There has been major cyberattack targeting Iran’s largest cryptocurrency exchange, Nobitex, by a hacking group with strong links to Israel.
On Wednesday, hackers siphoned approximately $90 million from Nobitex, according to multiple independent blockchain analytics firms. The group behind the attack, known as Gonjeshke Darande or “Predatory Sparrow,”. This group is widely believed to be pro-Israel and has previously claimed responsibility for disruptive cyber operations against Iranian infrastructure.
In a post in Farsi on X, the hackers said that they had hit Iranian crypto exchange Nobitex, claiming that Iran used the exchange to skirt international sanctions. And in an extraordinary move, the hackers may have effectively thrown the stolen crypto away by transferring it to digital “wallets” that they don’t have control over, according to multiple cybersecurity experts.Nobitex acknowledged the incident in a statement on its website on Wednesday, saying that access to the crypto exchange had been “suspended,” as a precaution, until further notice. Crypto-tracking firms Elliptic and TRM Labs confirmed the crypto was stolen and sent to “wallets” or crypto accounts, with an expletive that referenced Iran’s Islamic Revolutionary Guard Corps (IRGC).
The hackers publicly announced their actions in a Farsi message on social media, stating that Nobitex was being targeted because it allegedly helped Iran evade international sanctions and supported the activities of the IRGC, which is designated as a terrorist organization by several Western countries.
Notably, the stolen cryptocurrency was not taken for financial gain, but essential relocated to an electronic “black hole“.
The vanity addresses used by the hackers are generated through “brute force” methods – involving the creation of large numbers of cryptographic key pairs until one contains the desired text. But creating vanity addresses with text strings as long as those used in this hack is computationally infeasible.This means that Predatory Sparrow would not have the private keys for the crypto addresses they sent the Nobitex funds to, and have effectively burned the funds* in order to send Nobitex a political message.
Gonjeshke Darande has hacked Iranian firms before, previously hitting gas stations and a steel mill.
Gonjeshke Darande is an established hacking group with a history of sophisticated cyberattacks targeting Iran. A 2021 operation claimed by the group caused widespread gas station outages, while a 2022 attack targeting an Iranian steel mill caused a large fire and tangible, offline damage.Israel has never formally acknowledged that it is behind the group, although Israeli media has widely reported Gonjeshke Darande as “Israel-linked.”Wednesday’s attack started in the early hours of the morning when funds were moved to hacker-controlled wallets denouncing the Islamic Revolutionary Guard Corps (IRGC), according to blockchain analysis firm TRM Labs, which pegged the total theft at about $90 million across multiple types of cryptocurrencies.
In addition to the Nobitex attack, Gonjeshke Darande also claimed responsibility for a cyberattack on Iran’s state-owned Bank Sepah the previous day, where they allegedly erased data and disrupted banking services.
The bank’s website was offline on Tuesday and its London-based subsidiary, Bank Sepah International plc, did not immediately respond to an emailed request for comment.Customers were having problems accessing their accounts, according to Israeli media.Gonjeshke Darande did not respond to multiple messages sent via social media.“Disrupting the availability of this bank’s funds, or triggering a broader collapse of trust in Iranian banks, could have major impacts there,” Rob Joyce, the former top cybersecurity official at the NSA, said in a post on X.
Iranians at home and abroad are reporting major disruptions to banking and internet services.
The bank’s website and mobile services remain inaccessible. Users reported Sepah cards are all non-functional, with some ATMs across Tehran and other provinces out of cash.Despite official denials, users across the country told Iran International that major banks, including Melli, Pasargad, and Eghtesad-e Novin, are also facing service failures.“I’ve visited ten ATMs today,” said one man in Tehran. “None had any cash.”
I sure hope our government officials are paying attention to the importance of cybersecurity.
Image by perplexity.ai.
CLICK HERE FOR FULL VERSION OF THIS STORY