Iran’s largest cryptocurrency exchange, Nobitex, suffered a $100 million theft in a cyberattack claimed by the pro-Israeli hacker group Predatory Sparrow. The breach involved several cryptocurrencies, including Bitcoin, Ethereum, and Dogecoin.
Following the attack, Iranian authorities imposed a near nationwide internet blackout that persisted into Thursday, aiming to limit public access during the cyber incident. According to Iran’s Ministry of Communications, the restrictions stem from the investigation of unauthorized access to Nobitex’s systems.
Predatory Sparrow accused Nobitex of assisting Tehran in evading Western sanctions and funneling funds to Iran’s nuclear program. The group announced on Telegram that “assets left in Nobitex are now entirely out in the open.” Nobitex has not publicly confirmed the hack but temporarily shut down its app and website to analyze the breach.
Andrew Fierman, head of national security intelligence at Chainalysis, described the attack as significant due to the relatively small size of Iran’s cryptocurrency market.
Predatory Sparrow has previously claimed responsibility for major cyberattacks in Iran, including a 2021 hack disrupting gas stations and a 2022 attack causing a fire at a steel mill. While Israel has praised these operations and hinted at connections with the group, it has not officially acknowledged any involvement.
Netblock, a firm tracking global internet usage, reported that the current internet blackout in Iran is the most severe since the civil unrest protests of 2019.