Hacker group Gonjeshke Darande (Predatory Sparrow) used vanity wallet addresses containing anti-IRGC slogans, referencing Iran’s Islamic Revolutionary Guard Corps, during the Nobitex hack to deposit funds.

Quotes that support claims

Most of the addresses where the hacked funds are currently held are vanity addresses, containing some variation of the term “F*ckIRGCterrorists” within their public key.

Several wallet addresses used in the attack included political vanity names, such as “TKFuckiRGCTerroristsNoBiTEXy2r7mNX,” which holds the majority of the stolen assets on Tron – $48.6 million in USDT.