Iranian Crypto Outflows Spike Amid Geopolitical Tensions

Following recent U.S. And Israeli strikes, Iran witnessed a significant surge in cryptocurrency outflows, raising questions about capital flight and exchange security measures. Although initial reports suggested a “digital bank run,” analysis reveals a more complex picture involving both potential user reactions and proactive security protocols by exchanges like Nobitex.

Initial Spike and Capital Flight Concerns

Within minutes of the February 28 airstrikes, crypto outflows from Nobitex, Iran’s largest cryptocurrency exchange, spiked by 873%, according to CoinDesk. This surge, exceeding typical market volatility, initially led to speculation of a mass withdrawal of funds by Iranians seeking to protect their assets amidst the escalating geopolitical risks. Chainalysis reported that outflows surged far beyond what’s considered normal volatility, suggesting a possible “digital bank run.” crypto worth $10.3 million left Iranian crypto exchanges between Saturday and Monday, according to the Economic Times.

Alternative Explanations: Routine Rebalancing

However, TRM Labs offers a contrasting perspective, arguing that the spike is misleading and primarily reflects routine “hot-to-cold” wallet rebalancing by Nobitex. This practice involves moving funds from readily accessible “hot” wallets to more secure, offline “cold” wallets to protect against potential cyberattacks. Ari Redbord, global head of policy at TRM Labs, noted that the increase amounted to only a few million dollars in a market that processes billions annually, and wasn’t, in itself, evidence of wartime capital flight CoinDesk.

Nobitex’s Security Context

This explanation is particularly relevant given Nobitex’s history. In June 2025, the exchange suffered a $90 million cyberattack attributed to a pro-Israel hacktivist group, as reported by Chainalysis. The attackers not only drained the exchange’s hot wallets but also leaked its source code and rendered the stolen cryptocurrency unrecoverable. This prior incident likely prompted Nobitex to prioritize security measures and proactively rebalance its wallets following the recent airstrikes.

Ongoing Outflows and Internet Blackouts

Despite the rebalancing argument, Elliptic maintains that some capital flight is occurring, observing a persistent daily trickle of funds to overseas exchanges, averaging approximately $1 million per day. This outflow continued even during a nationwide internet blackout, albeit at a reduced volume, mirroring patterns observed during a previous blackout in January. Tom Robinson, founder and chief scientist at Elliptic, stated that the pattern reflects previous blackouts, when volume declined but outflows to offshore exchanges continued CoinDesk.

The Broader Iranian Crypto Landscape

The events highlight the growing role of cryptocurrency in Iran, where transaction volumes reached an estimated $8-11 billion in 2025. The Iranian government has utilized crypto infrastructure for international trade, while many Iranians view it as a vital financial lifeline. The United States is currently investigating whether crypto platforms have facilitated sanctions evasion by Iranian officials Economic Times.

interpreting cryptocurrency market movements during times of crisis remains challenging. The transparency of blockchain technology provides valuable data, but contextual analysis is crucial to differentiate between routine operational adjustments and genuine capital flight.