Iran has once again been the victim of a catastrophic cyberattack, and this time, more than just its digital infrastructure has been damaged. The shadowy hacker collective Predatory Sparrow, which has caused high-profile disruptions in the nation’s vital industries, has now launched a concerted cyberattack against Sepah Bank, a significant financial institution associated with the Iranian government, and Nobitex, Iran’s most well-known cryptocurrency exchange.

Not only were the attacks brutal, but they were also symbolic. They also sent a terrifying message.

Elliptic, a top blockchain analytics company, claims that Predatory Sparrow destroyed over $90 million worth of cryptocurrency assets stored on Nobitex. However, the group purposefully burned the money, sending it to “vanity” wallet addresses like “FuckIRGCterrorists”—instead of draining it into anonymous wallets. It is not possible to recover these wallet addresses. This implies that the money is lost forever once it enters.

Elliptic co-founder Tom Robinson declared, “This is a statement attack.” It is obvious that the hackers had political intentions. The money was purposefully destroyed. They had no intention of making money.

The exchange facilitated transactions for the IRGC, Hamas, Houthi rebels, and Palestinian Islamic Jihad, according to Predatory Sparrow, who accused Nobitex of complicity in sanction violations and terror financing. Blockchain evidence was discovered during Elliptic’s investigation to back up these assertions.

Nobitex’s website went down after the attack. There has been silence, no official statement, and no update. For thousands of Iranian cryptocurrency users who used the exchange to avoid Iran’s precarious banking system and make investments, that silence is becoming more and more audible.

The attack continued after that.

The same day, Predatory Sparrow declared that it had totally destroyed internal systems at Sepah Bank, a company well-known for its strong connections to Iran’s defense industry and the Islamic Revolutionary Guard Corps. The group cited documents purportedly demonstrating direct collaboration between Sepah and the Iranian military, including transactions related to nuclear and ballistic missile programs, to support the allegation.

In its X message, the group cautioned that “associating with the regime’s instruments for evading sanctions is bad for your long-term financial health.” “Who will be next?”

Hamid Kashfi, an Iranian cybersecurity researcher based in Sweden, said he has heard from people inside Iran that Sepah’s services are experiencing widespread disruptions. “A lot of users are having trouble using online banking and ATMs,” he stated. “People are annoyed. Institutions are no longer the only targets of attacks. The public is the cause.

The website for Sepah Bank eventually returned to operation, but there are indications that there are still more serious infrastructure problems.

Predatory Sparrow has previously brought Iran to a complete digital halt. The group shut down thousands of fuel pumps nationwide in 2021. It then displayed anti-regime messages on monitors in train stations. Most famously, it took over the control system of a steel mill in 2022, resulting in the spillage of molten steel and the start of a fire. The group itself shared video footage of the incident, demonstrating the extent of its willingness to go.

Despite posing as an Iranian resistance group, many analysts think the operation is too well-planned and accurate to be domestic. Most people concur that the group is probably being supported by Israeli intelligence services, who are using it as a front for focused cyberattacks.

According to John Hultquist, chief analyst at Google’s Mandiant division, “this is cyberwarfare with military discipline.” “One of the few actors that regularly produces high-impact, strategic attacks is Predatory Sparrow.”

Iran has been using cryptocurrencies more and more to lessen the impact of economic sanctions. A key component of that endeavor was Nobitex. Its demise makes it abundantly evident that those weaknesses are now being targeted. In the meantime, military operations have long relied on Sepah Bank for financial support.

By striking both, Predatory Sparrow interfered with two of Iran’s most important survival tools in addition to its financial systems.

It’s obvious that this won’t be their last strike after their parting message, “Who’s next?” And from here, Iran’s digital future might only become more uncertain.