Iran\u2019s financial sector takes another hit as largest crypto exchange is targeted | CyberScoop<\/title> <meta name=\"description\" content=\"A $90 million crypto theft from Nobitex marks the second cyberattack on Iran\u2019s financial systems in as many days. Predatory Sparrow claimed responsibility for both attacks.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/iran-nobitex-cyberattack-predatory-sparrow\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Iran\u2019s financial sector takes another hit as largest crypto exchange is targeted\"> <meta property=\"og:description\" content=\"A $90 million crypto theft from Nobitex marks the second cyberattack on Iran\u2019s financial systems in as many days. Predatory Sparrow claimed responsibility for both attacks.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/iran-nobitex-cyberattack-predatory-sparrow\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\"> <meta property=\"article:published_time\" content=\"2025-06-18T17:29:41+00:00\"> <meta property=\"article:modified_time\" content=\"2025-06-18T17:29:44+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/irans-financial-sector-takes-another-hit-as-largest-crypto-exchange-is-targeted-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1280\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Matt Kapko\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@CyberScoopNews\"> <meta name=\"twitter:site\" content=\"@CyberScoopNews\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1746040294g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1750115417g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1748220166g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=13897d660a0ac2c9c7d1\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/84944\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.8.1\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=84944\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Firan-nobitex-cyberattack-predatory-sparrow%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Firan-nobitex-cyberattack-predatory-sparrow%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"wp-singular post-template-default single single-post postid-84944 single-format-standard wp-theme-scoopnewsgroup wp-child-theme-cyberscoop\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/iran-nobitex-cyberattack-predatory-sparrow\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"4.9180327868852\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Voting is open for the 2025 CyberScoop 50 awards!<\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.511545293073\">\n<div class=\"single-article__header-content\" readability=\"34.323725055432\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/iran-nobitex-cyberattack-predatory-sparrow\/\"> <span>Geopolitics<\/span> <\/a> <\/li>\n<\/ul>\n<p> A $90 million crypto theft from Nobitex marks the second cyberattack on Iran\u2019s financial systems in as many days. Predatory Sparrow claimed responsibility for both attacks. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/84944\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/irans-financial-sector-takes-another-hit-as-largest-crypto-exchange-is-targeted.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt=\"Iranian flag waving with cityscape on background in Tehran, Iran. (Sir Francis Canker Photography\/Getty Images)\" decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/irans-financial-sector-takes-another-hit-as-largest-crypto-exchange-is-targeted-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/irans-financial-sector-takes-another-hit-as-largest-crypto-exchange-is-targeted-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/irans-financial-sector-takes-another-hit-as-largest-crypto-exchange-is-targeted-2.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/irans-financial-sector-takes-another-hit-as-largest-crypto-exchange-is-targeted-2.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/irans-financial-sector-takes-another-hit-as-largest-crypto-exchange-is-targeted-2.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/irans-financial-sector-takes-another-hit-as-largest-crypto-exchange-is-targeted-2.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/irans-financial-sector-takes-another-hit-as-largest-crypto-exchange-is-targeted-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/irans-financial-sector-takes-another-hit-as-largest-crypto-exchange-is-targeted-2.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/irans-financial-sector-takes-another-hit-as-largest-crypto-exchange-is-targeted-2.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/irans-financial-sector-takes-another-hit-as-largest-crypto-exchange-is-targeted-2.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> Iranian flag waving with cityscape on background in Tehran, Iran. (Sir Francis Canker Photography\/Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"32.519576096556\"><body readability=\"66.075871496924\"><\/p>\n<p>Cyberattacks targeting Iran\u2019s financial sector widened Wednesday, as a pro-Israel hacktivist group stole more than $90 million from Nobitex, the country\u2019s largest cryptocurrency exchange. The attack marks the second attack on Iran\u2019s financial systems in as many days. <\/p>\n<p>Predatory Sparrow, the group that self identifies as Gonjeshe Darande in Persian, claimed responsibility for the attack on Nobitex in a <a href=\"https:\/\/x.com\/GonjeshkeDarand\/status\/1935231018937536681\">social media post<\/a> early Wednesday. Less than 24 hours prior, the hacktivist group said it <a href=\"https:\/\/cyberscoop.com\/iran-bank-sepah-cyberattack\/\">attacked the Iran state-owned Bank Sepah<\/a>, resulting in service disruptions.