.png){kind=logo}
Israeli authorities charged an Iron Dome reservist for leaking classified defense data to Iranian intelligence for about $1,000 in cryptocurrency, exposing vulnerabilities in modern espionage networks. The Shin Bet and Lahav 433 unit filed the indictment at the Jerusalem District Court following a joint investigation conducted during Operation Roaring Lion.
The suspect, Raz Cohen, 26, served in the Iron Dome command and control unit and maintained contact with an Iranian handler through Telegram starting in December 2025. Prosecutors said Cohen knowingly transferred sensitive information and received cryptocurrency payments in return, confirming awareness of contact with a foreign intelligence agent.
Authorities arrested him on March 1, one day after the war with Iran began, according to case details cited in court filings.
Investigators said Cohen transmitted 27 photos and videos that revealed firing processes, rates of fire, and arming procedures within the Iron Dome system. He also shared the GPS coordinates of missile defense batteries located at Hatzerim and Palmachim bases, along with the locations of seven Israeli Air Force installations.
According to the indictment, Raz Cohen explained how the Iron Dome battery operates, including system structure and deployment methods used across operational zones.
Authorities stated that he volunteered details about his military role without prompting and disclosed personal data tied to Israeli security personnel. He provided information about a security guard at the President’s Residence and a relative serving as an Israeli Air Force pilot.
Investigators said the Iranian handler later attempted coercion by threatening exposure through a Telegram profile using a photo of Cohen’s sister. Cohen blocked the handler and deleted the application in February 2026, ending contact shortly before his arrest.
Cohen faces charges of assisting the enemy during wartime and transmitting information with the intent to harm state security, both carrying potential life imprisonment under Israeli law.
Authorities confirmed this case marks the first known espionage incident involving an Iron Dome operator with direct system access.
Officials reported that dozens of Israelis have faced similar Iran-linked espionage charges over the past two years, with recruitment efforts increasing through social media platforms. Security agencies warned that foreign intelligence operatives actively recruit individuals online, often offering payment for information or operational tasks.
Police and Shin Bet stated that “intelligence and terrorist agents from enemy countries continue efforts to recruit Israelis for security missions,” particularly during ongoing conflict conditions. This case raises a central question: how can highly sensitive defense systems remain secure when insider access combines with low-cost digital payments?
Also Read: Iran Crypto Activity Plunges 80% Following US-Israel Strikes and Internet Shutdowns
Investigators linked the operation to cryptocurrency transactions, which enabled quick and discreet payments between the handler and the suspect. Digital assets allow cross-border transfers without traditional banking oversight, reducing traceability in intelligence exchanges.
Security analysts observed that classified information access requirements no longer require expensive financial resources, as individuals with existing security clearances can access the information. Encrypted messaging platforms, including Telegram, have become central tools for recruitment, coordination, and data transfer in espionage cases.
Authorities observed that many recent espionage attempts rely on social engineering rather than advanced technical intrusion. Recruitment patterns show that adversaries combine small payments with direct communication channels to exploit human access points within sensitive systems.
Israel’s case against Raz Cohen shows how a small crypto payment and a Telegram contact allegedly led to the leak of sensitive Iron Dome data to Iran. The charges, the military details shared, and the wartime timing point to rising insider espionage risks and tighter scrutiny of digital recruitment methods.
