Pro-Israel hackers attack Iran's largest crypto exchange, destroying $90 million
An anti-Iranian hacking group with possible ties to Israel announced an attack on one of Iran's largest cryptocurrency exchanges on Wednesday, destroying nearly $90 million and threatening to expose the platform's source code.
A group known as Gonjeshke Darande, or 'Predatory Sparrow,' claimed the attack, making it the group's second operation in two days. On Tuesday the group claimed to have destroyed data at Iran's state-owned Bank Sepah amid the increasing hostilities and missile attacks between Israel and Iran.
Wednesday's attack targeted Nobitex, one of Iran's largest cryptocurrency exchanges. The platform allegedly helps the Iranian government avoid sanctions and finance illicit operations around the world, the hackers claimed in a message posted to its social media channels early Wednesday.
Nobitex's website was unavailable Wednesday. Messages sent to the company's support channel on Telegram were not returned. Gonjeshke Darande did not respond to requests for comment.
Nobitex said in a post on X that it had pulled its website and app offline as it reviewed 'unauthorized access' to its systems.
Gonjeshke Darande is an established hacking group with a history of sophisticated cyberattacks targeting Iran. A 2021 operation claimed by the group caused widespread gas station outages, while a 2022 attack targeting an Iranian steel mill caused a large fire and tangible, offline damage.
Israel has never formally acknowledged that it is behind the group, although Israeli media has widely reported Gonjeshke Darande as 'Israel-linked.'
Wednesday's attack started in the early hours of the morning when funds were moved to hacker-controlled wallets denouncing the Islamic Revolutionary Guard Corps (IRGC), according to blockchain analysis firm TRM Labs, which pegged the total theft at about $90 million across multiple types of cryptocurrencies.
The way the hacker-controlled wallets were created suggests the hackers would not be able to access the stolen money, meaning that the hackers 'effectively burned the funds in order to send Nobitex a political message,' blockchain analysis firm Elliptic said in a blog post.
Elliptic's post shared evidence that Nobitex had sent and received funds to cryptocurrency wallets controlled by groups hostile to Israel, including Palestinian Islamic Jihad, Hamas and Yemen's Houthis.
Senators Elizabeth Warren and Angus King had raised concerns about Nobitex's role in enabling Iranian sanctions evasion in a May 2024 letter to top Biden administration officials, citing Reuters reporting from 2022.
Andrew Fierman, head of national security intelligence with Chainalysis, confirmed in an email to Reuters that the value of the attack was roughly $90 million and that it was most likely geopolitically motivated, given that the money was burned.
Chainalysis has 'previously seen IRGC-affiliated ransomware actors leveraging Nobitex to cash out proceeds, and other IRGC proxy groups leveraging the platform,' Fierman said.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
North Wales Chronicle
30 minutes ago
- North Wales Chronicle
Security review launched after Pro-Palestinian activists break into RAF base
Footage posted online by Palestine Action on Friday morning shows two people inside RAF Brize Norton in Oxfordshire. The clip shows one person riding an electric scooter up to an Airbus Voyager air-to-air refuelling tanker and appearing to spray paint into its jet engine. The incident is being investigated by counter terror police. Defence Secretary John Healey said he was 'disturbed' by the vandalism, while Sir Keir Starmer said it was 'disgraceful'. 'I am really disturbed that this happened and have ordered an investigation and a review of wider security at our bases,' Mr Healey said. 'These aircraft are used by our military personnel to support security and peace around the world. 'This action does nothing to support Gaza or our push for peace and stability in the Middle East.' Downing Street said security is being reviewed across the defence estate and that the Government is working closely with police. The act of vandalism committed at RAF Brize Norton is disgraceful. Our Armed Forces represent the very best of Britain and put their lives on the line for us every day. It is our responsibility to support those who defend us. — Keir Starmer (@Keir_Starmer) June 20, 2025 A No 10 spokesman said: 'A full security review is under way at Brize Norton. 'We are reviewing security across the whole defence estate. 'We treat all breaches of security very seriously, and where there is suspected criminal activity, we will take the necessary steps to investigate and prosecute in line with longstanding principle.' He said the incident had not disrupted any planned aircraft movements or operations. A spokesman for the campaign group said: 'Despite publicly condemning the Israeli Government, Britain continues to send military cargo, fly spy planes over Gaza and refuel US/Israeli fighter jets. 'Britain isn't just complicit, it's an active participant in the Gaza genocide and war crimes across the Middle East. 'By decommissioning two military planes, Palestine Action have directly intervened in the genocide and prevented crimes against the Palestinian people.' RAF Brize Norton serves as the hub for UK strategic air transport and refuelling, including flights to RAF Akrotiri in Cyprus. A Ministry of Defence spokesman said: 'We strongly condemn this vandalism of Royal Air Force assets. We are working closely with the police who are investigating. 'Our Armed Forces represent the very best of Britain. 'They put their lives on the line for us, and their display of duty, dedication and selfless personal sacrifice are an inspiration to us all. 'It is our responsibility to support those who defend us.' Sir Keir said in a post on X: 'The act of vandalism committed at RAF Brize Norton is disgraceful. 'Our Armed Forces represent the very best of Britain and put their lives on the line for us every day. 'It is our responsibility to support those who defend us.' A Counter Terrorism Policing South East statement said: 'Specialist counter terrorism officers are working closely with officers from Thames Valley Police and the Ministry of Defence Police. 'Inquiries are ongoing to establish the exact circumstances.'
