A hacking group called Predatory Sparrow claimed responsibility Wednesday for a cyberattack on Iran’s largest cryptocurrency exchange, Nobitex, transferring and destroying at least $90 million in digital assets as part of a politically motivated assault tied to the country’s Revolutionary Guards.

Cyberattack Hits Iran’s Crypto Heart

Predatory Sparrow announced the breach early Wednesday in Persian, declaring it had targeted Nobitex and would soon leak its source code. Hours later, the group confirmed in English that it had moved $90 million into inaccessible wallets as a symbolic act of destruction—accusing the exchange of helping Iran’s Islamic Revolutionary Guards Corps (IRGC) bypass U.S. sanctions.

Nobitex acknowledged the breach and said nearly $100 million had been transferred to “burn” wallets beyond recovery. “The situation is now under control,” the company said, denying regime ties and claiming to be a private business.

Chainalysis and Elliptic Confirm Regime Links

Crypto analytics firms Chainalysis and Elliptic independently confirmed the attack. Chainalysis labeled it “the first hack of this scale exclusively for geopolitical purposes.” Elliptic said the stolen funds were moved to wallets labeled with expletives and the acronym “IRGC,” making attribution clear.

Open-source data and Elliptic’s analysis linked Nobitex to figures close to Iran’s supreme leader Ayatollah Ali Khamenei and to IRGC operatives on the FBI’s most-wanted list for cybercrimes, including Ahmad Khatibi Aghda and Amir Hossein Nickaein Ravari. The platform also allegedly hosted wallets tied to the Houthis in Yemen and Hamas.

Broader Cyber Offensive Targets Regime Institutions

The Nobitex breach follows another cyberattack by Predatory Sparrow on Tuesday, targeting Bank Sepah—one of Iran’s oldest and most powerful financial institutions. The hackers accused the bank of helping the IRGC finance terrorism using public funds. Fars News Agency confirmed disruptions to online and ATM services amid the attack.

Internet access across Iran was also disrupted Wednesday, further complicating Nobitex’s recovery.

Predatory Sparrow: A Shadowy Force

Predatory Sparrow has claimed past high-profile cyberattacks, including disabling IRIB (Iran’s state broadcaster) and targeting Iranian infrastructure. The group’s logo has even appeared in opposition propaganda. A leaked document from a 2022 cyberattack in Albania—blamed on Iranian state actors—featured an eagle clutching Predatory Sparrow’s symbol inside a Star of David, fueling speculation of Israeli backing.

As physical and cyber warfare escalate between Israel and Iran, this breach adds a new digital front to the conflict.