INCIDENT REPORT · CP-2025-009
Predatory Sparrow attacks on Bank Sepah and Nobitex
L3 · ELEVATEDREPORTED
During the June 2025 Israel-Iran war, the group Predatory Sparrow (Gonjeshke Darande) claimed a data-destroying attack on state-owned Bank Sepah, then on 18 June drained Iran's largest crypto exchange, Nobitex, sending funds to unspendable addresses.
- Incident ID
- CP-2025-009
- Incident date
- 17 JUN 2025
- Detection date
- 17 JUN 2025
- Affected countries
- Iran
- Plotted location
- Tehran, Iran (Affected organizations headquarters)
- Threat classification
- Level 3 — ELEVATED
- Classification rationale
- Destructive wartime attacks on a state bank and the national crypto exchange.
- Attack type
- Wiper / Destructive Malware
- Nature
- Malicious activity
- Attack vector
- Not publicly documented
- Sectors
- Finance
- Critical infrastructure
- Yes
- Organizations affected
- Bank Sepah, Nobitex
- Operational consequences
- Bank Sepah services and website were disrupted and some branches closed, while Elliptic traced over $90 million sent from Nobitex wallets to attacker-controlled burn addresses; Nobitex source code was later leaked.
- Estimated financial impact
- Elliptic (blockchain analytics firm, not victim or official body) traced more than $90 million taken from Nobitex.
- Attribution (as stated)
- Claimed by Predatory Sparrow (Gonjeshke Darande), a group widely reported to be linked to Israel; no official government attribution
SOURCE REFERENCES
- [1] Iranian crypto exchange Nobitex hacked for over $90 million by pro-Israel groupElliptic · elliptic.co · 18 JUN 2025
- [2] Pro-Israel hackers claim attack on Iranian bankThe Record · therecord.media · 17 JUN 2025
- [3] Predatory Sparrow burns $90 million on Iranian crypto exchange in cyber shadow warSecurityWeek · securityweek.com
RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.