---

Crypto outflows from Iranian exchanges surged dramatically in the 72 hours following coordinated US and Israeli airstrikes on Iran that began February 28, 2026. Blockchain analytics firms Chainalysis and Elliptic each documented the spike independently, with total outflows from Iranian platforms reaching $10.3 million between February 28 and March 2. The strikes, which targeted IRGC facilities, military infrastructure, and nuclear sites including Natanz, also killed Supreme Leader Ayatollah Ali Khamenei. The immediate crypto response reflected patterns analysts have seen repeatedly during Iranian crises, representing one of the more significant recorded spikes in recent years.

The Numbers

Elliptic tracked outgoing transaction volume from Nobitex, Iran's dominant exchange with more than 11 million registered users and roughly 87% of all Iranian-linked crypto flows, and found it jumped approximately 700% within minutes of the first strike confirmations. Peak hourly outflows from Nobitex reached $2.89 million between 1100 and 1200 GMT on February 28, about eight times the prior day's peak. Chainalysis put the broader surge at 873% above the 2026 hourly average when accounting for all Iranian exchanges tracked.

Despite those outflow spikes, overall domestic trading volume collapsed. TRM Labs reported an approximately 80% drop in Iranian crypto trading between February 27 and March 1, driven largely by regime-imposed internet shutdowns that cut connectivity to nearly 99% loss for most of the population. Retail traders, API-based systems, and market makers all lost access simultaneously.

Multiple exchanges moved to manage the resulting pressure. Wallex suspended crypto withdrawals entirely. Ramzinex moved assets into cold storage (offline wallets held for security) and halted deposits and withdrawals. Tabdeal shifted to twice-daily batch processing with 24-hour delays. Nobitex flagged reduced market depth and slower withdrawals. Bitpin issued risk-management guidance to users, according to TRM Labs. Iran's central bank separately ordered a temporary halt to USDT-toman trading, cutting off the primary bridge between crypto and Iran's national currency and producing thin order books and brief price dislocations once trading reopened.

At the time of the strikes, Bitcoin was trading between $63,000 and $64,000, later recovering to approximately $65,500 to $68,000. Ether declined roughly 3.8% to around $1,930, and oil prices spiked approximately 6%, reflecting the broader market environment in which the crypto outflows occurred.

Who Was Moving Funds and Why

Analysts are cautious about attributing intent. Chainalysis wrote in a March blog post that "some of these flows are almost certainly ordinary Iranians moving funds in response to rising risk," while others may be exchanges reshuffling liquidity, attempting to reduce the visibility of their operations on-chain, or state-aligned actors leveraging mainstream platforms to transfer funds. Elliptic co-founder and Chief Scientist Dr. Tom Robinson described the activity as potentially representing "capital flight from Iran that bypasses the traditional banking system." TRM Labs characterized the overall situation as "liquidity stress rather than systemic failure."

The state-actor dimension carries significant weight. Chainalysis data indicates that IRGC-associated addresses accounted for over $3 billion in crypto flows in 2025, representing roughly 50% of Iran's total crypto ecosystem in the fourth quarter of that year. That scale underscores why analysts cannot rule out coordinated institutional movement alongside ordinary civilian capital flight.

Structural context matters here as well. As Chainalysis has noted, "Bitcoin withdrawals represent a rational response to the collapse of the Iranian rial, which has lost nearly all of its value." For ordinary Iranians, crypto has long functioned as a store of value and an escape from a depreciating currency, which means a portion of the post-strike outflows reflects rational self-preservation rather than sanctions evasion.

The technical preference is telling. TRON-based USDT (the TRC-20 stablecoin standard) dominates Iranian crypto infrastructure, accounting for roughly $2 billion of Nobitex's 2025 volume. TRON's low transaction fees, deep liquidity, and compatibility with hawala-style informal money networks make it well suited for rapid, cross-border value transfer. Elliptic's initial tracing indicated outgoing funds were routed to overseas exchanges with prior documented inflows from Iran.

