Hackers stole the equivalent of roughly $90 million from Iran’s largest cryptocurrency exchange on Wednesday, according to multiple independent crypto-tracking firms.
A skilled pro-Israel hacking group known as “Predatory Sparrow” took credit for the cyberattack, which appeared to be aimed at further weakening Iran amidIsraeli’s military strikeson Tehran.
In a post in Farsi on X, the hackers said that they had hit Iranian crypto exchange Nobitex, claiming that Iran used the exchange to skirt international sanctions. And in an extraordinary move, the hackers may have effectively thrown the stolen crypto away by transferring it to digital “wallets” that they don’t have control over, according to multiple cybersecurity experts.
Nobitex acknowledged the incident in a statement on its website on Wednesday, saying that access to the crypto exchange had been “suspended,” as a precaution, until further notice. Crypto-tracking firmsEllipticandTRM Labsconfirmed the crypto was stolen and sent to “wallets” or crypto accounts, with an expletive that referenced Iran’s Islamic Revolutionary Guard Corps (IRGC).
In a separate hack on Tuesday, Predatory Sparrow said it had destroyed data at Iran’s state-owned Bank Sepah, claiming IRGC members used the bank’s services as a justification for the action. Iran’s state-affiliated Fars news agency warned of potential disruptions to bank services at gas stations.
A source in Tehran told CNN they have gone to about 10 ATM machines over the course of Tuesday and Wednesday and found all of them either non-functional or out of cash.
The pair of stunning cyberattacks mark an escalation in Israel and Iran’s years-long shadow war in cyberspace, where the arch-enemies — or their supporters — have conducted digital spying and data-destroying attacks for tactical advantage.
Predatory Sparrow has emerged in the last five years to claim spectacular cyberattacks that have previously disrupted an Iranian steel mill and payments at Iranian gas stations. The hackers cast themselves as anti-government Iranian hacktivists but are widely suspected among cybersecurity experts of having ties to Israel.
Hamid Kashfi, a Farsi-speaking cybersecurity expert, told CNN that the Predatory Sparrow hack of Nobitex could affect ordinary Iranians despite the hackers’ claims to just be targeting the IRGC assets. In the current war with Israel and with shrinking access to financial resources, “many Iranians are banking on crypto,” Kashfi said.
Much of the cyber activity in recent days, as Israel and Iran trade missile strikes, appears aimed at sowing panic in the two countries. Israelis, for example, have received mass text messages impersonating authorities that claim that bomb shelters aren’t safe.
The Iranian government, meanwhile, has warned citizens not to use the WhatsApp messaging service out of fear that Israel was collecting information from those chats. A spokesperson for Meta, which owns WhatsApp, has called those claims false and underscored that WhatsApp messages are end-to-end encrypted.
CNN’s Muhammad Darwish contributed reporting.