The stolen funds were transferred to addresses bearing messages that criticised Iran's Revolutionary Guard, Blockchain analytics firm Elliptic wrote in a blog post.