Key Highlights
- In the 48 hours following the joint US-Israeli airstrikes, Bitcoin outflows from Iranian exchanges jumped to approximately $10.3 million
- Analysts identify three primary drivers: retail investors seeking self-custody, exchange-level obfuscation to dodge sanctions, and potential state-actor laundering.
- Historical data from January shows that Iranian users often front-run internet shutdowns, moving assets into private wallets before the state severs connectivity.
On February 28, 2026, joint US-Israeli airstrikes struck Iranian territory in what analysts described as a significant escalation of the long-simmering conflict between the two Western allies and Tehran. Within hours, something else was moving—Bitcoin.
According to on-chain data compiled by Chainalysis tracking Iran’s crypto ecosystem, hourly outflows from Iranian exchanges jumped sharply as news of the strikes broke, with volumes approaching or exceeding $2 million per hour within several hours of the attack. By March 2, cumulative outflows from the start of February 28 had reached approximately $10.3 million—well above typical volumes for that time frame.
In the hours before the strikes, outflows had remained relatively modest and choppy. The inflection point was near-instantaneous: as geopolitical news spread, so did the movement of digital assets.
Where the money moved
A breakdown of the outflows from Iran’s largest exchanges—tracked by wallet origin, transfer size, and destination—paints a nuanced, but telling picture. Significant volumes flowed toward overseas mainstream crypto exchanges, consistent with Iranians seeking access to global liquidity outside the reach of domestic authorities.
A notable share also moved between domestic Iranian exchanges, a pattern often associated with liquidity management or layering, and a substantial portion landed in what researchers classify as ‘other wallets’: addresses with no immediately identifiable exchange affiliation.
Transfer sizes ranged from sub-$100 microtransactions—likely individual retail users—all the way up to transfers exceeding $1 million, pointing to the involvement of institutional or state-level actors alongside ordinary citizens.
Plausible money movers
Researchers are careful to note that on-chain data alone cannot definitively identify the actors behind the surge. Instead, analysts have outlined three plausible, and potentially overlapping, explanations.
1. Ordinary Iranians seeking financial self-preservation
The most straightforward explanation mirrors what analysts observed during Iran’s January 2025 protest wave: everyday Iranians pulling assets off centralized exchanges into self-custodial wallets.
With the rial in freefall and inflation chronically elevated, Bitcoin has increasingly become a hedge—a portable, censorship-resistant store of value that cannot be frozen by a bank or confiscated in a crackdown. Self-custodial crypto wallets preserve optionality and provide liquidity that domestic banking channels cannot guarantee in a crisis.
Also Read: Ledger Under Scrutiny: 30K USDC Vanishes from Air-Gapped Wallet
2. Exchanges reshuffling funds to evade blockchain surveillance
A second explanation relates to how Iranian crypto businesses operate under the constant threat of sanctions enforcement. In sanctioned jurisdictions, exchanges routinely cycle funds through new wallets to obscure their activity on the blockchain—knowing that identified wallets make it harder to access liquidity from mainstream global crypto markets.
The cybersecurity threat is real and acute. In 2025, hackers exploited Nobitex—Iran’s largest crypto exchange—in a high-profile incident resulting in the theft of over $90 million in digital assets.
That breach underscored how Iranian platforms operate with an especially large target on their backs, creating powerful incentives to aggressively manage and move liquidity during periods of political turmoil when outside attention is at its peak.
3. State actors using mainstream exchanges as conduits
The third and most geopolitically sensitive explanation is that Islamic Revolutionary Guard Corps (IRGC)-linked and other state-aligned actors are using mainstream Iranian exchanges as conduits for cross-border fund movement, sanctions evasion, and proxy financing—as they have been documented doing in the past.
The presence of large transfers—some exceeding $1 million—from multiple Iranian exchanges simultaneously is consistent with this type of behavior. In periods of heightened volatility, state actors may seek to move funds before potential additional sanctions, internet blackouts, or international enforcement actions can complicate access.
Iran’s digital dollar
To understand the February 28 spike, it helps to understand the broader economic environment in which it occurred. Iran’s $7.8 billion crypto ecosystem—one of the largest in the Middle East—did not emerge by accident. It was built, in large part, by crisis.
Decades of compounding US and international sanctions have made it functionally impossible for Iranian citizens and businesses to access global banking systems. The rial has lost enormous value over successive political shocks—from the 2018 sanctions reimposition to the assassination of Qasem Soleimani to the 2022 Mahsa Amini protest wave.
Each crisis has eroded trust in the domestic financial system and driven more Iranians toward alternative stores of value, including gold, foreign currency, and increasingly, cryptocurrency.
Bitcoin, in particular, offers something that neither cash nor gold can: near-instant transferability across borders, without intermediaries that can be coerced or shut down. For a population that has lived through repeated internet blackouts imposed by authorities to suppress dissent, the ability to move financial value via a decentralized network—even an imperfect one—carries real and growing appeal.
From Kerman to the protest waves
Analysts first documented this on-chain response pattern during the January 2024 Kerman bombings, when a series of explosions at a memorial ceremony for General Qasem Soleimani killed over 80 people. On-chain activity spiked in the aftermath, consistent with anxious citizens seeking financial cover.
The pattern became even clearer during direct Iran-Israel exchanges of fire in 2024 and into 2025. But it was during the most recent major protest wave that the interplay between political repression and crypto behavior became most starkly visible.
Bitcoin withdrawals from Iranian exchanges to personal wallets had been climbing steadily in the days before authorities imposed a blanket internet blackout on January 8.
Once connectivity was cut, on-chain flows essentially flatlined—not because the desire to move funds had disappeared, but because users could no longer reach the centralized platforms they needed to execute transactions. When internet access was restored, outflows resumed immediately. The implication was clear: many users had anticipated further instability and had moved into self-custody while they still could.
The February 28 strike-driven spike appears to follow the same logic—a near-reflexive financial response to political and military shock.
The limits of real-time analysis
Analysts are candid about the difficulty of drawing firm conclusions from data this close to the triggering events. Several compounding factors make definitive interpretation impossible in the immediate aftermath.
Internet throttling and blackouts—a standard tool of the Iranian authorities during moments of civil or military crisis—can delay or suppress retail responses while sophisticated actors with alternative connectivity, such as VPNs or satellite internet, continue to move funds. This creates a distorted on-chain picture that may undercount retail participation.
There is also the fundamental challenge of wallet attribution. Many transactions that appear to be user withdrawals may, in fact, terminate at wallets still controlled by the same exchange, a related entity, or a state-linked intermediary. Without tracing the subsequent movement of funds, it is premature to assume that every outflow represents genuine end-user flight.
Notably, while Nobitex has been largely inaccessible since the airstrikes, blockchain transactions in and out of the service suggest some domestic access has persisted, raising further questions about who is still operating through the platform and under what conditions.
Researchers have indicated they will continue to analyze the activity over the coming days and weeks, with updated data and a more definitive interpretation expected as the on-chain picture crystallizes.
Also Read: XRP ETFs See Inflows Even As US-Iran War Shakes Crypto Markets
