Elliptic recorded a sharp spike in cryptocurrency withdrawals from Iranian exchanges beginning February 28, as a coordinated US-Israeli military operation killed Supreme Leader Ayatollah Ali Khamenei and triggered what blockchain analytics researchers have described as capital flight among Iranian users. Chainalysis separately tracked the broader pattern of outflows across multiple exchanges over the following days.

The joint operation, codenamed Operation Epic Fury by the United States and Operation Roaring Lion by Israel, targeted Iranian military facilities and senior leadership in Tehran and across the country. Within minutes of the first strikes, outgoing crypto transactions from Nobitex, Iran's largest exchange by volume, jumped 700% above baseline levels according to Elliptic. Between February 28 and March 2, Iranian exchanges recorded approximately $10.3 million in total cryptoasset outflows, per Chainalysis data. Hourly outflow rates peaked between $2 million and $3 million, compared to a pre-strike baseline of roughly $300,000 to $400,000 per hour, per Elliptic and Chainalysis. Bitcoin dropped briefly toward $63,000 to $64,000 in the immediate aftermath of the February 28 strikes, with roughly $100 million in long positions liquidated within 15 minutes of the first reports. Prices later recovered.

Nobitex buckled under the pressure almost immediately. The exchange suspended its Tether/Toman trading pair on February 28, citing an emergency situation. When trading resumed, the platform reported supply and demand imbalances and liquidated user positions that fell below 145,000 Tether per Toman. Internet outages across Iran slowed withdrawal processing throughout the period. Conor Grogan, a Director at Coinbase, noted publicly that no outbound Ethereum transactions were processed from Nobitex over the weekend of the strikes, pointing to operational breakdowns at the exchange. At the height of the disruption, the exchange's website returned error 504 messages.

The operational failures under crisis conditions arrived against a backdrop of existing vulnerability. In June 2025, Nobitex suffered a hack in which approximately $90 million in assets were stolen, raising questions about the exchange's infrastructure resilience that the February 2026 events brought back into sharp focus.

Elliptic co-founder and chief scientist Dr. Tom Robinson described the activity as something that "potentially represents capital flight from Iran that bypasses the traditional banking system." The firm added that initial tracing of recent outflows from Nobitex suggests the funds are being sent to overseas cryptoasset exchanges that have historically seen significant inflows from Iran, with early routing patterns pointing to exchanges in Southeast Asia and possibly South Africa. Chainalysis cautioned that it is too early to determine whether the flows came primarily from ordinary users seeking self-custody wallets, exchange liquidity management, or state-linked actors repositioning assets, and that deeper wallet-level analysis over time would be needed to draw firmer conclusions.

The February 2026 crisis is not an isolated incident. Chainalysis has now documented a consistent on-chain pattern across at least four geopolitical shocks in Iran: the January 2024 Kerman bombings, the October 2024 Iranian missile strikes against Israel, the June 2025 twelve-day conflict, and now the February 2026 airstrikes. The firm characterized this as a recurring pattern marked by "a sharp increase in activity" in which "digital assets serve as a release valve during moments of stress." Iran's total crypto ecosystem reached $7.78 billion in on-chain volume in 2025, up from $7.4 billion in 2024 and $3.17 billion in 2023.

Iran's crypto infrastructure runs along two parallel tracks, with different motivations on each side. On the civilian side, ordinary Iranians have turned to digital assets as a savings tool because the rial has depreciated roughly 90% since 2018 and annual inflation currently runs between 40 and 50 percent. Nobitex claims 11 million registered users and processed approximately $7.2 billion in transactions in 2025, handling an estimated 87% of Iran's total crypto volume. On the state and military side, the Islamic Revolutionary Guard Corps received more than $3 billion in crypto inflows during 2025 and accounted for over 50% of total Iranian crypto inflows in the fourth quarter of that year, according to Chainalysis aggregate data. Iran's central bank separately accumulated at least $507 million in Tether during 2025, using stablecoins to partially support the rial and finance international trade, with limited success. The US Treasury had already opened probes into crypto exchanges suspected of facilitating Iranian sanctions evasion in the weeks before the airstrikes, according to TRM Labs.

Iran's structural integration with crypto markets extends beyond crisis-driven behavior. The Iranian government legalized crypto mining in 2019, and state miners now produce Bitcoin at approximately $1,300 per coin using subsidized electricity. Iran accounts for an estimated 2 to 5 percent of global Bitcoin mining power, a position that gives state actors direct, ongoing access to cryptocurrency independent of exchange activity and helps explain why the country's relationship with digital assets is structural rather than merely reactive.

What the Iran Data Means for Users Outside the Country

The operational failures at Nobitex during peak demand carry direct relevance for exchange operators and developers in other markets defined by instability. Users in Nigeria, Kenya, and South Africa face structurally similar pressures: currency depreciation, inflation, and political risk have driven widespread stablecoin adoption and peer-to-peer infrastructure that closely mirrors Iran's civilian crypto economy. South Africa appears in the outflow data as well: Elliptic's early routing analysis flagged exchanges in Southeast Asia and possibly South Africa as likely destinations for the departing Iranian funds, a detail that sharpens the regional significance of the crisis for regulators and analysts tracking those markets. Bitcoinke.io, a Nairobi-based crypto news platform, covered the Nobitex outflow surge directly, reflecting regional attention to how centralized exchanges perform under sovereign-level stress.

For regulators in emerging markets, the Chainalysis data adds on-chain weight to a familiar tension. Aggressive exchange controls during crises tend to redirect capital flows rather than contain them, as India's 30% crypto tax regime and Nigeria's 2024 Binance ban have each demonstrated in different ways. According to Chainalysis's analysis of the Iran data, tighter restrictions push users toward harder-to-monitor channels rather than eliminating outflows entirely.

With the broader situation in Iran still unfolding, the full picture of where those funds went remains unclear. Chainalysis has noted that determining whether the flows came from ordinary users, exchange liquidity management, or state-linked actors will require deeper wallet-level analysis over time, a methodological caution that underscores how much of the February 2026 outflow story is still being written.