Pro-Israel Hackers Steal $90 Million In Iranian Crypto Heist, Then Lose All

A pro-Israel hacking group on Wednesday drained over $90 million worth of cryptocurrency from an Iranian exchange. But multiple crypto tracking firms believe that Gonjeshke Darande, or 'Predatory Sparrow' in Farsi, lost all of the proceeds from the heist after reportedly “burning” them in the process.

The funds are now inaccessible after they were stored in “vanity addresses” for which they do not have the cryptographic keys, The Guardian reported.

On June 18, the group said it hacked the Nobitex exchange, a day after claiming they destroyed data at Iran's state-owned Bank Sepah amid escalating tensions between Israel and the Islamic Republic.

Cryptocurrencies such as Doge, Ethereum and Bitcoin were taken from digital wallets on the Iranian exchange Nobitex, which has been connected to the Islamic Revolutionary Guard Corps.

According to crypto tracking firm Elliptic, over $90 million in cryptocurrency was transferred from Nobitex crypto wallets to hacker addresses.

The stolen funds were routed to addresses containing some variation of the term “F*ckIRGCterrorists”. In a social media post on X, Predatory Sparrow confirmed that it had targeted Nobitex and later released its source code.

“Predatory Sparrow would not have the private keys for the crypto addresses they sent the Nobitex funds to, and have effectively burned the funds in order to send Nobitex a political message,” Elliptic said.

Predatory Sparrow is frequently reported in Israeli media as having Israeli connections, although there has been no official proof of the hackers' identity or nationality. “Although there is no confirmation yet that the funds were moved by Predatory Sparrow, the hack appears to be motivated by the recent escalation of tensions between Israel and Iran,” Elliptic added.

Nobitex claims to have over 7 million users and is Iran's main cryptocurrency exchange. Past investigations by independent reporters have revealed linkages between Nobitex and IRGC-linked ransomware operatives and individuals close to Iran's Supreme Leader, Ali Khamenei.

The attack occurred amid growing tensions between Israel and Iran, with the two countries exchanging missile strikes, targeting crucial military installations.

On Thursday, the US said it would wait for another two weeks before getting directly involved in the conflict, while Russia warned Israel against targeting the Bushehr nuclear power plant.

Earlier, President Donald Trump said his patience was running out with Iran. He issued threats to Supreme Leader Ayatollah Ali Khamenei, who then hit back, saying any intervention from the US would result in “irreparable damage.”