Israel-backed hackers wiped out $90 million in Revolutionary Guards crypto wallets during last month's war, calling it a landmark campaign to cripple Iran’s financial backbone, The Wall Street Journal reported.
Predatory Sparrow, the group believed to be aligned with Israeli intelligence, demonstrated “surgical precision and total freedom of access,” erasing data and destroying wallets linked to the Islamic Revolutionary Guards Corps (IRGC), according to a report published Sunday.
By targeting Bank Sepah—the Guards’ central financial institution—hackers rendered Iran’s military payroll inoperative and triggered cascading disruptions. “Automated teller machines went dark, and online and in-branch services shut down,” the report said. “Salary and pension payments halted.”
The hackers also penetrated Nobitex, Iran’s dominant cryptocurrency exchange, extracting and burning stablecoins tied to IRGC operational funds.
Nearly 90 percent of the country’s crypto transactions pass through Nobitex, and the group extracted approximately $90 million in stablecoins linked to IRGC funds. These were then burned by transferring them to inaccessible blockchain addresses, permanently removing them from circulation.
“Predatory Sparrow reportedly extracted $90 million from wallets linked to the Islamic Revolutionary Guard Corps, then burned the assets by transferring the funds to addresses where they could not be retrieved, thereby permanently removing them from circulation,” the article said.
The strike ignited a broader panic. Though not directly attacked, Iran’s largest commercial bank, Bank Melli, couldn’t meet demand for cash. The Central Bank of Iran attempted to contain the collapse by injecting liquidity, but confidence evaporated. The rial fell more than 12 percent, and authorities suspended trading on the Tehran Stock Exchange.
The attack denied officials and security personnel access to their own money, directly challenging the government’s ability to sustain loyalty through financial means.
The report also said that the success of the cyber campaign has reframed US strategy. While President Trump said at the NATO summit, “We want [Iranians] to be prosperous, we want them to do well, but they can’t have nuclear weapons," it was a message to Iran's Supreme Leader that he must relinquish the nuclear program or face economic collapse.
The report said that sanctions that drive the Islamic Republic finances into vulnerable channels such as crypto and informal banking will likely be part of that strategy, in addition to shifting US cyber policy from passive backing to active involvement in offensive operations alongside Israel.
“Cyber warfare also rewards live-fire experience," the article said. "The more Washington and Jerusalem operate together in combat, the stronger their alliance grows. And when the next big test comes—as it surely will—the nations that have trained together under fire will dominate the field."
The most recent case involves Mahsa Shafiee, the 24-year-old sister of slain protester Parsa Shafiee, who was arrested by intelligence agents at her home in Yasuj, southwestern Iran, on Thursday, according to a source who requested anonymity due to fear of reprisals.
Eighteen-year-old Parsa was killed in November 2022, during the nationwide protests sparked by the death in custody of Mahsa Zhina Amini over an alleged hijab law violation in September that year, which triggered the nationwide uprising known as the Woman, Life, Freedom Movement.
In addition to Shafiee's detention, her father was also summoned by the Revolutionary Guard's intelligence on the same day, according to former political prisoner and rights activist Foad Choobin.
“The Shafiee family is currently under severe pressure from security institutions and has been threatened not to share information about Mahsa’s situation,” he wrote on X Sunday, adding that Mahsa’s whereabouts are currently unknown.
Last Monday, Ehsan Khazaei, the brother of slain protester Erfan Khazaei, and his wife Neda Karegar were arrested in Tehran. According to Norway-based rights group Hengaw, more than 60 security agents stormed their residence, beat family members, and confiscated mobile phones. US-based rights group HRANA reported that the couple was later released on bail.
On June 23, Suleiman Qader Galwan, the brother of slain protester Abdulsalam Qader Galwan, was arrested in Oshnavieh, a city in West Azarbaijan province, following a raid by intelligence agents.
