The New Role Of Banks In War

Cutting off access to financial markets has long been an effective strategy to force political enemies into submission.

Typically employed via sanctions designed to cut unfavorable organizations and enemy countries off from the global financial system, Israel's continued assault on neighboring regions is beginning to solidify a new era in the weaponization of financial infrastructure, engaging in the direct targeting of banking systems not through bureaucratic means, but the use of force.

Sepah Bank and the Nobitex Exchange

On June 17th, customers of the Iranian Sepah Bank, one of Iran's largest state-owned banks originally founded to serve the Iranian military – the term Sepah translates to "corps" or "army" in Farsi – began reporting outages at Sepah operated ATMs.

The hacking group Gonjeshke Darand, which translates to Predatory Sparrow, took credit for the attack in a post on X, stating that Sepah Bank "was an institution that circumvented international sanctions and used the people of Iran’s money to finance the regime’s terrorist proxies, its ballistic missile program and its military nuclear program."

According to Predatory Sparrow, all data belonging to Bank Sepah has been destroyed in the attack. Due to an Internet shut down imposed by the Iranian Government, it is unclear whether services have been restored.

According to Reuters, Predatory Sparrow is "an anti-Iranian government hacking group with potential ties to Israel and a track record of destructive cyberattacks on Iran." Reuters highlights that the group had previously been linked to the 2022 hack of an Iranian steel production facility, noting that "such attacks are usually beyond the capabilities of activist hackers, security experts say, and would be more in line with the capabilities of a nation state."

The Times of Israel, which describes Predatory Sparrow as "previously linked to Israel," reports that customers had been shut out of their accounts, and that customers of other Iranian banks, Ansar Bank and Kosar Bank, reported having issues with their debit cards as well, noting that it is unclear whether services have been restored.

Drop Site News reported that Bank Melli, Iran’s largest bank, was also taken offline, affecting ATM and online services around June 17. "It remains unclear if this was part of Predatory Sparrow’s operation, but its outage added to the nationwide financial paralysis."

On June 18th, Predatory Sparrow hacked the Iranian cryptocurrency exchange Nobitex, burning $90 Million "of the regime's favorite sanctions violation tool." The hackers have released what they claim to be Nobitex' source code, including scripts, app-image user guides and server lists, leaving remaining assets on the exchange up for grabs.

Users on X are already scrambling to extract funds from the leak, but are having issues accessing servers. "I only need 1 btc not more, also it’s from terrorists so who cares?? Help me gonj," one commenter writes. "Honestly it's not from the terrorists," another commenter responds. "This money belongs to ordinary people. We all have lost our savings due to this stupid incident." "The government has not suffered much from this action. Only our poor people. We have lost all of our savings," the commenter continues.

The Nobitex hack was confirmed by the blockchain surveillance firm Elliptic, which notes that "the hack [...] does not appear to be financially motivated," and was rather meant to "send Nobitex a political message," given that the funds had not been stolen but destroyed. According to Elliptic's report, Nobitex has been linked to two sanctioned individuals accused to have been involved in the distribution of ransomware and cyber threats.

In a follow-up statement, Predatory Sparrow announced that "any institution that will support the IRGC will be on our radar. [...] Some of them will be destroyed with intense force; others will just disappear right before your very eyes." Notably, the two sanctioned individuals identified by Elliptic can also be tied to the US-based exchange Kraken, as well as to Binance.

Elliptic claims that Nobitex has been linked to the Palestinian Islamic Jihad (PIJ), Gaza's Hamas, as well as to Yemen's Houthis, though these claims cannot be independently verified due to a lack of published addresses.

Elliptic has previously quietly corrected statements of funds attributed to the PIJ, which had served as data in an investigative article published by the Wall Street Journal, causing backlash in the industry. Similarly, the blockchain surveillance firm Chainalysis has previously corrected funds attributed to North Korea, highlighting that attributions that cannot be independently verified should be viewed with caution.

In a likely response to the attacks, Iran has targeted the Tel Aviv stock exchange in a missile strike on Thursday morning. However, reports on the impacts remain hard to verify as Israel has imposed a total media ban on the publication of Iranian impacts within the country, requiring all reports on missile and drone strikes to be cleared by Israel's military censor.

The ban spans both national and international reporting, as well as publication on social media, blogs and chats. According to the Jerusalem Post, Israeli officials have clarified that "violating this order is liable to severely harm the security of the state, [...] stating that any violators will be charged."

Financial Infrastructure as Legitimate Targets

Banks and financial services are generally understood to be part of critical civilian infrastructure, the attack of which constitutes a war crime under the Geneva Convention.

