Israeli-Linked Predatory Sparrow Destroys Data at IRGC-Linked Bank Sepah, Steals $90 Million and Wipes 95% Assets at Nobitex Crypto Exchange

The Israeli-linked hacker group Predatory Sparrow (Gonjeshke Darande) has claimed responsibility for a series of cyberattacks targeting major Iranian financial institutions. On June 17, 2025, the group announced it destroyed the entire data infrastructure of Bank Sepah, one of Iran's oldest banks affiliated with the Islamic Revolutionary Guard Corps (IRGC) and the Iranian Army. This attack caused a nationwide IT failure, disrupting all online services, including ATM access, mobile and internet banking, and branch operations, leaving customers unable to access their accounts or withdraw funds. Bank Sepah is reported to have supported the IRGC's missile and nuclear programs and financed proxy forces in the Middle East.

Following the attack, the bank was offline for several days but reconnected to Iran’s national banking network by June 21. Subsequently, on June 18, Predatory Sparrow also targeted Nobitex, Iran’s largest cryptocurrency exchange, stealing between $81.7 million and over $90 million in digital assets including Bitcoin, Ethereum, Tron, and Dogecoin. The group claimed that Nobitex was used by the Iranian regime to evade international sanctions and finance terrorism. The attack on Nobitex resulted in the loss of approximately 95% of the exchange's assets, with wallet holdings dropping from $1.8 billion to about $100 million. Predatory Sparrow has threatened to release Nobitex’s internal data and source code within 24 hours of the attack. These cyber operations are part of a broader campaign by the group, which has previously claimed responsibility for attacks on Iranian infrastructure such as fuel pumps and steel factories.