bitcoin geopolitics adoption regulation

Iranian Crypto Outflows Spike 700% After US-Israeli Airstrikes

bitcoinindex.net · · 7 min read
Iranian Crypto Outflows Spike 700% After US-Israeli Airstrikes

Bombs fell on Tehran at dawn on February 28, 2026. Within minutes, cryptocurrency started flooding out of Iran.

Blockchain analytics firms Elliptic and Chainalysis watched it happen in real-time. Outflows from Nobitex, Iran’s largest crypto exchange, surged 700% in the first hour. By March 2, $10.3 million had left Iranian platforms.

The data paints a picture more complex than simple panic. Three possible explanations emerge: ordinary Iranians moving funds to safety, exchanges repositioning liquidity under sanctions pressure, or state actors leveraging the same infrastructure for sanctions evasion. The reality is probably all three at once.

Here’s what blockchain transparency reveals about crypto during war.

The 700% surge

Nobitex serves 11 million users and processed $7.2 billion in transactions in 2025. It’s Iran’s crypto backbone. When U.S.-Israeli airstrikes hit Tehran early on February 28, the platform saw outflows spike 700% compared to baseline activity.

Elliptic’s analysis tracked funds flowing to overseas exchanges with historical Iranian inflow patterns. Chainalysis reported that hourly outflow volumes surged 873% higher than the 2026 average. The $10.3 million figure covers multiple Iranian exchanges between February 28 and March 2.

The speed matters. These weren’t planned moves. People reacted to bombs in real-time, and blockchain data captured every transaction.

Three explanations (or all of them)

Chainalysis identified three possible behaviors behind the outflows, and separating them is harder than you’d think.

Ordinary Iranians seeking safety

Iran’s rial has lost nearly 90% of its value since 2018. Inflation runs at 40-50%. When airstrikes began, moving funds off centralized exchanges vulnerable to government seizure makes sense. Self-custodial Bitcoin wallets offer censorship resistance and liquidity.

This pattern showed up during January 2026’s mass protests and internet blackout. Bitcoin withdrawals to personal wallets surged in the days before the January 8 blackout, flatlined during the connectivity cut, then resumed immediately after internet access returned.

Chainalysis framed it this way: “Self-custodial crypto wallets provide safety and liquidity and preserve optionality. For many Iranians, cryptocurrency has become an element of resistance.”

Iranian exchanges obfuscating activity

Crypto businesses in sanctioned jurisdictions routinely move funds to avoid wallet identification. Comprehensive sanctions make identified wallets harder to connect to mainstream liquidity.

Nobitex was hacked for over $90 million in June 2025, adding operational pressure. During intense political events, exchanges have incentive to move liquidity off easily identifiable addresses to maintain access to global markets.

Chainalysis noted that “Iranian exchanges routinely move funds to new wallets to obfuscate their activity on the blockchain, knowing that identification of their wallets makes it more difficult to access liquidity to mainstream crypto markets.”

State actors using mainstream exchanges

The Islamic Revolutionary Guard Corps (IRGC) controls roughly 50% of Iran’s crypto ecosystem as of Q4 2025. IRGC-linked addresses received over $3 billion in 2025, up from $2 billion in 2024.

State-sponsored Bitcoin mining operates as a sanctions-evasion tool: licensed miners send BTC to the Central Bank of Iran, which transfers it to overseas counterparties for machinery, fuel, and goods. Transactions settle on the public blockchain but bypass U.S.-controlled banks.

U.S. Treasury and TRM Labs found that Iran-linked exchange Zedcex processed $1 billion in funds tied to the IRGC. State actors historically rely on local platforms during volatility, making their activity harder to distinguish from retail flows.

Why real-time interpretation is so hard

Three complicating factors make it difficult to confidently separate retail flight from exchange operations from state activity:

Internet blackouts. Nobitex was largely inaccessible after the February 28 airstrikes, but blockchain transactions suggest some domestic access remained. During January’s blackout, sophisticated actors with alternative connectivity could still move funds while ordinary citizens couldn’t access centralized services.

Wallet control ambiguity. Many flows appearing to be “withdrawals to new addresses” may terminate at wallets controlled by the same exchange, related entities, or state-linked actors. Without onward movement, it’s premature to assume every outflow represents an end-user.

Operational risk management. Iranian services face cyber threats (like the June 2025 Nobitex hack), potential seizures, and sanctions pressure. This incentivizes aggressive liquidity management during turmoil, exactly when outside observers are most likely to interpret any movement as politically driven.

Chainalysis acknowledged the challenge: “Over the coming days and weeks, we’ll continue to analyze this activity and share updated charts as the on-chain picture becomes clearer.”

