TL;DR
- On-chain data shows a sharp increase in activity from major Iranian exchanges in the hours following the February 28, 2026 US-Israeli airstrikes, with roughly $10.3M in cryptoasset outflows between February 28 and March 2.
- This spike fits a broader pattern we highlighted in our recent analysis of Iran’s $7.8 billion crypto ecosystem in 2025, where trading volumes and on-chain movements tend to surge around major geopolitical shocks and domestic unrest.
- Further analysis reveals important nuance: most funds are sent to wallets that could be Iranian citizens’ personal wallets, new infrastructure for Iranian exchanges, or withdrawals by state actors. In the immediate aftermath of events like this weekend’s strikes, it’s too early to say how much of the activity reflects each. As more time passes, onward funds movements will sharpen the picture.
A familiar pattern: crypto as a pressure valve in times of crisis
In January, we published an analysis of Iran’s growing $7.8 billion crypto ecosystem, showing how on-chain activity consistently spikes around major domestic and regional shocks — from the Kerman bombings in early 2024 to direct clashes with Israel in 2024–2025. Those episodes coincided with a collapsing rial, high inflation, and mounting sanctions pressure, creating powerful incentives for both the state and ordinary Iranians to turn to crypto as an alternative channel for value transfer and storage.
We also documented how Bitcoin withdrawals from Iranian exchanges to personal wallets surged during the most recent protest wave, as citizens sought a self-custodial hedge against economic instability and potential crackdowns — until authorities imposed a blanket internet blackout that restricted access to centralized platforms.
New analysis of cumulative BTC outflows during that period shows this even more clearly: volumes climbed steadily in the days leading up to the January 8 blackout, then essentially flatlined while connectivity was cut, before picking up pace again once internet access was restored. In other words, many users appeared to anticipate further instability and moved into Bitcoin while they still could, with flows resuming as soon as they were able to reach exchanges again.
The new activity we’re seeing in the wake of the February 28 airstrikes appears to follow this same basic pattern: major geopolitical escalation, followed by a burst of on-chain movement.
Hourly outflows from Iranian exchanges surge higher than usual
In the hours before the strikes, outflows remain relatively modest and choppy. Once news of the joint US-Israeli strikes breaks on February 28, hourly volumes jump sharply — within several hours approaching or exceeding $2 million.
By March 2, total outflows since the start of February 28 reached approximately $10.3M – higher than typical volumes in that time frame.
Nuance behind the spike: three plausible explanations for the outflow
While the sharp incline in outflows tell us that “something big” is happening, they don’t tell us exactly who is moving funds or why. A closer look at outflows from major Iranian exchanges starting on February 28, broken down by transfer size and destination category, offer some possible explanations.
On the left, we see several of Iran’s largest platforms as the origin points for transfers. In the middle, flows are grouped into size buckets (from sub-$100 transfers up to transfers above $1 million), and on the right, we see where those funds go by category. As expected, there are significant outflows to overseas mainstream exchanges, as well as to other domestic Iranian exchanges. Notably, a substantial share of outflows land in “other wallets,” which could include a combination of three plausible explanations:
1. Iranians moving funds off exchanges
One explanation is consistent with what we observed during recent protest waves: ordinary users pulling assets off centralized exchanges into self-custody as a hedge against instability. Self-custodial crypto wallets provide safety and liquidity and preserve optionality.
2. Iranian exchanges cycling funds to obfuscate activity
Crypto businesses in sanctioned jurisdictions like Iran routinely move funds to new wallets to obfuscate their activity on the blockchain, knowing that, due to comprehensive sanctions, identification of their wallets make it more difficult for them to access liquidity to mainstream crypto markets. In 2025, hackers exploited Nobitex — Iran’s largest crypto exchange — in a high-profile incident resulting in the theft of over $90 million in assets, underscoring the importance of strong operational and cybersecurity for Iranian platforms that operate with an especially large target on their backs.
In times of intense political pressure, Iranian exchanges are particularly motivated to move sizable amounts of liquidity off easily identifiable addresses into newly created wallets or into other services. The presence of larger transfers from multiple Iranian exchanges is consistent with this type of behavior.
3. State actors leveraging mainstream Iranian exchanges
A third possibility is that state-aligned actors are using mainstream Iranian exchanges as conduits for laundering and cross-border trade, as they have in the past. IRGC-linked and other state actors have historically relied on local platforms and their counterparties to move and cash out funds tied to sanctions evasion, proxy financing, and illicit trade. Some portion of the current flows could therefore reflect these actors moving funds through the same domestic rails in a time of heightened volatility.
Why real-time interpretation is so hard
The truth is that from this close to the events, it’s extremely difficult to confidently separate retail flight from service-level wallet management, from state-related activity. Several factors complicate the picture:
- Internet blackouts and throttling. During previous protest waves, authorities imposed a blanket internet blackout that made it difficult for ordinary Iranians to access centralized services even as on-chain activity patterns shifted. Similar disruptions around major security events can delay or mute retail response while still allowing sophisticated actors with alternative connectivity to move funds.
- Service-controlled wallets vs. user-controlled wallets vs. state-controlled wallets. Many flows that appear to be withdrawals to new addresses may, in fact, terminate at wallets controlled by the same exchange, related entities, or state-linked actors. Without additional onward movement of funds, it’s premature to assume that every outflow from an exchange represents an end-user.
- Operational risk management. In addition to sanctions pressure, Iranian services must navigate cyber threats and potential seizures, incentivizing aggressive liquidity management during periods of turmoil — exactly when outside observers are most likely to interpret any movement as politically driven.
While Nobitex has largely been inaccessible since the airstrikes, blockchain transactions in and out of the service suggest there must be some domestic access
In short, there are multiple interpretations. Some of these flows are almost certainly ordinary Iranians moving funds in response to rising risk. Others may be exchanges reshuffling liquidity or attempting to reduce the visibility of their operations on-chain, or state-aligned actors leveraging mainstream platforms to transfer funds. Distinguishing among these possibilities requires more time, more data, and deeper wallet-level analysis than is possible in the immediate aftermath of the strikes.
Over the coming days and weeks, we’ll continue to analyze this activity and share updated charts and a more definitive interpretation as the on-chain picture becomes clearer.
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.
