Iran’s largest cryptocurrency exchange, Nobitex, was hacked for more than $90 million Wednesday, according to blockchain analytics firm Elliptic.
The funds were drained from platform wallets into addresses bearing anti-government messages explicitly referencing Iran’s Islamic Revolutionary Guard Corps, or IRGC, pointing to a politically motivated cyberattack, Elliptic said.
Blockchain research firm Chainalysis said the stolen crypto included bitcoin, ethereum, doge, ripple, solana, tron, and ton.
Pro-Israel hacking group Gonjeshke Darande, or “Predatory Sparrow,” claimed responsibility for the attack and said it would release the exchange’s source code. Elliptic said the exchange was offline at the time of its post.
Predatory Sparrow also claimed credit for a separate cyberattack on Iran’s state-owned Bank Sepah this week.
Fighting erupted between Israel and Iran on Friday and the countries have continued to trade missile fire. Iran Supreme Leader Ayatollah Ali Khamenei threatened the U.S. with “irreparable damage” Wednesday in response to President Donald Trump’s demand that the country surrender.
Though the stolen assets have not been conclusively attributed to the group, both Elliptic and Chainalysis said the funds were sent to burner wallets — cryptographic addresses the hackers likely can’t access — strongly suggesting the money was intentionally destroyed, not stolen for profit.
“The motive for stealing the $90+ million in funds is for other than financial gain,” said Andrew Fierman, head of national security intelligence at Chainalysis, noting the lack of access to the burner accounts by the hackers.
Fierman added that this kind of symbolic, destructive attack shows how crypto infrastructure is becoming a new front in modern geopolitical conflict. And while Iran’s digital asset market is modest in size, the scale and message of this hack make clear that even smaller, regional platforms can become strategic targets.
Elliptic’s research linked the Nobitex exchange to the IRGC, a powerful branch of the Iranian military designated as a terrorist organization by the United States, United Kingdom, European Union and Canada.
Past investigations have connected the platform to sanctioned IRGC-linked ransomware operatives and individuals close to Khamenei.
Blockchain data also shows activity between the Nobitex exchange and wallets associated with Hamas, Palestinian Islamic Jihad, and the Houthis.
Elliptic said it’s continuing to monitor virtual asset flows tied to Iranian entities and has updated its compliance tools to reflect emerging threats in the region’s crypto ecosystem.
