Billions in crypto are moving in Iran. Analysts can't agree if it's war-time panic or business as usual.

Finance

Share

Share this article

Copy linkX (Twitter)LinkedInFacebookEmail

Billions in crypto are moving in Iran. Analysts can't agree if it's war-time panic or business as usual.

When airstrikes hit Iran on Feb. 28, crypto outflows from Nobitex spiked 873%, suggesting a "digital bank run" was ongoing. The reality may be more complex.

By Francisco Rodrigues|Edited by Sheldon Reback

Updated Mar 4, 2026, 4:54 p.m. Published Mar 4, 2026, 4:16 p.m.

Make us preferred on Google

(Amos K/Unsplash/Modified by CoinDesk)

What to know:

• Within minutes of the Feb. 28 airstrikes, crypto outflows from Iran's Nobitex exchange spiked 873%, suggesting a "digital bank run" was ongoing.
• TRM Labs argues the data instead points to Nobitex conducting routine "hot-to-cold" wallet rebalancing to protect its funds as the war escalated.
• Elliptic maintains that capital flight is occurring, noting a persistent daily trickle of funds to overseas exchanges despite nationwide internet blackouts.

In this article

BTCBTC$73,141.05◢7.07%

Within minutes of missiles striking Iranian soil on Feb. 28, blockchain monitors detected the shockwaves in crypto markets.

Withdrawals from the country's crypto exchanges spiked that Saturday, particularly from the country's largest, Nobitex. According to Chainalysis, outflows surged 873%, far beyond what’s considered normal volatility.

The story seemed clear: In a moment of crisis, Iranians rushed to secure their crypto by pulling it off centralized platforms and moving the funds into self-custody wallets. To observers of historical patterns of capital flight, the comparison was obvious. It was a digital bank run.

The picture may not be that simple.

While some firms, including Chainalysis and Elliptic, saw the outflows as evidence of panic and flight from risk, others argued the movement was consistent with operational security measures.

Capital flight?

TRM Labs, a blockchain intelligence company, is one of the dissenters.

According to TRM, the size of the outflow spike is misleading. Because exchange activity was unusually low at the moment of the bombardment, about 10 a.m. local time, even a modest increase in withdrawals created a large percentage change.

"Percentages without context can distort what’s actually happening," Ari Redbord, the global head of policy at TRM Labs, told CoinDesk, pointing out that the spike amounted to only a few million dollars in total.

“In a market that processes billions annually, that scale of activity is not, by itself, evidence of wartime capital flight,” Redbord said. Instead, TRM’s wallet-level tracing revealed a pattern more typical of internal exchange operations, specifically, hot-to-cold wallet rebalancing.

That kind of rebalancing is usually meant to protect funds from potential cyberattacks by moving them into offline wallets, which are less vulnerable to hacks. TRM said that’s exactly what happened here.

Nobitex has strong reasons to act defensively. In June 2025, the exchange was hit by a $90 million cyberattack linked to a pro-Israel hacktivist group. The group not only drained the exchange’s hot wallets but also leaked its internal source code and effectively destroyed the stolen crypto, rendering it unrecoverable.

Since then, security precautions have taken on a new urgency. Viewed through that lens, Nobitex’s behavior following the airstrikes that opened Operation Epic Fury may not reflect panic among users, but a calculated attempt by the exchange to avoid a repeat breach at a time of geopolitical instability.

“Capital flight has a distinct behavioral signature. It tends to show sustained net outflows over multiple days, clustering into identifiable self-custody destinations, and eventual cashout pathways or offshore exchange routing,” Redbord said.

“It also tends to occur in environments where users can actually access platforms. In this case, widespread internet disruptions and exchange-level withdrawal batching materially constrained retail participation."

While he acknowledged that some of the platform’s users could have moved funds in response to the strikes, so far the flows are “limited in size and consistent with operational adjustments inside the exchange.”

