Overview

• Predatory Sparrow claimed a June 18 hack of Nobitex that siphoned over $90 million in cryptocurrencies and transferred them to vanity addresses that effectively destroyed the assets.
• The group accused Nobitex of aiding sanctions evasion and terror financing by Iran’s IRGC, embedding anti-IRGC messages in the destroyed wallet addresses to underscore their political motive.
• Blockchain analytics firms Elliptic and TRM Labs corroborated the theft and identified past transfers between Nobitex and wallets tied to the IRGC as well as Hamas and the Houthis.
• On June 17, Predatory Sparrow also struck Iran’s state-owned Bank Sepah, crippling ATMs and erasing data before warning it would leak Nobitex’s source code and internal data within 24 hours.
• Nobitex responded by pulling its platform offline, assuring customers that most funds in cold wallets were unaffected and promising full reimbursement for any losses while investigations continue.