In a moment of extreme geopolitical tension, Israel's internal security apparatus was shaken by a disturbing revelation. On March 20, 2026, authorities indicted Raz Cohen, a 26-year-old Israel Defense Forces (IDF) reservist, on charges of transmitting highly classified information to Iranian intelligence.
What makes the case particularly alarming is not only the nature of the leaked data, but the negligible price paid: approximately $1,000 in cryptocurrency.
The Investigation and Arrest Under Operation "Roaring Lion"
The indictment came at the conclusion of a joint operation between Shin Bet (Israel's internal security service) and the Lahav 433 police unit, conducted under a broader investigative framework known as Operation Roaring Lion. Cohen was arrested on March 1st — just one day after the outbreak of open conflict with Iran — highlighting the speed with which authorities moved to neutralize an internal threat precisely as the external front was igniting.
From Iron Dome Batteries to Sensitive IAF Data
Cohen served in the command and control unit of the Iron Dome system during his mandatory military service between 2019 and 2022. According to documents filed at the Jerusalem District Court, the young soldier allegedly established contact with an Iranian agent on Telegram starting in December 2025.
In under a month, Cohen allegedly transmitted a total of 27 photos and videos. The material included critical details on firing processes, interceptor missile discharge rates, and arming procedures. Even more serious was the handover of GPS coordinates for Iron Dome batteries stationed at the Hatzerim and Palmachim bases, along with the locations of seven other Israeli Air Force (IAF) bases.
Prosecutors emphasize that Cohen was not passively recruited — he proactively offered his military role to the Iranian handler. The leak extended beyond technical data: the reservist also provided personal details about colleagues and relatives, including a guard at the President's Residence and a relative who pilots IAF aircraft.
Blackmail and the End of the Relationship
The relationship between Cohen and Iranian intelligence deteriorated when the handler began applying pressure tactics. The foreign agent allegedly threatened to expose Cohen by posting a photo of his sister on a Telegram profile. Frightened, Cohen blocked the contact and deleted the app in February 2026 — but the damage was already done. The digital traces left by cryptocurrency payment transfers allowed investigators to trace the activity back to him.
Legal Consequences and Hybrid Threats
Cohen now faces extremely serious charges: aiding the enemy in wartime and transmitting classified information with intent to harm state security. Under Israeli law, these offenses carry a maximum sentence of life imprisonment.
This case marks the first known instance of espionage directly involving an operator of the Iron Dome system. Authorities report that over the past two years, dozens of Israeli citizens have been investigated for suspected ties with Iran. The pattern is consistent: adversarial intelligence services exploit social media and encrypted messaging apps to recruit vulnerable individuals, offering small cryptocurrency payments to bypass security barriers and acquire strategic assets. The use of crypto as a covert payment channel — precisely because of its pseudonymous nature — is becoming a defining feature of modern hybrid espionage.