Since October 7th 2023, Israel has strategically targeted financial infrastructure in the Gaza Strip as well as in Lebanon through cash blockades, asset seizures, and missile strikes.

On October 7th 2023, Israel stopped the import of Shekels into Gaza, blocking the entry of physical currency into a region reliant on Israeli monetary infrastructure. Under the 1994 Paris Accords, the Palestinian Monetary Authority (PMA), established as the de facto central bank for the Palestinian territories, has been barred from issuing its own national currency.

On October 8th 2023, Israel destroyed the Palestinian Islamic National Bank, also known as the Islamic National Bank of Gaza or INB, as well as the Gazan Postal Bank, in a series of air strikes.

The IDF then began seizing large sums of cash from remaining banks, confiscating 200 Millon Shekels from Bank of Palestine headquarters in Gaza City, equating to ~$54 Million USD, according to the PMA.

In 2025, Israel continued to target remaining exchange offices in missile strikes, claiming that the services were used to funnel money toward Hamas and the Palestinian Jihad.

The World Bank estimates that 33 out of 56 bank branches in Gaza have been completely destroyed and 19 partially damaged. Of 94 ATMs, only two remain semi-functional, the World Bank states. Among non-bank financial institutions, 83 percent of microfinance offices were impacted, with 15 out of 18 branches damaged. Additionally, 32 out of 46 currency exchange branches were impacted, and the only payment service provider office in Gaza was damaged.

"The widespread damage of banking infrastructure and reduced liquidity in Gaza have halted access to financial services," the World Bank writes. "This has deepened poverty and inequality, particularly among the most vulnerable populations."

The damage to Gaza's financial sector has reportedly led to commission rates as high as 48% on single withdrawals. "If you have 1000 USD in your bank account, you get 520 USD in physical cash while the 480 USD is deducted as a commission for that," writes Mosab Abu Toha on X.

Locals reportedly camp out at the remaining ATMs, waiting as long as 15 days for the chance to withdraw their savings, while the repairing of old bills has turned into a new profession in the Strip.

“The fact is that cash became a commodity, so it’s kind of taxed,” Nil Eyuboglu, a cash and voucher assistance adviser for Save the Children, told the online news outlet The New Humanitarian.

In total, the destruction of Gaza's financial infrastructure has resulted in $325 Million in losses for the Palestinian economy.

Al‑Qard al‑Hasan and the SpiderZ Hack

In October 2024, Israel began targeting the non-profit banking network Al-Quard al-.Hasan (AQAH), destroying branches in Nabatieh, Tyre, and Beirut in a series of missile strikes.

As Lebanon's currency began collapsing in 2019 and banks were increasingly unable to process withdrawals, many Lebanese began turning to AQAH as an alternative financial institution.

Offering interest-free loans, AQAH effectively functions as a pawn shop: customers can give valuables like gold or jewelry into commission, and receive loans for up to $5000 USD in return.

In 2006, Israel already struck sites belonging to AQAH. The organization has been under US sanctions since 2007.

Following Israeli strikes on AQAH, the UN reported that "Israel’s multiple bombings of a financial institution in Lebanon were illegal attacks on civilian objects under international humanitarian law."

“Bombing banks obliterates the distinction between civilian objects and military objectives which is fundamental to protecting civilians from violence. It opens the door to ‘total war’ against civilian populations, where fighting is no longer limited to attacking militarily dangerous targets,” the UN reported, citing Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism.

“Such attacks jeopardize the right to life”, noting hat "international counter-terrorism law does not authorize military attacks to prevent alleged terrorist financing or money laundering."

Similarly, the human rights group Amnesty International called for a war crime investigation into the bombings.

Again, the justification for missile strikes against AQAH were its alleged use in the financing of terrorism.

The allegations appear to be largely based on a leak attributed to the anonymous hacking group called SpiderZ claiming to show internal documents obtained from the institution, reportedly showing ties to the paramilitary group Hezbollah. Several banks, which the SpiderZ group alleged to be working with AQAH, denied the allegations.

"Al-Qard Al-Hassan officials do not know exactly who was behind this cyber-attack but they are certain that most of the information they disclosed are not accurate," the Jerusalem Post reported at the time, stating that the attack was likely carried out by a foreign nation state.

Israel's attacks on financial infrastructure have been critically under reported and dangerously overlooked in light of their potential to bring civilian life to a total halt. The normalization of portraying financial infrastructure as legitimate targets should be worrying to anyone with an interest in the rule of law, marking a significant escalation in what is deemed acceptable to combat the financing of terrorism.

Independent journalism does not finance itself. If you enjoyed this article, please consider making a donation.