Predatory Sparrow has again changed the rules of war in a time when cyberwarfare is as consequential as boots on the ground. Targeting Iran’s top cryptocurrency exchange, Nobitex, and one of the country’s main state banks, Sepah Bank, the group executed a double-barreled attack on Iran’s financial system this week. The outcomes were appalling. The intention is much more terrifying.

It started on Wednesday morning on the group’s X page with an announcement. Claiming they had broken into Nobitex, Predatory Sparrow claimed they assisted the Iranian government in avoiding sanctions and financing terrorism. Blockchain analysis company Elliptic claims, however, that the hackers burned over $90 million worth of cryptocurrency instead of pilfering.

The money was transferred to crypto addresses including “FuckIRGCterrorists,” with messages like These addresses are referred to as vanity wallets—custom-coded and intended to prevent recovery of the crypto within. This approach is obviously driven by political intention and is hardly seen in hacker operations. “This was not theft,” co-founder of Elliptic Tom Robinson remarked. It was sabotage.

Predatory Sparrow claimed that Nobitex was instrumental in funding operations for IRGC, Hamas, the Houthis, and Palestinian Islamic Jihad, thus justifying the act. Every one of these organizations is sanctioned and regarded as a security concern by several countries.

The Nobitex website went dark following the attack. The business has stayed quiet on the incident or its effects. Silence says a lot. Elliptic’s tracking of blockchain movements, meantime, confirms that the trade involved blacklisted companies.

The digital anarchy did not stop there, though.

Predatory Sparrow claimed within hours that they had hacked Sepah Bank, wiping out all internal data of the institution. The online records the group uploaded seemed to show financial links between Sepah and Iran’s Islamic Revolutionary Guard Corps. Besides the data came a warning: “Caution: Your long-term financial situation suffers when you support the instruments of the government for escaping sanctions and finance its ballistic missiles and nuclear program. Who next?

The website of Sepah Bank went down but has lately come back. Reports from inside Iran, however, indicate that the actual harm happened on the consumer side.

According to Swedish Iranian cybersecurity researcher Hamid Kashfi, founder of DarkCell, contacts in Iran indicated that online banking and ATM linked to Sepah had been down since the attack. “This is anarchy. Individuals cannot get into their accounts. Not just are political players suffering; millions of common Iranians are also impacted.

Although the collateral damage raises ethical issues, for Predatory Sparrow, disruption seems to be the aim. The group has a past of targeting public systems with military ties under attack. Previously, they shut down thousands of gas stations, hacked Iran’s railway network, and, most famously in 2022, stole the industrial systems of a steel plant, starting a fire that almost resulted in deaths.

Digital messages and sometimes videos accompany the group’s attacks. In each case, their strategies have suggested state-level resources rather than only high-level planning. For this reason, a lot of analysts think they have connections to Israeli intelligence.

“This group doesn’t make idle threats,” Google’s chief threat analyst, John Hultquist, says without reservation. They are very competent. And they typically follow through when they announce something.

The consequences of these cyberattacks are difficult to overlook, given that Iran depends mostly on cryptocurrencies to escape financial isolation, and Sepah Bank is closely linked to military infrastructure. It goes beyond mere loss of data or assets for Iran. It’s about indicating that its digital shield isn’t as robust as once thought, while so undermining the country’s capacity to run financially.

“Who’s next?” Predatory Sparrow’s last message summed it all. That question should cause shivers all around in a world where crypto is a weapon and financial institutions are now front-stage targets.