Iran’s Crypto Flows Drop 11% in Q1 of 2025 Amid Geopolitical Strains and Exchange Hack: TRM Report

Total cryptocurrency flows involving Iranian entities fell to $3.7 billion between January and July 2025, representing an 11% decline compared with the same period in 2024, according to new analysis by blockchain intelligence firm TRM Labs.

The sharpest contraction came after April, with inflows in June plunging by more than 50% year-over-year, and July volumes down over 76%.

TRM said the downturn coincided with multiple shocks: the breakdown of nuclear negotiations, a 12-day conflict with Israel beginning June 13, and widespread power outages in Iran caused by Israeli kinetic and cyber operations as well as regime-initiated shutdowns.

“What we are seeing in Iran is an ecosystem under severe strain from geopolitical turmoil, enforcement actions, and a loss of confidence in domestic exchanges,” TRM Labs notes in its analysis.

Nobitex Remains Central Despite $90 Million Hack

Despite the disruption, Nobitex, Iran’s largest exchange, continued to dominate the market in 2025. TRM data shows Nobitex processed more than 87% of Iranian-linked transaction volume, with USD 2 billion of its USD 3 billion activity flowing through the TRON network, primarily in TRC-20 USDT and TRX.

However, Nobitex’s central role also amplified systemic risk. On June 18, the platform suffered a USD 90 million hack attributed to the pro-Israel group Predatory Sparrow.

The incident froze liquidity, slowed transaction processing, and forced users to temporarily migrate to alternative platforms.

TRM researchers noted that outflows from Nobitex surged 150% in the week leading up to the Iran–Israel conflict, as users sought safer venues. Many of these funds were redirected to global exchanges with limited Know Your Customer (KYC) controls, or to high-risk platforms operating with no KYC checks at all.

Tether Freeze Deepens Market Disruption

Market turbulence was compounded on July 2, 2025, when Tether froze 42 addresses linked to Iranian entities — the largest such action to date.

More than half of the frozen wallets had substantial exposure to Nobitex, with some also connected to Iranian Revolutionary Guard Corps (IRGC)-affiliated actors previously flagged by Israeli authorities.

“The Tether freeze disrupted entrenched settlement channels and forced both retail and institutional users to rapidly diversify their stablecoin strategies,” TRM Labs said.

In response, government-aligned channels and some domestic exchanges urged users to offload USDT and pivot toward DAI on the Polygon network, citing lower transaction costs and resilience against sanctions-driven freezes.

Illicit Activity Low, But Crypto Remains Sanctions Tool

TRM emphasized that while Iranian actors continue to leverage crypto for sanctions evasion and procurement of sensitive goods, illicit activity at Iranian exchanges accounted for just 0.9% of total volume — roughly in line with global averages.

Everyday Iranians are also turning to crypto as a hedge against inflation and financial instability, despite declining trust in local platforms. “For many ordinary citizens, crypto remains an indispensable savings vehicle amid currency depreciation and limited access to international finance,” TRM reported.

Nevertheless, the June hack revealed deeper structural issues. TRM analysis linked on-chain flows at Nobitex to IRGC-linked actor Amir Hossein Nikaeen Ravari and to Gaza Now, a pro-Hamas outlet sanctioned after the October 2023 attacks on Israel. Investigators also uncovered Nobitex code designed for warrantless surveillance, further eroding public trust.

A Fragile but Adaptive Ecosystem

Despite contraction, Iran’s crypto economy continues to adapt under pressure. Mining activity remains a core revenue source for Tehran, with TRM tracking previously dormant wallets tied to bitcoin miners moving funds into Nobitex’s new hot wallet after the hack.

Meanwhile, underground networks such as Novin Verify are expanding, offering forged IDs and KYC bypass tools to sanctioned users seeking access to foreign platforms.

TRM also reported the first documented cases of cryptocurrency being used to pay foreign operatives for espionage, showing crypto’s widening role in Iran’s geopolitical playbook.

“While confidence in domestic exchanges is deteriorating, Iranians are demonstrating agility in migrating to new stablecoins, new chains, and new settlement methods,” TRM Labs concluded. “The ecosystem remains fragile, but highly adaptive.”