PANews reported on June 27 that according to a TRM Labs report, Israel may use internal data from the hack of Nobitex, Iran's largest crypto exchange, to arrest suspects suspected of espionage. Nobitex was attacked by a self-proclaimed pro-Israel hacker group Gonjeshke Darande on June 18, and its hot wallet was stolen, resulting in a loss of more than $90 million.

TRM Labs pointed out that on June 24, Israel arrested three people suspected of spying for Iran, two of whom were paid in cryptocurrency. A 28-year-old suspect received $500 worth of cryptocurrency payments for each task completed. TRM Labs said that these arrests are rare public cases of state-sponsored espionage paid through digital assets, and digital assets have become an effective tool for covert operations due to their convenience in cross-border payments.

The report also mentioned that the timeline and tactical features from the Israeli airstrike on June 13, the hacking of Nobitex on June 18 to the arrest on June 24 may indicate that the Israeli cyber unit used Nobitex's internal data, such as wallet information or message records. However, Israeli officials have not yet confirmed a direct connection between the two.