- calendar_today September 3, 2025
Hacker group Predatory Sparrow executed two coordinated attacks this week, crippling the biggest cryptocurrency platform in Iran and severely damaging a bank connected to the Iranian military in a blatant cyberoffensive shocking both civilian and military sectors in Iran.
Targeting two financial behemoths reflecting Iran’s attempts to survive international sanctions and retain domestic control, the painstakingly executed and profoundly symbolic attacks aimed at Nobitex and Sepah Bank
Let us break out what happened.
Predatory Sparrow not only broke the system but also destroyed over $90 million in digital assets at Nobitex. These were not laundered or quietly taken. Rather, they were directed to custom crypto addresses under names like “FuckIRGCterrorists,” addresses devoid of recovery and return.
“These are what we refer to as vanity addresses,” co-founder of Elliptic, the blockchain company that found the transactions Tom Robinson said. ” Sending money there is a decision to burn them deliberately. This is financial execution, not theft.
On X, formerly Twitter, the hacker group claimed Nobitex was providing a means of financing terrorism and sanctions avoidance. They linked the trade to wallets belonging to Hamas, the Houthis, the Islamic Revolutionary Guard Corps (IRGC), and Elliptic verified several of these correlations using its own trace-analysis.
Soon after the attack, the website of the exchange went dark. There have been no official comments, which leaves consumers perplexed and worried about their money as well as their digital security.
Just hours later, Predatory Sparrow claimed to have also hacked Sepah Bank, one of Iran’s most established financial institutions. The hackers claimed that internal bank data was totally erased. They also uploaded internal records claiming Sepah’s participation in Iran’s nuclear and missile programs under IRGC direction.
“Who’s next?” the sharp message asked.
Based in Sweden, cybersecurity specialist Hamid Kashfi noted that Sepah’s ATMs and online systems have not been operating since the attacks. “It is influencing daily life,” he said. People cannot pay bills, take money out, or make transfers. Not just digital noise, but actual anarchy.
The main website of Sepah Bank returned online temporarily, but several backend systems still show no response. Iranian officials have not responded to press questions or the assertions made by the group.
Predatory Sparrow, sometimes known by its Farsi name Gonjeshke Darande, has a well-documented history of cybercrime in Iran. Following takeover of industrial control systems, the group disabled thousands of fuel stations, hacked railway systems, and even set fire at a steel mill. Later on, the group itself posted video of that attack online.
Although the group says it reflects local resistance, foreign experts think Predatory Sparrow is most likely an Israeli-backed cyberunit. Their campaigns’ sophistication, timing, and precision point to nation-state participation.
“This is not hacktivism. Leading cyberthreat analyst John Hultquist of Google’s Mandiant said this is intelligence-backed, coordinated cyberwarfare. “And they’re aiming for high-value systems with most strategic impact.”
The choice of Sepah Bank and Nobitex exposes a clear trend: these are tools of state survival, not only financial ones.
Nobitex let Iran use cryptocurrency to get around banking limits. Sepah Bank funded initiatives the government depends on for regional power and deterrent based on money flow.
Striking both, Predatory Sparrow not only caused financial damage but also compromised the infrastructure Iran depends on to withstand world pressure.
And given their last line, “Caution: working with the regime’s tools may end in loss,” the group appears to be just starting.
