The pro-Israeli hacker group known as Predatory Sparrow (Gonjeshke Darande) has pulled as much as $90 million from Iran’s cryptocurrency exchange.
Blockchain analytics firm Elliptic reported on Wednesday that it has tracked more than $90 million taken from accounts in the Iran exchange and moved to accounts set up by the pro-Israel hackers.
Theft for financial gain does not appear to be a factor, according to Elliptic. Instead, its analysis of the hack and transfer shows the money going to accounts, or wallets, which cannot be accessed. The recipient wallet addresses all contain a derogatory reference to Iran’s Islamic Revolutionary Guard Corps (IRGC), pointing to a geopolitically motivated cyberattack.
To make it worse for the original currency holders, the hackers don’t have private keys to the accounts where they transferred the funds. No one does. Elliptic said that it is a complicated way of ensuring the funds have been “burned,” or destroyed.
Elliptic said the Nobitex exchange is the primary crypto site used by Iran, with as many as 7 million users. The exchange has been linked in the past with the Iranian government and IRGC leaders. The analytics firm also reported that the exchange has been used by IRCG operatives who have been involved in ransomware attacks.
The multi-million dollar hack against Iran happened as Israel continued to attack Iran’s nuclear enrichment sites, believed to be producing material that can be used to construct nuclear weapons. The opening of the military strikes late Thursday began after negotiations to potentially stop Iran’s nuclear program came to a standstill.
Predatory Sparrow on Tuesday also claimed to have infiltrated Iran’s Bank Sepah and “destroyed the data of the Islamic Revolutionary Guard Corps.” The group claimed the bank “was an institution that circumvented international sanctions and used the people of Iran’s money to finance the regime’s terrorist proxies, its ballistic missile program and its military nuclear program.”
The Treasury Department in October 2022, issued a release on the bank being sanctioned for affiliation with the IRGC and involvement in ransomware attacks.
© 2025 Newsmax. All rights reserved.
