Chainalysis: Iranian Crypto Outflows Hit $10.3M in Days After US-Israeli Airstrikes

When the first US-Israeli airstrikes hit Tehran on February 28, it took minutes, not even hours, for the on-chain data to move. According to Chainalysis, outflows from major Iranian exchanges climbed sharply almost immediately after news of the strikes broke, approaching or exceeding $2 million per hour at the peak. 

By March 2, cumulative outflows from the start of February 28 had reached approximately $10.3 million. Separately, Elliptic tracked a 700% surge in outgoing transaction volumes from Nobitex, Iran’s largest crypto exchange, in the minutes following the first strike, with withdrawals hitting a peak of nearly $3 million per hour before settling.

The speed of that reaction is quite striking, but it isn’t surprising. Iran has one of the more developed crypto ecosystems in the Middle East, built by decades of compounding economic crisis. 

In a January report, Chainalysis estimated that total crypto activity tied to Iran reached $7.8 billion in 2025, driven by a collapsing rial, inflation running at historic highs, and a population that has learned, through repeated experience, that the domestic financial system can be weaponized or shut down at short notice. 

Crypto, Bitcoin in particular, offers something that neither cash nor gold can: near-instant cross-border transferability without intermediaries that can be coerced or cut off.

A Pattern That Has Played Out Before

To understand what happened on February 28, it helps to zoom out. Chainalysis has documented how Bitcoin withdrawals from Iranian exchanges to personal wallets surged during the most recent protest wave, as citizens moved into self-custody ahead of anticipated instability, right up until the government imposed an internet blackout that severed access to centralized platforms. 

The cumulative outflow data from that period tells the story cleanly, which is that volumes climbed steadily in the days leading up to the January 8 blackout, flatlined while connectivity was cut, and picked up again once access was restored. People who could see the blackout coming moved early. Those who couldn’t were stuck.

The February 28 spike appears to follow the same basic arc. In the hours before the strikes, outflows from Iranian exchanges were relatively quiet. The inflection point was near-instantaneous. Nobitex posted on its Telegram channel that it was suspending the Tether/Toman market “due to the current emergency situation and per the directive of the Central Bank.” 

When it reopened, the exchange acknowledged that user positions priced below 145,000 Tether/Toman had been liquidated as a result of what it called “a temporary disruption in supply and demand balance.” 

The rial, which had already hit a record low on February 19, fell further. Nobitex has been largely inaccessible since the strikes, though blockchain data suggests some domestic access has persisted, raising the question of who, exactly, is still reaching the platform and how.

Three Explanations, None of Which Can Be Ruled Out Yet

Here’s where the honest interpretation gets complicated. A breakdown of the outflows by transfer size and destination shows funds flowing to overseas mainstream exchanges, other domestic Iranian platforms, and a substantial share to unclassified “other wallets.” That last category is where the ambiguity lives. Chainalysis lays out three plausible explanations, none of which is mutually exclusive.

The first is the most sympathetic: ordinary Iranians pulling funds off centralized exchanges into self-custody as a hedge against instability. This is consistent with documented behavior during prior protest waves, and the presence of smaller sub-$1,000 transfers in the data is at least partially consistent with retail activity.

The second is more structural. Iranian exchanges operating under comprehensive sanctions have a persistent incentive to cycle funds across new wallet addresses to obscure their on-chain footprint, making it harder for compliance teams at overseas platforms to identify and block their liquidity. 

In 2025, pro-Israel hackers exploited Nobitex in an attack that drained over $90 million in assets, a breach that raised the operational security stakes considerably for every Iranian platform still running. In periods of peak political pressure, the incentive to move liquidity off well-known addresses and into newly created wallets intensifies sharply. 

The presence of larger transfers exceeding $1 million, originating from multiple exchanges simultaneously, is consistent with this kind of coordinated liquidity management rather than retail flight.

The third explanation is the most geopolitically sensitive. IRGC-linked and other state-aligned actors have historically used mainstream Iranian exchanges as conduits for cross-border fund movement, sanctions evasion, and proxy financing. 

Earlier this year, Iran’s Ministry of Defence Export Center, Mindex, began accepting crypto as payment for weapons sales. Iran’s central bank also quietly accumulated $507 million in Tether’s USDT over the past year, routing most of it through Nobitex to inject dollar liquidity into the domestic market and prop up the rial. 

TRM Labs, separately, found that two UK-registered exchanges, Zedcex and Zedxion, moved $619.1 million on behalf of the IRGC in 2024 alone, accounting for 87% of both firms’ total transaction volume.

Chainalysis is frank about the limits of what the current data can tell us. “The truth is that from this close to the events, it’s extremely difficult to confidently separate retail flight from service-level wallet management, from state-related activity,” the firm wrote. Internet throttling, exchange outages, and aggressive operational security measures can all distort short-term signals. 

What looks like a retail withdrawal surge from the outside may, in many cases, terminate at a wallet still controlled by the same exchange, or by a state-linked actor with the infrastructure to keep moving funds regardless of what’s happening on the surface web. 

The firm says it will continue tracking onward fund movements over the coming days and weeks, with the expectation that a clearer picture will emerge as flows settle and wallet-level analysis deepens. For now, the $10.3 million figure tells us something real happened. It doesn’t yet tell us what.