Massive Cyberattack Hits Iran’s Largest Crypto Exchange, $90 Million Destroyed

In one of the most damaging cyberattacks in Iran’s recent history, hackers have destroyed nearly $90 million in cryptocurrency from Nobitex, the country’s biggest crypto exchange. The group behind the attack, called Gonjeshke Darande (also known as Predatory Sparrow), is widely believed to be an Israeli state-backed operation posing as an Iranian opposition group.

The hackers deliberately sent the stolen funds to fake wallets that included a shocking message: “FuckiRGCTerroristsNoBiTE.” This was clearly not about money — it was a political move. The group accused Nobitex of helping the Iranian government and the Islamic Revolutionary Guard Corps (IRGC) bypass international sanctions.

The attack happened shortly after Israeli airstrikes on Iranian military and nuclear sites on June 13, hinting at a connection between the two events. Experts say the cyberattack was well-planned and likely involved access to Nobitex's internal systems long before the hack.

To make things worse, the hackers also leaked Nobitex’s full source code, internal files, wallet scripts, and backend configurations on Telegram. Screenshots shared by the group suggest deep access to the company’s systems — possibly through stolen passwords or even help from someone inside, although this hasn’t been confirmed.

Nobitex admitted its hot wallet was compromised, but says its cold wallets (offline storage) remain safe. The company shut down parts of its system to stop further damage and promised a gradual return to service in the next few days. However, widespread internet slowdowns in Iran are delaying the process.

The attack wasn’t just technical — it was symbolic. By burning millions and calling Nobitex a tool for terrorism financing, the hackers aim to damage public trust in Iran’s financial systems. This fits the group’s past behavior. Predatory Sparrow has previously attacked Iranian railways, steel mills, and most recently Bank Sepah, always at moments of high political tension.

Cybersecurity experts warn this attack shows how powerful digital warfare has become — especially when it targets financial systems like crypto exchanges. These platforms are seen as neutral and secure, but in a politically unstable region, they can become dangerous battlegrounds.

If confirmed to be a state-sponsored Israeli operation, this marks a serious escalation in cyberwar tactics — using digital assets not only to cause damage but to send a clear political message.

Experts believe more attacks like this could be coming, especially as tensions rise in the Middle East. They urge crypto companies and financial institutions to step up their security to defend against these kinds of threats.