Following a strong double cyberattack by hacker group Predatory Sparrow, thought to have links to Israeli intelligence, Iran’s financial scene is under siege. The group started two separate but coordinated strikes on Wednesday—one against Sepah Bank, a long-standing financial institution linked to Iran’s military sector, and another against Nobitex, the biggest bitcoin exchange in the nation.

Although the extent of damage is astounding, what distinguishes this cyberattack is not only the damage, but also the message behind it.

First, let us begin with Nobitex.

Elliptic, a blockchain forensics company, claims that the hackers transferred over $90 million worth of bitcoin to vanity wallet addresses, including phrases like “FuckIRGCterrorists,” burning over. These kinds of crypto addresses are practically digital black holes. Not even the hackers themselves can access the money once it is delivered there.

“This had nothing to do with theft. Tom Robinson, co-founder of Elliptic, spoke of erasure. “It’s one of the most obvious cases we have seen of a politically driven financial attack leveraging crypto infrastructure.”

Predatory Sparrow charged Nobitex with serving as a financial arm of the Iranian government, enabling it to fund militant organizations and evade global sanctions. The group mentioned relationships between the trade and groups, including Palestinian Islamic Jihad, Houthis of Yemen, and Hamas. Elliptic’s research confirmed this assertion by pointing to transaction records linking back to wallets connected to IRGC employees.

The website of Nobitex went dark not long after the attack. The company has not issued any public comments, which leaves thousands of consumers wondering whether their money is permanently lost or safe.

Then came the second blow, aimed at Sepah Bank, a financial institution vital for funding Iranian military operations. Predatory Sparrow claimed to have totally erased all bank internal data. They leaked papers purportedly proving Sepah’s direct involvement with Iran’s ballistic missile projects and the Islamic Revolutionary Guard Corps (IRGC), so bolstering their claim.

“Associating with the tools for evading sanctions could cost you everything,” their clear, direct warning said. Who is next?

Hamid Kashfi, an Iranian cybersecurity researcher living in Sweden, claims that the Sepah Bank hack is already having an impact on the ground. People cannot get into their accounts. Automated teller machines are not operational. Online banking is down right now. That is total disturbance, he remarked. “It’s hitting the average Iranian hard, not only a setback to the government.”

Although Sepah’s public-facing website temporarily returned online, insiders believe most of the internal system is still crippled. The Iranian government has not yet commented on the episode.

Predatory Sparrow has made news before this as well. The group earlier disabled thousands of gas stations in Iran, disrupted rail systems, and even uploaded video footage of an industrial sabotage operation at a steel plant in 2022, in which molten metal spilled onto the floor and started a fire.

Though it bills itself as an Iranian resistance group, analysts agree that Predatory Sparrow is a state-aligned cyber unit, probably supported by Israel.

John Hultquist, chief analyst at Google’s Mandiant, said this group is working with a degree of skill and coordination that points to significant institutional support. “They are surgically precisely destroying systems, not merely poking about them.”

The objectives this week were not random.

Under U.S.-led sanctions, Nobitex stands for Iran’s workaround to the conventional global financial system—an effort at survival and growth. Sepah Bank, meanwhile, handles transactions fueling the military aspirations of the government and is closely ingrained in Iran’s defense system.

Eliminating both allowed the Predatory Sparrow to create more than just financial loss. They alerted others not to take part and revealed the mechanics behind Iran’s survival strategies.