Iran’s domestic cryptocurrency ecosystem has entered a defensive phase following U.S. and Israeli strikes that began on Feb. 28, according to new analysis from TRM Labs.
Transaction volume across Iranian exchanges fell by roughly 80% between Feb. 27 and March 1, TRM reported in a Monday blog post. The firm attributed the decline primarily to regime-imposed internet restrictions rather than systemic exchange failure.
Iran’s internet connectivity declined by approximately 99% after authorities implemented restrictive measures as hostilities escalated. TRM noted similar connectivity collapses during prior unrest, including the Iran-Israel conflict in summer 2025 and mass protests in January 2025. Retail users lost reliable access. Market makers lost API connectivity. Automated systems disconnected. Arbitrage activity slowed.
The contraction in crypto activity aligns with those functional constraints. TRM described the pattern as liquidity stress compounded by near-total connectivity disruption.
“It appears that the country’s crypto ecosystem is not showing signs of acceleration or capital flight, but instead experiencing a downturn in both transactions and volume as the regime enforces strict internet blackouts,” TRM wrote.
Exchanges remain online under tight controls
Despite the sharp decline in flows, major Iranian exchanges continued operating. They shifted into risk containment mode.
Nobitex, the country’s largest exchange, stated that deposits and withdrawals remained available “to the extent possible,” though it warned of delays and reduced market depth. Wallex suspended crypto withdrawals and cited infrastructure instability. Bitpin urged users to avoid emotionally driven trades and prepare for connectivity disruptions. Aban Tether temporarily halted both crypto and rial withdrawals. Ramzinex paused crypto deposits and withdrawals while stating that user assets remained secured in cold wallets. Tabdeal moved crypto withdrawals to twice-daily batch processing and warned of delays of up to 24 hours.
Exchanges also adjusted leverage, paced withdrawals and emphasized internal safeguards. TRM described these steps as consistent with stress management during volatility and infrastructure instability.
A coordinated measure targeted the USDT–toman trading pair, the primary crypto–fiat bridge in Iran. Under direction from Iran’s Central Bank, Nobitex, Wallex, and Tabdeal paused trading of the dollar-pegged Tether pair against the rial. Exchanges canceled open orders and suspended the market overnight.
When trading resumed, platforms reported thin order books and short-lived price dislocations. Nobitex cited a supply–demand imbalance and reversed certain liquidations. Bitpin acknowledged a brief pricing anomaly and committed to compensating affected users. Tabdeal activated internal risk controls and insurance mechanisms to limit cascading liquidations. TRM characterized these developments as impaired liquidity rather than structural insolvency.
Dispute over capital flight claims
On-chain movements at Nobitex drew attention in the hours surrounding the strikes. TRM identified an increase of nearly $3 million in combined inflows and outflows on Feb. 28 compared with the previous day. The firm attributed the change to an internal transfer on Polygon from a Nobitex hot wallet to cold storage. TRM also observed a separate cold storage transfer exceeding $35 million. It assessed both as routine internal liquidity management.
“Nobitex shows larger incoming and outgoing activity on the days around the initiation of US-Israeli strikes on February 28,” TRM wrote, but it added that the transactions fell within normal operational range.
A separate report from Elliptic reached a different interpretation. Elliptic stated that outflows from Nobitex surged by more than 700% to over $500,000 within minutes of the first airstrikes, with nearly $3 million leaving the exchange in a single hour later that day.
“The surge in crypto asset outflows last Saturday potentially represents capital flight from Iran,” Elliptic CEO Tom Robinson wrote.
TRM cautioned against that conclusion. It stated that recent transaction data align more closely with mechanical access limitations than a collapse in infrastructure. The firm wrote that it “cautions against drawing conclusions regarding capital flight at this time.”
A large but sanctioned ecosystem
TRM estimates that approximately $11 billion in total crypto activity has linked to Iran from the beginning of 2025 to the present. All crypto activity associated with Iran constitutes sanctioned exposure under broad restrictions on the country’s financial sector.
Digital assets serve as a financial outlet for many Iranians who face currency instability and restricted access to traditional banking. At the same time, enforcement cases have shown that state-linked actors have used crypto infrastructure for sanctions evasion. TRM previously highlighted the case of Zedcex and related UK-registered exchanges, later sanctioned by the U.S. Treasury, which processed stablecoin flows tied to Iran’s Islamic Revolutionary Guard Corps.
For now, the data point to stress rather than systemic breakdown. Exchanges operate under constraint. On-chain flows have thinned. Whether activity normalizes depends on the restoration of stable internet access and the trajectory of the broader conflict.
Oleksii Shumak
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
