While Tehran slept, digital chaos erupted. On June 18, 2025, just after 6 a.m. local time, hackers targeted Nobitex, Iran’s largest cryptocurrency exchange, making off with nearly $90 million in digital assets. But this wasn’t your average crypto heist.
The group behind the attack, Gonjeshke Darande (meaning “Predatory Sparrow”), promptly claimed responsibility. They’ve got reported ties to Israel, and boy, did they make those connections obvious. Rather than quietly pocketing the funds, they sent everything to specially created “vanity” blockchain addresses embedded with the phrase “F*ckIRGCterrorists.” Subtle, right?
The hackers sent a $90 million message to Tehran, flashing “F*ckIRGCterrorists” across the blockchain like digital graffiti.
Here’s the kicker – those vanity addresses aren’t just for show. Creating them with such extended text is computationally impossible for practical use. Translation: the money’s gone forever. Burned. Kaput.
The timing wasn’t coincidental. The hack came amid heightened Israel-Iran tensions following Israeli operations against Iranian military targets earlier that month. Just one day before, the same group had attacked Iran’s Bank Sepah. Smoke was seen rising over Tehran as Israeli missile strikes targeted key facilities during this escalating conflict. They weren’t after money – they were sending a message.
Nobitex’s website went dark immediately after the attack. Users panicked. The exchange had been hit across multiple blockchains – TRON, Ethereum, Bitcoin, and over 100 other cryptocurrencies. Not a single coin has moved from those exploit addresses since. Many affected users could have prevented losses by using hardware wallets to maintain control of their private keys offline.
The fallout was swift. Iran’s crypto sector destabilized. Multiple exchanges restricted operations. The Central Bank of Iran imposed new restrictions, mandating nightly closures of Toman/Tether trading markets.
Predatory Sparrow claimed the attack was retaliation for Nobitex’s alleged involvement in regime financing and sanctions evasion. This sophisticated operation used structured transactions on the TRON blockchain to systematically funnel funds away from Nobitex. They publicly warned Nobitex beforehand, even threatening to release the exchange’s source code.
The hack demonstrated the vulnerability of financial platforms in geopolitically sensitive regions. For Nobitex’s users, the message was expensive – $90 million expensive. And for Iran’s crypto community? Trust shattered at the speed of a blockchain transaction.
