An organisation calling itself Predatory Sparrow, which Western analysts have previously linked to Israel, claimed a series of coordinated cyberattacks against Iran’s financial sector in mid-June. On 17 June the group said it had “destroyed the entire data infrastructure” of Bank Sepah, a state-owned lender that processes pay for Iran’s armed forces and is sanctioned by the United States for its links to the Islamic Revolutionary Guard Corps. Customers reported nationwide outages that disabled online banking, ATMs and card payments at Bank Sepah’s 1,800 branches as well as its European subsidiaries. Iranian state media acknowledged the disruption and said the lender was reconnected to the national banking network on 21 June, but offered no details on data recovery or potential losses. Less than 24 hours after the bank attack, Predatory Sparrow said it had breached Nobitex, Iran’s largest cryptocurrency exchange. Blockchain-tracking firms and military reporters estimate the hackers drained roughly $90 million—about 95 percent of Nobitex’s hot-wallet assets—across Bitcoin, Ether, Tron and Dogecoin. The exchange froze withdrawals, warned remaining users to move funds and began phased service restoration on 29 June. In communiqués released alongside leaked internal documents, the hackers alleged both institutions were being used to finance IRGC proxy forces and to evade international sanctions. Iranian authorities have not commented on the claims, and there is no independent confirmation that the stolen crypto has been recovered. The twin strikes highlight the intensifying digital confrontation between Tehran and Jerusalem and come amid a broader surge in crypto heists. Blockchain-intelligence firms calculate that more than $2.1 billion was stolen globally in the first half of 2025, with infrastructure compromises such as hot-wallet breaches accounting for the bulk of the losses.