Iran’s $7.8 billion crypto shadow economy

The February 28 spike fits a year-long pattern. Iran’s crypto ecosystem reached $7.8 billion in 2025, with notable surges correlating to major political events:

  • January 2024: Kerman bombings killed nearly 100 at a memorial for IRGC commander Qasem Soleimani. On-chain activity surged.
  • October 2024: Iran launched missile strikes on Israel in retaliation for assassinations. Crypto volumes spiked.
  • June 2025: The 12-Day War saw joint U.S.-Israeli strikes on Iran’s nuclear and missile programs, plus cyberattacks on Nobitex and IRGC-linked Bank Sepah. Crypto activity spiked again.
  • December 2025 - January 2026: Mass protests led to a blanket internet blackout on January 8. Bitcoin withdrawals to self-custody surged beforehand, flatlined during the blackout, then resumed immediately after.
  • February 28, 2026: The 700% outflow surge.

Crypto activity acts as a real-time barometer of instability. Blockchain data provides insights into economic impact before traditional financial channels report anything.

The dual narrative: resistance and evasion

Two narratives about Iranian crypto activity both hold true.

Narrative one: Crypto as financial resistance. Ordinary Iranians facing currency collapse, inflation, and authoritarian controls withdraw Bitcoin to self-custody during protests and strikes. It’s capital preservation and financial sovereignty.

Narrative two: Crypto as sanctions evasion. The IRGC uses state-sponsored mining, exchange infrastructure, and cross-border crypto trade to bypass U.S.-controlled banking and fund regional militias.

The February 28 outflows likely contain both behaviors simultaneously. Iranian citizens moving funds to safety. Exchanges repositioning liquidity under pressure. State actors leveraging the same rails.

Blockchain transparency reveals complexity, not simplicity. The same on-chain data showing capital flight also enables authorities to trace where funds go, often with greater precision and speed than traditional financial monitoring allows.

What Bitcoin’s behavior reveals about “safe haven” claims

Bitcoin’s price action on February 28 challenges the “digital gold” narrative.

When airstrikes began, BTC dropped to $63,000 (a 7% selloff). By Sunday, March 1, after confirmation of Ayatollah Khamenei’s death, BTC surged back to $68,600. As of March 2, it’s holding the $66,000-$67,000 range.

If Bitcoin were a true safe haven like gold, it would rise during crisis, not fall. Instead, it behaved like a risk asset during the initial shock, then recovered faster than equities.

But here’s the nuance: Iranian citizens used it for capital flight even as Western markets sold it off. Bitcoin isn’t a safe haven for institutional investors during risk-off events. It is a safe haven for individuals in authoritarian regimes, currency crises, and capital controls.

The threat model determines the asset’s utility.

U.S. enforcement response

U.S. investigators are examining whether crypto platforms helped Iranian officials evade sanctions. Reuters reported in February 2026 that the Treasury Department is targeting exchanges, stablecoin corridors, and liquidity hubs.

TRM Labs analysis identified Iran-linked exchange Zedcex as having processed $1 billion in funds tied to the IRGC. The shift toward “service-layer platforms as repeatable access points for sanctioned networks” highlights the compliance challenge.

VinciWorks noted that once value moves through multiple wallets and exchanges, transactions may not carry obvious Iranian identifiers. “Without robust blockchain analytics, enhanced PEP screening and continuous sanctions list monitoring, institutions risk facilitating capital flight by sanctioned actors.”

The U.S. Scam Center Strike Force, formed in November 2025, has frozen or seized $580+ million in cryptocurrency from transnational crime networks. The scale highlights both crypto’s cross-border crime utility and growing enforcement sophistication.

The pattern extends beyond Iran

This behavior mirrors patterns in other conflict zones:

  • Ukraine (2022-present): Crypto donations to military and humanitarian groups; citizens converting hryvnia to Bitcoin during invasion; cross-border transfers when banking was disrupted.
  • Russia (2022-present): Sanctions pressure driving adoption; citizens preserving wealth amid ruble collapse and capital controls.
  • Nigeria (2020-2021, 2023-2024): #EndSARS protest funding via Bitcoin donations after the government froze activist bank accounts.
  • Hong Kong (2019-2020, 2024): Capital flight via Bitcoin and stablecoins after the national security law; bypassing capital controls.

The common thread: crypto serves as a pressure valve during political and economic crisis. Usage spikes during instability regardless of user motivation.

What the data tells us

The February 28 outflow spike reveals something fundamental about cryptocurrency. It’s not neutral technology. It’s infrastructure that serves competing interests simultaneously.

Ordinary Iranians used it to escape a collapsing currency and preserve optionality. Exchanges used it to maintain liquidity under sanctions. State actors used it to bypass the global financial system.

All three happened at once. Blockchain transparency lets us watch it unfold in real-time, but separating signal from noise requires time, more data, and sophisticated analysis.

The IRGC controls half of Iran’s crypto ecosystem. The U.S. is ramping up enforcement. Iranian citizens are using Bitcoin for capital preservation and resistance. The on-chain data will keep revealing who moved what, where, and why.

For now, the 700% surge stands as proof that crypto functions as real-time economic infrastructure during crisis, for better and worse.

Sources

Updated March 3, 2026