In June 2025, the hacking group Gonjeshke Darande, also known as Predatory Sparrow, claimed cyberattacks on Iran’s Bank Sepah and cryptocurrency exchange Nobitex. The group said it hacked Bank Sepah on June 17 and warned Nobitex users to withdraw assets before releasing internal data. Blockchain analytics firm Elliptic traced more than $90 million from Nobitex wallets to addresses used in the attack.
What happened at Bank Sepah
Predatory Sparrow announced that Bank Sepah had been hacked. Bank Sepah is an Iranian bank with ties to the country’s military institutions. The Times of Israel reported that the bank’s services remained available, while blockchain analytics firm TRM Labs said the attack disrupted services. Predatory Sparrow also said it destroyed IRGC data. See the June 18 report and TRM Labs’ incident analysis.
What happened at Nobitex
On June 18, the group said it would publish Nobitex’s source code and internal network information within 24 hours, and warned customers that remaining assets were at risk. It posted screenshots it said showed tens of millions of dollars in crypto assets had been seized.
Nobitex is an Iranian cryptocurrency exchange. Predatory Sparrow accused it of helping the regime evade sanctions and finance terror. Elliptic identified more than $90 million transferred from Nobitex wallets to hacker addresses and said the destinations appeared to render the funds inaccessible. TRM Labs traced nearly $90 million across several blockchains. See Elliptic’s blockchain analysis.
Cyberattacks during the June fighting
Predatory Sparrow publicly targeted Iranian financial and digital infrastructure during the fighting. Israel did not publicly claim responsibility; the Times of Israel noted Israel’s policy of ambiguity around cyber operations.
Cyberattacks formed one strand of the June conflict, alongside missile attacks and strikes on military and nuclear facilities. For the wider campaign timeline, see Operation Rising Lion.