Ali Mohammadi, the father of slain protestor Shahriyar Mohammadi, was arrested on June 21 in Bukan, also in West Azarbaijan province, his daughter Asrin told Iran International.
Asrin said that her father was beaten during interrogation and lost consciousness, after which he was briefly hospitalized. Asrin added that her father is being denied independent legal representation.
On June 19, security forces also arrested Majid Naderkhani, whose son Matin was detained during the 2022 protests and shot dead months after release from prison.
In Yasuj, Feyzollah Azarnosh, the father of 18-year-old slain protester Pedram Azarnoosh, was arrested on June 18 and transferred to Yasuj Central Prison following questioning, according to a report by Hengaw.
That same day in Bukan, Karim Qaderpour, the father of protest victim Awat Qaderpour, was detained and taken to an undisclosed location.
Earlier this month, United Nations experts urged Iranian authorities to end a post-ceasefire crackdown marked by executions, mass arrests, and hate speech, warning that the country risks repeating past cycles of repression.
Last month, HRANA reported that 823 Iranian citizens were on political or security-related charges since the outbreak of the war.
According to the report, 286 people were detained for their online activities, including sharing content about Israel’s attack on Iran.
In a bulletin published on Sunday, Sobhe Sadegh, the daily outlet of the IRGC’s political department, described the prospect of renewed UN sanctions as a multidimensional threat and said policymakers must focus on preparing the public and economic actors rather than relying on hopeful messaging.
“A change in the tone of policy—from absolute hope-building to psychological readiness—is essential,” the outlet said.
The daily also warned that activation of the UN snapback mechanism could carry severe legal, economic, and social consequences for Iran.
The comments come amid growing concern in Tehran that Britain, France, and Germany may move to trigger the snapback mechanism before the 2015 nuclear deal’s 10-year term expires in October.
Once activated, the mechanism would restore all UN sanctions on Iran without the possibility of veto from Russia or China.
Iran, E3 agree to hold talks soon
Meanwhile, a source quoted by the IRGC-linked Tasnim News Agency said Iran has reached an agreement in principle with the three European countries to hold negotiations, though discussions are ongoing about time and location.
“There is agreement on holding the negotiations, but consultations on where and when are ongoing,” the source said.
However, Sky News reported on Sunday that Iran and the European troika are set to hold talks next Sunday in Geneva.
Officials warn of retaliation
On the other hand, lawmakers from Iran’s Parliament National Security and Foreign Policy Committee repeated Tehran’s position that any effort to revive UN sanctions would prompt a response.
“Europeans have no right to consider reactivating snapback sanctions when they themselves failed to meet their JCPOA obligations,” said committee member Vahid Ahmadi in an interview with Didban Iran.
“The Islamic Republic has prepared responses and will implement corresponding actions.”
Tehran's preconditions for nuclear talks
Ahmadi listed three conditions for Iran’s return to the negotiating table: condemnation of recent US and Israeli attacks on Iran, recognition of war-related damages, and guarantees against future aggression.
“If the West expects Iran to come back to the negotiating table, it must first recognize and rectify the aggression committed against us,” Ahmadi added. “There must be international condemnation, a clear assessment of the damages, and credible guarantees that our sovereignty won’t be violated again.”
MP says snapback is 'psychological ploy'
Committee member Esmail Kowsari dismissed the snapback threat as a “psychological ploy,” though Sobhe Sadegh warned that failure to manage expectations could intensify inflation and trigger capital flight.
The outlet proposed measures including new taxes and restrictions on foreign transactions.
“If the Westerners are acting in good faith, they must first condemn the aggressions and crimes of the United States and the Zionist regime, and only then speak of negotiations. We have not walked away from the negotiating table and have acted based on logic and the law. Even now, if they intend to make threats, the Iranian nation is prepared,” he added.
"If the enemies move toward using force," Kowsari warned, “they will undoubtedly face a firm and severe response. We will make important decisions and will not allow the security and authority of the Iranian nation to be undermined.”