North Wales Chronicle
31 minutes ago
- North Wales Chronicle
Seven men arrested after two people injured at protest outside Iranian Embassy
Metropolitan Police officers responded to reports of an altercation in Princes Gate in Knightsbridge, west London, shortly after 9.50am on Friday, a force spokesperson said. Two men were treated for injuries at the scene by the London Ambulance Service (LAS) before one was taken to a major trauma centre and the other to hospital. The incident is thought to have involved protesters from 'the pro and anti-Iranian regime', the Met said. Their injuries are not thought to be life-threatening. The seven arrested men, whose ages have not yet been given, currently remain in police custody. Officers remain at the scene and the area has been cordoned off while initial investigations take place. Police have imposed conditions to stop protestors from gathering in the area until 1pm on Sunday. One man was arrested and taken into custody on suspicion of breaching the conditions. An LAS spokesperson said: 'We were called at 9.56am today (June 20) to reports of an assault in Princes Gate, SW7. 'We sent a number of resources to the scene including ambulance crews, paramedics in fast response cars and our Tactical Response Unit. 'We treated two patients at the scene and took one to hospital and one to a major trauma centre.' Footage shared on social media appeared to show two men lying on the ground in a fenced-off section of the road. One man, who was shirtless, had blood covering his nose and mouth, while the other man lay motionless clutching his left leg and ankle, with police officers attending both individuals. A number of national embassies are located on or near Prince's Gate, including the Embassy of The Islamic Republic of Iran.
The Sun
an hour ago
- The Sun
Inside the seedy underworld of Vinted where sellers use five-letter secret code to flog unwashed underwear & socks
VINTED is an easy money-maker for millions of users across the country. From secondhand clothing and accessories to old books and toys, savvy sellers can top up their income by hundreds of pounds a month. 4 It's completely free to upload clothes to the app and Vinted does not take a cut of sellers' profits - instead charging buyers a small fee to purchase each item. But beyond the innocent sales and haggling, there's a seedy "underworld" on the marketplace app. That's because sneaky Vinted users have sussed out a way to target the fetish market and flog worn and dirty tights, socks and underwear for up to £100. Selling goods which "do not comply with hygiene standards" is prohobited on Vinted and can see users banned from the app. Described as "unsafe items", this includes worn underwear, handmade underwear bottoms, shorts worn as underwear - such as sleep shorts, corsets, body shapers and shapewear with bottom parts, protective underwear bottoms for sports. The Vinted guidelines add: "For hygiene reasons, only new underwear can be sold - you must clearly show the attached tags and/or original packaging in your item's pictures. Composition and brand labels inside do not count as tags. "Worn bras, swimming costumes, tights and socks can be sold as long as they are properly washed and the description clearly states that the item has been worn." But TikTok posts have revealed the five-letter code that sellers are using to flog such items without raising the alarm with Vinted. The hashtag 'iykyk' - an acronym for 'if you know, you know' - has soared in popularity on the app. The Scottish Sun investigated the secret tactic to see just how many sellers managed to avoid Vinted's strict rules and filters. Within seconds, we were confronted with pages of listings with seemingly innocent packs of 'new with tags' thongs, socks and bras. But the descriptions showed the telling code word and immediately asked prospective buyers to "message on TG for details". TG, short for Telegram, is an encrypted messaging service and social network. Secret Chats on the platform come with additional privacy features which means messages can't be forwarded, and you can set a self-destruct timer, with intervals ranging from one second to one week. It is here that the Vinted users can engage with potential customers directly to sell filthy, used belongings. Apart from the 'iykyk' hashtag, the prices some items are being flogged for are an additional red flag. 4 4 4 One user - Emma, from Glasgow - is advertising a five-pack of Tesco tights, originally purchased for £5, at £5 per pair. This works out at a 400 per cent profit. Her description reads: "Price per pair. Selling as I bought the wrong shade. Iykyk Message for more info TG." Another seller advertised a used Boohoo bikini that's been "worn a lot over two summers" for £20. Her description adds: "Please text me on TG, I don't get the messages from here." And someone else is flogging a "variety of tights, socks and stockings" for £20 with the 'iykyk' hashtag and a note to "see bio" where her Telegram account is listed. Air hostesses have also jumped on the trend, trying to sell tights and cabin crew shoes worn on flights. One user is demanding £110 for a "crew shoes and tights" bundle, while another boasts her £8.50 tights - in a "satisfactory" condition - have been "worn to and from Turkey on over 100 flights". Vinted has been approached for comment. New Vinted rules to be aware of IF you fancy clearing out your wardrobe and getting rid of your old stuff on Vinted, you'll need to consider the new rules that recently came into play. If people are selling personal items for less than they paid new (which is generally the case for second-hand sales), there is no impact on tax. However, since January 1, digital platforms, including eBay, Airbnb, Etsy, Amazon and Vinted, must share seller information with HMRC as part of a crackdown. You're unlikely to be affected if you only sell a handful of second-hand items online each year - generally, only business sellers trading for profit might need to pay tax. A tax-free allowance of £1,000 has been in place since 2017 for business sellers trading for profit - the only time that an individual personal item might be taxable is if it sells for more than £6,000 and there is a profit from the sale. However, firms now have to pass on your data to HMRC if you sell 30 or more items a year or earn over £1,700. It is part of a wider tax crackdown to help ensure that those who boost their income via side hustles pay up what they owe. While your data won't be shared with HMRC if you earn between £1,000 and £1,700, you'll still need to pay tax as normal.
