Iran is not unfamiliar with shadow wars, sabotage, and sanctions. But in a terrifying escalation, the country’s financial industry has just experienced one of its most damaging cyberattacks ever. First against Nobitex, Iran’s most used bitcoin exchange, and then against Sepah Bank, a pillar of the nation’s financial system, the infamous hacker group Predatory Sparrow has claimed responsibility for two devastating operations.

The type of these strikes distinguishes them. Unlike conventional tips that center on data theft or ransom demands, this operation was motivated by eradication instead. Respected blockchain tracking company Elliptic claims the hackers burned more than $90 million worth of cryptocurrency by moving the digital money into “vanity” wallets—wallets purposefully coded with phrases like “FuckIRGCterrorists,” which make them unrecoverable.

“This was symbolic destruction, not theft,” Tom Robinson, co-founder of Elliptic, said. “The hackers obviously have political rather than financial drives. Their pilfering of cryptocurrency has essentially been burned.

In a public statement, Predatory Sparrow defended its activities by charging Nobitex of being closely involved in efforts by Iran’s government-led sanctions avoidance and funding of extremist groups. Research by Elliptic supports this, connecting Nobitex to organizations approved for connections to IRGC, Hamas, the Houthi rebels of Yemen, and Palestinian Islamic Jihad.

Publicly, the crypto exchange has not commented. Its website is still down, and its users are left wondering whether they will be able to get back in or retrieve any money at all.

Still, the hackers were not content with that. They declared an even more bold attack on Sepah Bank hours later. Renowned for its historical ties to the IRGC, the state-owned bank reportedly cleaned all internal data. Predatory Sparrow released what it claimed to be internal records proving the bank’s military collaboration with Iran, together with a terrifying warning: “Caution: Your long-term financial situation suffers when you support the instruments of the government for escaping sanctions and fund its ballistic missiles and nuclear program. Next? Who?

Sepah’s website went dark momentarily, then came back online not too long ago. Still, the actual effect seems to be behind the scenes. Hamid Kashfi, an Iranian-born cybersecurity specialist now residing in Sweden, claims that since the attack, many people have been unable to access their own money due to malfunctioning bank ATMs and online systems.

“From what I’m hearing inside Iran, this attack has caused broad disturbance,” said Kashfi. “It’s affecting common people trying to get by, not only targeting regime structures.”

This is not at all the first high-impact blow Predatory Sparrow delivers. In past operations, the group disabled thousands of fuel stations around Iran, closed national rail systems, and most famously, set fire to a steel plant in a 2022 attack, almost killing staff. Later on, the group made public video footage of that industrial sabotage, verifying their participation and indicating a readiness to inflict not only digital but also physical damage.

Though the group’s identity is still veiled in partial anonymity, cybersecurity experts have little question about their affiliations. Although Predatory Sparrow sometimes presents itself as a domestic Iranian movement, experts generally agree that they are connected to Israel’s intelligence network, or at least, functioning with its support.

“This is not your typical hacker group,” said Google’s threat intelligence lead, John Hultquist. “Predatory Sparrow is serious, clever, and obviously able to fulfill its threats.”

The twin strikes on Sepah Bank and Nobitex mirror changes in cyberwarfare strategy. These days, stealing secrets is not the focus. It’s about neutralizing important economic nodes in a country, severing its financial lifeblood, and alerting others to avoid.

And for Iran, whose semi-independent financial institutions and crypto transactions help to explain some of its economic resilience, the message is negative. The question is not only who’s next but also how much more Iran’s infrastructure can withstand if Predatory Sparrow can destroy $90 million in assets and overnight ruin a state bank.