Taking down two pillars of Iran’s financial infrastructure in a matter of hours, a hacker group known as Predatory Sparrow has executed one of the most damaging cyberattacks in recent memory in a rapid escalation of cyberwarfare between Israel and Iran.

The targets are Sepah Bank, a financial institution closely linked with the Iranian military, and Nobitex, the biggest bitcoin exchange in the nation.

This was about devastation, not only about breach and theft.

Blockchain analytics company Elliptic verified that the attack on Nobitex wiped off over $90 million worth of cryptocurrencies. Still, the money was not taken in a conventional sense. Rather, they were purposefully destroyed by being sent to so-called vanity wallets, digital addresses under personalized names like “FuckIRGCterrorists.”

“These addresses cannot be accessed again,” Elliptic co-founder Tom Robinson said. ” Sending money to them is essentially burning that money on demand. This was a political act of sabotage not a heist.

Predatory Sparrow asserted on social media that Nobitex was a “key regime tool,” allowing the Islamic Republic to violate international sanctions and direct crypto toward terrorist groups including Hamas, the Houthis, and Palestinian Islamic Jihad. Elliptic’s investigation confirmed that Nobitex and wallets connected to the elite military arm of the Iranian government, the IRGC, had links supporting that accusation.

Not long after the hack, the website of the crypto platform went dark. Nobitex officials have not yet responded or provided explanation, which leaves its users nervous—and maybe empty of their holdings.

Then Predatory Sparrow moved near Sepah Bank, as if doubling down on their message.

Known for close ties to Iran’s defense industry and the IRGC, Sepah Bank became the second target of the day. The hacker group claimed to have destroyed all internal bank data, and even released what it said were authentic internal documents showing Sepah’s cooperation with Iranian military and nuclear entities.

“Who’s next?” their message concluded in a familiar, menacing note.

The actual effect of the attack was instantaneous.

Hamid Kashfi, an Iranian cybersecurity specialist now living in Sweden, claims that ATMs and digital banking systems across Iran went down, particularly for customers of Sepah Bank. “The disturbance has been rather large,” he said. “People cannot even pay basic bills, access their pay, or make transfers.”

Eventually Sepah’s public-facing website returned online, but there is no indication that full operations have started once more. Furthermore fueling the conjecture is the silence among Iranian officials on the extent of the damage.

Predatory Sparrow has rocked Iran before this as well.

They turned off thousands of gas stations in 2021, resulting in a national shortfall. To further create mass confusion, the group also stole train station signs. Perhaps their most remarkable action, though, was in 2022 when they allegedly hacked the Khouzestan Steel Company, allegedly altering industrial control systems to spew molten steel on the factory floor, so igniting a fire and almost killing staff. The group even uploaded attack video.

Though they present themselves as a homegrown Iranian hacktivist movement—called Gonjeshke Darande—analyzers have long suspected the group serves as a front for Israeli military intelligence. Technical complexity, timing, and cautious aiming all point to state-level support.

“This goes beyond simply cyber disruption,” said Google’s threat intelligence division chief analyst John Hultquist. We are engaged in strategic warfare here. This group has the will to permanently harm important infrastructure as well as the capacity to do it.

The targets have symbolic meaning just as strong as their technical accomplishment.

Nobitex is Iran’s crypto lifeline, its workaround to the world banking system. Sepah Bank, meantime, stands for military financing and firmly established state authority.

Predatory Sparrow sent an unmissable signal by disabling both: none of Iran’s financial system is safe.