Regional Exposure

The outflows carry implications well beyond Iran's borders. Dubai and the UAE more broadly serve as the most established offshore destination for Iranian crypto capital. Reports from Chainalysis and Insight Threat Intel indicate more than $1.5 billion was transferred toward Dubai within 48 hours of the strikes, largely via crypto channels. That concentration is likely to intensify scrutiny from the Financial Action Task Force (FATF), the global body that monitors money laundering and terrorist financing risks, toward UAE-based exchanges and over-the-counter trading desks.

Turkey functions as a secondary corridor, with facilitator networks historically routing IRGC-linked funds through Turkish exchanges. Analysts assessing the post-strike flows have noted that outflows likely passed through Turkey-based intermediaries as an additional routing hop, extending the geographic reach of Iranian capital movement beyond the UAE.

South Asia faces indirect exposure as well. Pakistan is a top-five P2P Bitcoin market globally, and informal currency networks there have long-standing links to Iranian hawala operations. A surge in USDT liquidity moving through UAE and Turkish intermediaries could pass through Pakistani channels, complicating that country's ongoing efforts to formalize its crypto regulatory framework.

India faces related compliance pressure. The country's hawala-and-crypto underground economy maintains informal links with Iran via UAE intermediaries, raising compliance implications for Indian exchanges and the country's Financial Intelligence Unit.

Afghanistan presents a distinct concern. Afghan crypto corridors, one of the few financial lifelines for a largely bank-excluded economy, have been flagged by researchers as potential transit routes for fleeing Iranian capital, an exposure that US Treasury monitoring teams are tracking.

The Yemen connection adds a further geopolitical dimension. Iran's IRGC Quds Force has funded the Houthi movement (Ansarallah) through an oil-to-crypto pipeline in which Iranian oil, relabeled as "Malaysian blend," is sold to buyers in East Asia with proceeds returned via cryptocurrency. Facilitator networks associated with Sa'id al-Jamal alone moved nearly $1 billion in illicit crypto funds through this structure. With Supreme Leader Khamenei killed in the strikes, the continuity of these funding flows is now uncertain, a development with direct implications for Red Sea shipping security and supply chains serving South Asia and East Africa.

In Sub-Saharan Africa, platforms like Yellow Card and Binance's peer-to-peer network serve as active USDT liquidity endpoints for Middle East and North Africa capital flows. Because Iranian exchanges rely on the same TRON infrastructure that powers P2P markets across Nigeria, Kenya, and Egypt, Iranian flight capital can blend with ordinary emerging-market flows on-chain, making detection harder for compliance teams.

What Comes Next

The events of the past week arrive against a backdrop of escalating enforcement pressure on Iran's crypto ecosystem. In January 2026, OFAC designated two UK-registered exchanges linked to IRGC financing: Zedcex Exchange Ltd. and Zedxion Exchange Ltd. The action was significant as the first time OFAC specifically targeted digital asset exchanges for operating within Iran's financial sector; both entities have been linked to Iranian businessman Babak Morteza Zanjani. In July 2025, Tether froze 42 Iranian-linked addresses in what represented the company's largest-ever freeze of Iranian-linked addresses. Nobitex suffered a $90 million exploit in June 2025, attributed to the pro-Israel hacker group Predatory Sparrow (Gonjeshke Darande).

Analysts have linked prior Iranian crises to behavioral shifts in the country's crypto user base, with outflows historically spiking in anticipation of and during periods of elevated geopolitical risk.

With regime leadership in flux and sanctions enforcement tightening, exchanges globally that handle TRON-based USDT flows face renewed pressure to upgrade real-time on-chain screening. Tether itself may face calls to proactively freeze addresses receiving post-strike outflows, consistent with its July 2025 precedent. Whether the current outflows represent ordinary people protecting savings or something more coordinated, compliance analysts note that the window for tracing and attributing those flows narrows quickly as funds move through layered intermediaries.