Exodus or firewall? Blockchain analysts clash over Iran’s crypto outflows

The Initial Observation: A Digital Bank Run

On February 28, shortly after missiles struck Iranian territory, blockchain monitors observed a significant spike in cryptocurrency withdrawals from Iranian exchanges, particularly Nobitex, the country's largest. Chainalysis reported an 873% surge in outflows, a figure far exceeding normal volatility. This led many observers to interpret the event as a digital bank run, where Iranians rushed to secure their assets by moving them from centralized platforms to self-custody wallets during a moment of crisis.

Counterarguments: Operational Security and Context

However, some blockchain intelligence firms, including TRM Labs, offered a different perspective. TRM Labs argued that the large percentage increase was misleading due to unusually low trading volume at the time of the airstrikes. Ari Redbord of TRM Labs noted that the total withdrawal amount was only a few million dollars, which is not substantial enough on its own to indicate wartime capital flight in a market that handles billions annually.

TRM's analysis of wallet-level tracing suggested the movements were more consistent with internal exchange operations, specifically hot-to-cold wallet rebalancing. This process is typically undertaken to enhance security by moving funds to offline wallets, which are less susceptible to cyberattacks. Nobitex has a history of security concerns, having been targeted by a $90 million cyberattack in June 2025 by a pro-Israel hacktivist group. This event led to the draining of its hot wallets and the leakage of its source code, underscoring the urgency for enhanced security measures.

Redbord further explained that capital flight typically exhibits a distinct pattern, including sustained net outflows over several days, clustering into specific self-custody destinations, and eventual routing to offshore exchanges or cashout points. He also pointed out that widespread internet disruptions and withdrawal batching by exchanges would have constrained retail participation during the event.

Continued Outflows and the Blackout Factor

Despite TRM's analysis, other firms like Elliptic maintain that the outflows are consistent with capital flight, albeit on a smaller scale. Elliptic reported tracking steady outflows averaging about $1 million per day from Nobitex to overseas wallets, even during a nationwide internet blackout. Tom Robinson, Elliptic's founder, noted that this pattern mirrors previous internet blackouts where transactions continued at lower levels.

TRM Labs countered that the extensive internet disruptions would make a mass exodus by average users difficult. They cited the lack of sustained retail outflows, transaction clustering, or routing through known offshore hubs as evidence against a broad-based exit. Chainalysis remains undecided, acknowledging the spike as a potential indicator of capital flight but stating it is too early to differentiate between retail user behavior and institutional movements.

Interpreting Blockchain Data in Crisis

The events highlight the difficulty in interpreting blockchain data in real-time, especially during crises. While blockchain ledgers offer visibility, the same data can support competing narratives without sufficient context. Iran's significant crypto ecosystem, valued at $7.8 billion, plays a dual role, serving as a tool for international trade for the regime and a financial lifeline for its citizens.