<\/p>\n<p>Researchers at Elliptic, a blockchain analytics firm, confirmed <a href=\"https:\/\/www.elliptic.co\/blog\/iranian-crypto-exchange-nobitex-hacked-pro-israel-group\">more than $90 million was transferred from Nobitex<\/a> to multiple vanity addresses all containing some variation of \u201cF\u2013kIRGCterrorists\u201d within their public key. IRGC is the acronym for the Islamic Revolutionary Guard Corps, the Iranian military branch under the control of Ayatollah Ali Khamenei, Iran\u2019s supreme leader. <\/p>\n<p>In the social media post, the group said the \u201ccyberattacks are the result of Nobitex being a key regime tool for financing terrorism and violating sanctions.\u201d Predatory Sparrow, which previously claimed attacks on steel mills in Iran, the country\u2019s rail system network and gas station payment systems, also threatened to leak Nobitex\u2019s source code and internal information about its network by Thursday morning. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The attack on Nobitex could pose far-reaching financial consequences for the Iranian regime. <\/p>\n<p>\u201cI\u2019m not aware of any larger thefts of crypto from Iran-based exchanges,\u201d Tom Robinson, co-founder and chief scientist at Elliptic, said in an email. \u201cIran has been experimenting with crypto as a means of evading sanctions for a number of years. As Iran\u2019s largest crypto exchange, Nobitex is key to that strategy.\u201d<\/p>\n<p>Elliptic researchers noted that the vanity addresses hackers transferred the crypto funds to were generated through brute force methods, including large numbers of cryptographic key pairs.<\/p>\n<p>\u201cCreating vanity addresses with text strings as long as those used in this hack is computationally infeasible,\u201d Elliptic said in a blog post. \u201cThis means that Predatory Sparrow would not have the private keys for the crypto addresses they sent the Nobitex funds to, and have effectively burned the funds in order to send Nobitex a political message.\u201d<\/p>\n<p>Nobitex\u2019s website is currently offline. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Iran\u2019s government on Monday confirmed it was reducing internet speeds to ward off cyberattacks, but that didn\u2019t prevent the ensuing attacks on Bank Sepah and Nobitex.<\/p>\n<p>Iran government spokesperson Fatemeh Mohajerani said in a <a href=\"https:\/\/x.com\/Digiato\/status\/1934561401185432046\">social media post<\/a> Monday that the speed reduction is \u201ctemporary, targeted and controlled.\u201d She added that the country\u2019s stock market is also closed. The website for the Tehran Stock Exchange, the country\u2019s largest stock exchange, is also currently offline.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"3.8202127659574\">\n<div class=\"author-card\" readability=\"14\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/06\/irans-financial-sector-takes-another-hit-as-largest-crypto-exchange-is-targeted-1.jpg?w=640&ssl=1\" alt=\"Matt Kapko\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Matt Kapko<\/h4>\n<p> Matt Kapko is a reporter at CyberScoop. His beat includes cybercrime, ransomware, software defects and vulnerability (mis)management. The lifelong Californian started his journalism career in 2001 with previous stops at Cybersecurity Dive, CIO, SDxCentral and RCR Wireless News. Matt has a degree in journalism and history from Humboldt State University. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/iran-nobitex-cyberattack-predatory-sparrow\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Iran\u2019s financial sector takes another hit as largest crypto exchange<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[2701,337,78,1982,679,302,353,1965,513,1240,514],"tags":[2704,340,86,1984,680,306,357,1966,517,1242,518],"class_list":["post-7745","post","type-post","status-publish","format-standard","hentry","category-crypto","category-cryptocurrency","category-cybersecurity","category-finance","category-financial","category-geopolitics","category-hacktivism","category-hacktivists","category-iran","category-irgc","category-israel","tag-crypto","tag-cryptocurrency","tag-cybersecurity","tag-finance","tag-financial","tag-geopolitics","tag-hacktivism","tag-hacktivists","tag-iran","tag-irgc","tag-israel"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/crypto\/\" rel=\"category tag\">crypto<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cryptocurrency\/\" rel=\"category tag\">cryptocurrency<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/finance\/\" rel=\"category tag\">finance<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/financial\/\" rel=\"category tag\">Financial<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/geopolitics\/\" rel=\"category tag\">Geopolitics<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/hacktivism\/\" rel=\"category tag\">hacktivism<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/hacktivists\/\" rel=\"category tag\">hacktivists<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/iran\/\" rel=\"category tag\">Iran<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/irgc\/\" rel=\"category tag\">IRGC<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/israel\/\" rel=\"category tag\">Israel<\/a>","tag_info":"Israel","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7745","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=7745"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7745\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=7745"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=7745"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=7745"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":7745,"date":"2025-06-18T12:29:41","date_gmt":"2025-06-18T17:29:41","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=84944"},"modified":"2025-06-18T12:29:41","modified_gmt":"2025-06-18T17:29:41","slug":"irans-financial-sector-takes-another-hit-as-largest-crypto-exchange-is-targeted","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/06\/18\/irans-financial-sector-takes-another-hit-as-largest-crypto-exchange-is-targeted\/","title":{"rendered":"Iran\u2019s financial sector takes another hit as largest crypto exchange is targeted"},"content":{"rendered":"