybersecurity researcher living in Sweden and the creator of DarkCell, claims that damage was already done.
People on the ground report that ATMs and online banking are down. Individuals cannot get into their accounts. This is impacting ordinary Iranians rather than only government agents, Kashfi said.
Over the years, Predatory Sparrow has developed a reputation for highly impactful, highly targeted cyberattacks. By adjusting the control systems of a steel plant, they have even engineered a near-deadly industrial accident and taken credit for paralyzing Iran’s railway system and disabling hundreds of gas stations. Particularly, that attack startled analysts; it was not only data destruction. It was physical sabotage captured on film and disseminated worldwide.
Although the group brands itself as Iranian, experts have concluded it runs with the aid—if not under direct control—of Israeli intelligence based on its capabilities and strategic targeting.
Top Google threat intelligence unit analyst John Hultquist also expressed that view. “Predatory Sparrow isn’t flirting.” They have repeatedly shown that they are more than suited for acting when they threaten.
This attack on Nobitex strikes particularly strongly since crypto is becoming a major financial tool for Iran in escaping sanctions. It implies that not only are the nation’s digital defenses weak, but also its alternative financial systems are prone to total collapse.
The activities of the predatory Sparrow could mark the start of a more general change in cyberwarfare. We are not now looking at attacks intended for espionage or extortion. These are activities meant to destroy, obliterate, and disable important infrastructure.
And given their eerie farewell words, “Who’s next?” it is abundantly evident this was more than just a headline-grabbing blow. It was a foretelling.
