Ransom of $1,011 in Bitcoin: The Leak Shaking Israel Twelve Days Before Elections

State secret, friend’s price. A Telegram channel has been broadcasting videos purportedly filmed in the military helicopter of Benjamin Netanyahu, Israel's Prime Minister and candidate for re-election on October 27, along with photos from inside his official plane. Its administrators are demanding $1,011 in Bitcoin for the first batch.

This channel claims to have hacked the phones of Yossi Shelley, former director of the Prime Minister's office turned ambassador of Israel to the United Arab Emirates, and Sara Netanyahu, the Prime Minister's wife. No Israeli media had picked up the story by Thursday morning, in a country well-versed in cyber warfare with Iran.

Key Points

• According to a cyber monitoring X account, a Telegram channel is publishing images claimed to be filmed in the helicopter and official plane of the Israeli Prime Minister.
• It demands the equivalent of $1,011 in Bitcoin for a first batch of files.
• The phones of Yossi Shelley and Sara Netanyahu are reportedly targeted, with no official confirmation.
• The method resembles that of Handala, a group of hackers linked to Iranian intelligence that has previously targeted former Prime Minister Naftali Bennett.

Netanyahu Leak: What the Channel Has Published

The alert originated from the International Cyber Digest account, a cyber security monitoring X account without an identified editorial team, which relays captures from Telegram channels without its own verification. Its publication was viewed 2.8 million times within hours. By Thursday morning, no major Israeli media or cyber security publisher had picked it up. According to this relay, the channel has broadcast videos that were allegedly filmed aboard a military helicopter transporting the Prime Minister. It also published what it presents as photos from inside the Wing of Zion, the Boeing 767 that serves as Israel's Air Force One. A secure internal phone is visible.

The price is surprising. $1,011 is approximately 0.0125 BTC at Thursday morning's rate. For images taken at the heart of the Israeli security apparatus, the amount seems more like provocation than a business model. The channel promises further publications.

By Thursday morning, neither the Prime Minister's office nor the ambassador had publicly reacted. No Israeli authority has authenticated the images at this stage.

Several areas of uncertainty remain. There is nothing to date the images or establish that they come from the mentioned phones: they could just as easily come from a messaging account of the entourage, or even from files already in circulation. The meager sum and the electoral calendar suggest more a destabilization operation than a genuine extortion.

‼️BREAKING: Someone is leaking confidential videos and photos of Israeli Prime Minister Netanyahu through Telegram.

A channel claims hackers accessed the phones of Israeli Ambassador Yossi Shelley and Sara Netanyahu.

It has posted videos from Netanyahu's military helicopter and... pic.twitter.com/ea6B2DNQ9s
--- International Cyber Digest (@IntCyberDigest) October 14, 2026

Handala, Telegram, and the Bennett Precedent

The channel does not sign its posts. However, its method resembles that of Handala, a group that cyber security publisher KELA links to the Iranian Ministry of Intelligence ecosystem. In December 2025, Handala claimed to have hacked Naftali Bennett's iPhone, the former Prime Minister and Netanyahu's rival in the campaign, and then the phone of Tzachi Braverman, Netanyahu's chief of staff. The Prime Minister's office denied any intrusion. Bennett eventually acknowledged the hacking of his Telegram account, assuring that the device remained secure.

For KELA, these attacks target messaging accounts rather than phones. The hackers obtain login codes through phishing or steal session files from Telegram Desktop on a compromised computer. The publisher also deemed the scale of the Bennett leak exaggerated, with only about forty conversations containing real messages.

Twelve Days Before the Vote, a Campaign Undermined by Leaks

The timing is unfortunate for the Prime Minister. Israelis will vote on October 27 to renew the Knesset, the Parliament, and Netanyahu's entourage is facing a series of breaches. At the end of September, Calcalist revealed that Jonatan Urich, a close advisor to the Prime Minister, had linked his personal WhatsApp account to Ultramsg, a messaging management service that claims to be based in the United Arab Emirates. His messages leaked on October 11 and, according to Haaretz, the Shin Bet, Israel's internal security service, is examining the disclosed data.

In 2017, HBO hackers demanded $6 million in Bitcoin not to release unreleased episodes of Game of Thrones. Nine years later, images of the Israeli Prime Minister are being offered for nearly 6,000 times less.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.