Just now, the hacker group Predatory Sparrow made their most damaging action in the expanding digital battleground between Israel and Iran. This time, they set fire to Iran’s financial backbone, not only bringing disturbance.

Often under Farsi, Gonjeshke Darande, the group claimed two high-profile cyberattacks on Wednesday. First, on Iran’s largest cryptocurrency exchange, Nobitex, deliberate crypto destruction of over $90 million worth came of result. Not taken from anywhere. Not displaced. simply burned.

They struck once more hours later, this time aiming at Sepah Bank, a big financial institution connected to the Iranian military.

This operation is remarkable for reasons other than only scale. The approach is this. Predatory Sparrow sent Nobitex’s digital assets to crypto wallets under names like “FuckIRGCterrorists,” not cash. These are not your typical wallets. Often unrecoverable, vanity addresses—created to convey a message rather than store value—are called In this instance, the message was quite clear: this is political, not business.

The group claimed in a statement posted to their X account that Nobitex was supporting terror financing and sanctions breaking. Users linking with platforms connected to governments run the danger of losing everything.

Leading blockchain forensic company Elliptic confirmed the breaches. Their research revealed that Nobitex connected approved people and organizations including IRGC agents, Hamas, and the Houthi rebels in Yemen.

The co-founder of Elliptic, Tom Robinson, claims that this level of destruction of crypto assets is unheard of. “The crypto they stole has essentially been burned,” he said. “That is an act of sabotage.”

The digital assault did not stop there, though.

Claiming ties to Iran’s Islamic Revolutionary Guard Corps, Predatory Sparrow claimed to have erased all information from Sepah Bank. They uploaded supposedly supporting documentation, some looking to show military contracts.

Their message along with the attack seems more like a cyberwar declaration: “Your long-term financial situation suffers if you assist the regime in avoiding sanctions and funding its ballistic missiles and nuclear program. Who comes next?

Sepah momentarily lost access to his website. As of the last update, Nobitex’s website still was down. Neither business has responded in public.

People are experiencing it on the ground in Iran.

Iranian cybersecurity specialist Hamid Kashfi, who now resides in Sweden, claims ATMs connected to Sepah Bank and online banking systems have stopped working. According to Kashfi, a lot of collateral damage has occurred. “They’re focusing on infrastructure millions of people depend on as well.”

Predatory Sparrow is not new in aggressive attacks.

• They have dismantled Iran’s national railway system in past years.
• Disabled fuel pumps at many thousands of petrol stations.
• Use the control systems of a steel mill to set fire to it.

That last one particularly startled me. Over the factory floor, a molten steel vat spilled. Video uploaded by the hackers themselves depicted the incident nearly killing plant workers.

Although the group bills itself as an Iranian resistance movement, cybersecurity analysts think they have ties to Israeli intelligence. Traits hardly found in most hacktivist groups, their actions are exact, coordinated, and meticulously planned.

Why then the sudden attention on Iran’s financial system?

Some analysts, such as John Hultquist of Google’s threat intelligence division, speculate the timing might be connected to rising military conflict in the area. Targeted for cyber revenge, financial channels like Nobitex have apparently helped Iran avoid economic sanctions.

“This actor is quite capable and serious,” Hultquist said. They act rather than merely talk.

The cyberwar front is obviously getting hotter as hostilities between Iran and Israel keep rising. And should Predatory Sparrow’s warning be taken as credible, this might only be the start.