Billions in crypto are moving in Iran. Analysts can't agree if it's war-time panic or business as usual.

When airstrikes hit Iran on Feb. 28, crypto outflows from Nobitex spiked 873%, suggesting a "digital bank run" was ongoing. The reality may be more complex.

Make us preferred on Google

What to know:

• Within minutes of the Feb. 28 airstrikes, crypto outflows from Iran's Nobitex exchange spiked 873%, suggesting a "digital bank run" was ongoing.
• TRM Labs argues the data instead points to Nobitex conducting routine "hot-to-cold" wallet rebalancing to protect its funds as the war escalated.
• Elliptic maintains that capital flight is occurring, noting a persistent daily trickle of funds to overseas exchanges despite nationwide internet blackouts.

Within minutes of missiles striking Iranian soil on Feb. 28, blockchain monitors detected the shockwaves in crypto markets.

Withdrawals from the country's crypto exchanges spiked that Saturday, particularly from the country's largest, Nobitex. According to Chainalysis, outflows surged 873%, far beyond what’s considered normal volatility.

The story seemed clear: In a moment of crisis, Iranians rushed to secure their crypto by pulling it off centralized platforms and moving the funds into self-custody wallets. To observers of historical patterns of capital flight, the comparison was obvious. It was a digital bank run.

The picture may not be that simple.

While some firms, including Chainalysis and Elliptic, saw the outflows as evidence of panic and flight from risk, others argued the movement was consistent with operational security measures.

Capital flight?

TRM Labs, a blockchain intelligence company, is one of the dissenters.

According to TRM, the size of the outflow spike is misleading. Because exchange activity was unusually low at the moment of the bombardment, about 10 a.m. local time, even a modest increase in withdrawals created a large percentage change.

"Percentages without context can distort what’s actually happening," Ari Redbord, the global head of policy at TRM Labs, told CoinDesk, pointing out that the spike amounted to only a few million dollars in total.

“In a market that processes billions annually, that scale of activity is not, by itself, evidence of wartime capital flight,” Redbord said. Instead, TRM’s wallet-level tracing revealed a pattern more typical of internal exchange operations, specifically, hot-to-cold wallet rebalancing.

That kind of rebalancing is usually meant to protect funds from potential cyberattacks by moving them into offline wallets, which are less vulnerable to hacks. TRM said that’s exactly what happened here.

Nobitex has strong reasons to act defensively. In June 2025, the exchange was hit by a $90 million cyberattack linked to a pro-Israel hacktivist group. The group not only drained the exchange’s hot wallets but also leaked its internal source code and effectively destroyed the stolen crypto, rendering it unrecoverable.

Since then, security precautions have taken on a new urgency. Viewed through that lens, Nobitex’s behavior following the airstrikes that opened Operation Epic Fury may not reflect panic among users, but a calculated attempt by the exchange to avoid a repeat breach at a time of geopolitical instability.

“Capital flight has a distinct behavioral signature. It tends to show sustained net outflows over multiple days, clustering into identifiable self-custody destinations, and eventual cashout pathways or offshore exchange routing,” Redbord said.

“It also tends to occur in environments where users can actually access platforms. In this case, widespread internet disruptions and exchange-level withdrawal batching materially constrained retail participation."

While he acknowledged that some of the platform’s users could have moved funds in response to the strikes, so far the flows are “limited in size and consistent with operational adjustments inside the exchange.”

The blackout factor

Not all are convinced. Elliptic said what it sees is consistent with capital flight, albeit on a smaller scale than originally suggested. The firm said it’s tracking steady, ongoing outflows from Nobitex to overseas wallets, averaging about $1 million per day.

Even under restricted conditions, including a nationwide internet blackout, transactions have persisted. Elliptic’s founder and chief scientist, Tom Robinson, told CoinDesk that the pattern mirrors earlier blackouts, when volume dipped but outflows to offshore exchanges continued.

“Outflows from Nobitex continue, but at relatively low levels of approximately $1 million per day. This follows the pattern we saw during the previous internet blackout, in January this year - transactions continue but at a lower level,” Robinson said. “We continue to see outflows to overseas exchanges.”

The blackout is a crucial factor in the debate. TRM argues that with large portions of the country offline, a mass exodus of funds by average users would be difficult, if not impossible.

The firm sees the lack of sustained retail outflows, clustering of transactions or routing through known offshore cashout hubs as signs that this is not a broad-based exit.

Chainalysis, for its part, is undecided. While flagging the spike as a possible capital flight indicator, the company said it’s too early to determine the breakdown between retail user behavior and institutional wallet movements.

What’s clear is that even in a crisis, crypto markets remain hard to read and harder to interpret in real time. The open nature of blockchain ledgers provides visibility, but without context, the same data can support competing narratives.

Still, the Iranian regime’s $7.8 billion crypto shadow economy is now in the spotlight. The government has leveraged crypto infrastructure for international trade in the past, while many Iranian people see it as a lifeline.

More For You

CoinDesk Research looks into how Pudgy Penguins disrupts traditional toys market via a phygital model. With 2M+ units sold, they scale via global partnerships and events.

What to know:

• Disrupting a Stagnant Market: Pudgy Penguins is utilizing a "Negative CAC" model to challenge the traditional $31.7B licensed toy industry by treating physical merchandise as a profitable user acquisition tool rather than just a final product.

More For You

Ex-Binance communications lead joins stablecoin specialist KAST

Brad Jaffe, the former global communications leader at Binance, becomes chief communications officer at KAST.

What to know:

• Jaffe handled strategic communications at Binance during a period at the exchange which saw regulatory challenges against a backdrop of rapid growth.
• KAST has made over 300 hires in the past year across engineering, product and compliance.

Crypto Long & Short: Why bitcoin's quantum fears will pass just like the climate panic

1 min. ago

The Protocol: New Ethereum scaling plans

2 minutes ago

Bitcoin just cleared $73,000, but skeptical traders are already bracing for a bull trap

3 minutes ago

Coinbase, Strategy lead crypto stocks higher as bitcoin spikes above $72,000

1 hour ago

Bitcoin 'air pocket' above $72,000 could mean quick run to $80,000

2 hours ago

CoinDesk 20 performance update: Solana (SOL) gains 5.6%, leading index higher

2 hours ago

Stablecoin giant Tether invests $50 million in sleep technology startup Eight Sleep

3 hours ago

Morgan Stanley taps Coinbase and BNY for custody in proposed Bitcoin ETF

5 hours ago

Kraken becomes first crypto company to secure Fed master account access

5 hours ago

Bitcoin hits one-month high near $72,000 as haven demand rises

5 hours ago

Ray Dalio says 'there is only one gold' as bitcoin outperforms gold during worst geopolitical crisis in years

9 hours ago

Trump’s crypto adviser rejects Jamie Dimon on treating yield-bearing stablecoins like banks

3 hours ago