---
title: "Cyberattacks on Bank Sepah and Nobitex"
description: "A hacking group called Predatory Sparrow claimed attacks on Bank Sepah and the Nobitex cryptocurrency exchange in June 2025. Blockchain analytics firms traced more than $90 million from Nobitex wallets to addresses used in the attack."
url: "https://hasbara.co.il/resources/the-12-day-war-us-israel-strikes-on-irans-nuclear-sites-2025/cyber-warfare-targeting-bank-sepah-and-nobitex-exchange"
type: "resource-page"
locale: "en"
categories: ["The 12-Day War: US-Israel Strikes on Iran's Nuclear Sites 2025"]
---

# Cyberattacks on Bank Sepah and Nobitex

*A hacking group called Predatory Sparrow claimed attacks on Bank Sepah and the Nobitex cryptocurrency exchange in June 2025. Blockchain analytics firms traced more than $90 million from Nobitex wallets to addresses used in the attack.*

In June 2025, the hacking group Gonjeshke Darande, also known as Predatory Sparrow, claimed cyberattacks on Iran’s Bank Sepah and cryptocurrency exchange Nobitex. The group said it hacked Bank Sepah on June 17 and warned Nobitex users to withdraw assets before releasing internal data. Blockchain analytics firm Elliptic traced more than $90 million from Nobitex wallets to addresses used in the attack.

## What happened at Bank Sepah

Predatory Sparrow announced that Bank Sepah had been hacked. Bank Sepah is an Iranian bank with ties to the country’s military institutions. The Times of Israel reported that the bank’s services remained available, while blockchain analytics firm TRM Labs said the attack disrupted services. Predatory Sparrow also said it destroyed IRGC data. See the [June 18 report](https://www.timesofisrael.com/liveblog_entry/hacking-group-tied-to-israel-claims-to-have-carried-out-cyberattack-on-iranian-cryptocurrency-exchange-company/) and [TRM Labs’ incident analysis](https://www.trmlabs.com/resources/blog/irans-largest-cryptocurrency-exchange-targeted-in-90m-hack).

## What happened at Nobitex

On June 18, the group said it would publish Nobitex’s source code and internal network information within 24 hours, and warned customers that remaining assets were at risk. It posted screenshots it said showed tens of millions of dollars in crypto assets had been seized.

Nobitex is an Iranian cryptocurrency exchange. Predatory Sparrow accused it of helping the regime evade sanctions and finance terror. Elliptic identified more than $90 million transferred from Nobitex wallets to hacker addresses and said the destinations appeared to render the funds inaccessible. TRM Labs traced nearly $90 million across several blockchains. See [Elliptic’s blockchain analysis](https://www.elliptic.co/insights/iranian-crypto-exchange-nobitex-hacked-pro-israel-group/).

## Cyberattacks during the June fighting

Predatory Sparrow publicly targeted Iranian financial and digital infrastructure during the fighting. Israel did not publicly claim responsibility; the Times of Israel noted Israel’s policy of ambiguity around cyber operations.

Cyberattacks formed one strand of the June conflict, alongside missile attacks and strikes on military and nuclear facilities. For the wider campaign timeline, see [Operation Rising Lion](https://hasbara.co.il/resources/the-12-day-war-us-israel-strikes-on-irans-nuclear-sites-2025/operation-rising-lion-inside-israel-s-air-campaign).

## Pages

- [Iran’s nuclear program and the June 2025 IAEA finding](/resources/the-12-day-war-us-israel-strikes-on-irans-nuclear-sites-2025/iran-s-2025-nuclear-escalation-and-the-iaea-resolution.md)
- [Operation Rising Lion: Israel’s air campaign and command strikes](/resources/the-12-day-war-us-israel-strikes-on-irans-nuclear-sites-2025/operation-rising-lion-inside-israel-s-air-campaign.md)
- [Mossad operations and the targeting of Iran’s nuclear scientists](/resources/the-12-day-war-us-israel-strikes-on-irans-nuclear-sites-2025/operation-narnia-decapitating-iran-s-nuclear-brain-trust.md)
- [Operation Midnight Hammer: US strikes and damage assessments](/resources/the-12-day-war-us-israel-strikes-on-irans-nuclear-sites-2025/joint-strike-neutralizes-iran-s-hardened-nuclear-facilities.md)
- [Iranian missile attacks, Israel’s defenses and civilian protection](/resources/the-12-day-war-us-israel-strikes-on-irans-nuclear-sites-2025/iranian-missile-assaults-and-israel-s-civil-defense-shield.md)

## Sources

- [timesofisrael.com](https://www.timesofisrael.com/liveblog_entry/hacking-group-tied-to-israel-claims-to-have-carried-out-cyberattack-on-iranian-cryptocurrency-exchange-company/)
- [elliptic.co](https://www.elliptic.co/insights/iranian-crypto-exchange-nobitex-hacked-pro-israel-group/)
- [trmlabs.com](https://www.trmlabs.com/resources/blog/irans-largest-cryptocurrency-exchange-targeted-in-90m-hack)