The blackout factor

Not all are convinced. Elliptic said what it sees is consistent with capital flight, albeit on a smaller scale than originally suggested. The firm said it’s tracking steady, ongoing outflows from Nobitex to overseas wallets, averaging about $1 million per day.

Even under restricted conditions, including a nationwide internet blackout, transactions have persisted. Elliptic’s founder and chief scientist, Tom Robinson, told CoinDesk that the pattern mirrors earlier blackouts, when volume dipped but outflows to offshore exchanges continued.

“Outflows from Nobitex continue, but at relatively low levels of approximately $1 million per day. This follows the pattern we saw during the previous internet blackout, in January this year - transactions continue but at a lower level,” Robinson said. “We continue to see outflows to overseas exchanges.”

The blackout is a crucial factor in the debate. TRM argues that with large portions of the country offline, a mass exodus of funds by average users would be difficult, if not impossible.

The firm sees the lack of sustained retail outflows, clustering of transactions or routing through known offshore cashout hubs as signs that this is not a broad-based exit.

Chainalysis, for its part, is undecided. While flagging the spike as a possible capital flight indicator, the company said it’s too early to determine the breakdown between retail user behavior and institutional wallet movements.

What’s clear is that even in a crisis, crypto markets remain hard to read and harder to interpret in real time. The open nature of blockchain ledgers provides visibility, but without context, the same data can support competing narratives.

Still, the Iranian regime’s $7.8 billion crypto shadow economy is now in the spotlight. The government has leveraged crypto infrastructure for international trade in the past, while many Iranian people see it as a lifeline.

IranCrypto ExchangesChainalysisEllipticTRM Labs

More For You

Pudgy Penguins: Challenging the Pokemon and Disney Legacy in the Global IP Race

By CoinDesk Research

Feb 27, 2026

Commissioned byPudgy Penguins

CoinDesk Research looks into how Pudgy Penguins disrupts traditional toys market via a phygital model. With 2M+ units sold, they scale via global partnerships and events.

What to know:

• Disrupting a Stagnant Market: Pudgy Penguins is utilizing a "Negative CAC" model to challenge the traditional $31.7B licensed toy industry by treating physical merchandise as a profitable user acquisition tool rather than just a final product.

View Full Report

More For You

Ex-Binance communications lead joins stablecoin specialist KAST

작성자 Ian Allison|편집자 Oliver Knight

3시간 전

Brad Jaffe, the former global communications leader at Binance, becomes chief communications officer at KAST.

알아야 할 것:

• Jaffe handled strategic communications at Binance during a period at the exchange which saw regulatory challenges against a backdrop of rapid growth.
• KAST has made over 300 hires in the past year across engineering, product and compliance.

Read full story

Latest Crypto News

CEO of crypto investment firm Keyrock says bitcoin is undervalued, entering ‘transition year’

13분 전

Brian Armstrong met with Trump before the president slammed banks over crypto bill

14분 전

Crypto campaign PAC Fairshake marks first wins in 2026 U.S. congressional primaries

43분 전

Institutional investors may be buying the dip as traders pour $1.7 billion into spot bitcoin ETFs

46분 전

Crypto Long & Short: Why bitcoin's quantum fears will pass just like the climate panic

46분 전

The Protocol: New Ethereum scaling plans

48분 전

Top Stories

Bitcoin just cleared $73,000, but skeptical traders are already bracing for a 'bull trap'

49분 전

Coinbase, Strategy lead crypto stocks higher as bitcoin spikes above $72,000

2시간 전

Stablecoin giant Tether invests $50 million in sleep technology startup Eight Sleep

3시간 전

Bitcoin 'air pocket' above $72,000 could mean quick run to $80,000

2시간 전

Morgan Stanley taps Coinbase and BNY for custody in proposed Bitcoin ETF

5시간 전

Kraken becomes first crypto company to secure Fed master account access

6시간 전