Headline: Crypto flows spike in Iran after airstrikes — but is it a panic-driven run or routine security moves?
Within minutes of missiles striking Iranian soil on Feb. 28 — the opening salvo of Operation Epic Fury — blockchain monitors registered a dramatic reaction: withdrawals from Iran’s crypto exchanges jumped, led by the country’s largest platform, Nobitex. Chainalysis reported outflows surged 873% that Saturday, a figure that immediately prompted comparisons to a digital bank run.
But analysts are split. Some say this looks like wartime capital flight; others argue the on-chain patterns point to internal, defensive operations by exchanges.
Why the disagreement
- Chainalysis flagged the sharp percentage spike as a possible sign of panic withdrawals, a familiar signature from past crises.
- TRM Labs cautions the statistic is misleading without context. Ari Redbord, TRM’s global head of policy, told CoinDesk that the spike occurred around 10 a.m. local time when overall exchange activity was unusually low — so even modest withdrawals produced a large percentage move. By TRM’s tracing at the wallet level, the flows more closely matched hot-to-cold wallet rebalancing, an exchange practice that shifts funds into offline (cold) storage to reduce hack risk.
- Elliptic takes a middle view: it sees sustained outflows consistent with capital flight, but at a smaller, steady pace — roughly $1 million per day — even during the country’s internet blackout.
Context matters: Nobitex’s recent history
Nobitex has strong incentive to act defensively. In June 2025 the exchange suffered a $90 million cyberattack linked to a pro-Israel hacktivist group; attackers drained hot wallets, leaked internal source code and rendered the stolen funds unrecoverable. That breach appears to have heightened the exchange’s sensitivity to any security threat that could follow geopolitical shocks.
Technical signals vs. real-world constraints
TRM emphasizes behavioral signatures of genuine capital flight: sustained net outflows over multiple days, clustering into identifiable self-custody destinations, and eventual cashout paths through offshore exchanges. Those signatures are largely absent so far, TRM says. The company also notes that large parts of Iran were affected by internet outages at the time — a factor that would limit retail users’ ability to move funds en masse.
Elliptic and others counter that even during blackouts, transactions continue at reduced volumes. Tom Robinson, Elliptic’s founder and chief scientist, points out that earlier blackouts produced similar patterns: lower overall activity but persistent outflows to overseas exchanges.
Chainalysis remains cautious: the firm flagged the outflow spike as a potential capital flight indicator but said it’s too early to determine how much of the movement was retail users trying to secure assets versus institutional or exchange-level wallet maneuvers.
What this tells us about crypto in crisis
The episode highlights how the transparency of blockchains can both help and confuse real-time analysis. On-chain ledgers reveal movement, but without operational and human context the same data can support competing narratives. For a country like Iran — where authorities, businesses and citizens already use crypto to circumvent sanctions and facilitate trade — interpreting these flows has immediate economic and political importance.
And the stakes are high: analysts estimate Iran’s crypto “shadow economy” amounts to roughly $7.8 billion. For many Iranians, crypto remains a financial lifeline; for the state, it’s an avenue for international trade. Against that backdrop, every spike in movement invites scrutiny: is it panic, prudent security posture, or a mix of both?
Key takeaways
- Blockchain monitors detected a large percentage spike in Nobitex withdrawals after Feb. 28 airstrikes; Chainalysis quantified the surge at 873%.
- TRM Labs argues the spike was driven by low baseline activity and looks like hot-to-cold rebalancing rather than mass retail withdrawals.
- Elliptic reports ongoing outflows of roughly $1M/day and says the pattern resembles prior blackout-driven movements to overseas exchanges.
- Internet blackouts and exchange operational practices complicate efforts to label these flows definitively as capital flight.
- Iran’s estimated $7.8B crypto ecosystem keeps these developments geopolitically and economically significant.
Bottom line: the on-chain data shows money moved — but whether it was a wartime scramble or calculated defensive housekeeping is still a live debate.
Read more AI-generated news on: undefined/news
