I. Executive Summary On June 18, 2025, Nobitex, Iran’s largest cryptocurrency exchange, became the target of a significant cyberattack claimed by “Gonjeshke Darande,” also known as “Predatory Sparrow,” a hacking group widely associated with Israel. The incident resulted in a reported loss exceeding $48 million in Tether (USDT) from Nobitex’s hot wallets. Following the breach, Gonjeshke Darande issued a public warning, threatening to release Nobitex’s source code and internal network information within 24 hours, cautioning that any remaining assets on the platform would be at risk.