Inside minutes of a missile hitting mainland Iran on February 28, blockchain displays detected shockwaves within the cryptocurrency market.
That Saturday, there was a surge in withdrawals from home cryptocurrency exchanges, particularly Nobitex, the nation's largest. In line with Chainalysis, outflows jumped 873%, far exceeding what can be thought of regular volatility.
The scenario appeared clear. In the meanwhile of disaster, Iranians rushed to safe their cryptocurrencies by withdrawing them from centralized platforms and transferring funds to self-custodial wallets. For anybody observing historic patterns of capital flight, the comparability was apparent. It was a digital financial institution run.
The picture is probably not so easy.
Some firms, together with Chainalysis and Elliptic, noticed the breach as proof of panic and threat aversion, whereas others argued the transfer was per operational safety measures.
Capital flight?
Blockchain intelligence firm TRM Labs can be among the many opponents.
TRM says the size of the spike in spills is deceptive. Alternate exercise was unusually low in the mean time of the bombing, round 10 a.m. native time, so even a small improve in withdrawals induced a big proportion change.
“Percentages with out context can distort what is definitely taking place,” Ari Redboard, head of worldwide coverage at TRM Labs, instructed CoinDesk, noting that the spike totaled just a few million {dollars}.
“In a market that processes billions of {dollars} a yr, exercise of that magnitude is just not in itself proof of wartime capital flight,” Redboard mentioned. As an alternative, TRM's wallet-level traces revealed frequent patterns in inner trade operations, particularly rebalancing from scorching to chilly wallets.
The sort of rebalancing usually goals to guard towards potential cyber-attacks by transferring funds to offline wallets which are much less vulnerable to hacking. TRM mentioned that's precisely what occurred right here.
Novitex has robust causes to behave defensively. In June 2025, the trade suffered a $90 million cyberattack linked to a pro-Israel hacktivist group. The group not solely compromised the trade's scorching wallets, but in addition leaked its inner supply code, successfully destroying stolen cryptocurrencies and making them unrecoverable.
Since then, safety measures have taken on new urgency. Considered by means of that lens, Nobitex's actions after the airstrike that triggered Operation Epic Fury might not replicate panic amongst its customers, however moderately a calculated try by the trade to keep away from repeated breaches throughout a time of geopolitical instability.
“Capital flight has distinct behavioral traits; it tends to exhibit sustained internet outflows over a number of days, a focus in identifiable self-custody, and in the end cash-out channels and offshore trade routing,” Redboard mentioned.
“This additionally tends to happen in environments the place customers do have bodily entry to the platform; on this case, widespread web disruption and exchange-level batch processing of withdrawals considerably restricted retailer participation.”
He acknowledged that some platform customers might have moved funds in response to the strike, however mentioned the move to date has been “restricted in scale and per operational changes throughout the trade.”
Energy outage issue
Not everyone seems to be satisfied. Elliptic mentioned what it’s seeing is per capital flight, albeit on a smaller scale than initially recommended. The corporate mentioned it’s monitoring regular and ongoing outflows from Nobitex to abroad wallets, averaging about $1 million per day.
Buying and selling continued even underneath restricted circumstances, together with a nationwide web blackout. Tom Robinson, founder and chief scientist at Elliptic, instructed CoinDesk that this sample displays an earlier outage through which volumes fell however continued to move to offshore exchanges.
“Outflows from Novitex proceed, however at comparatively low ranges of round $1 million per day. This follows the sample seen over the past web blackout in January of this yr, with buying and selling persevering with however at low ranges,” Robinson mentioned. “The outflow to abroad exchanges continues.”
Energy outages are a key aspect of the dialogue. TRM claims that with massive elements of the nation offline, massive outflows of funds by the common consumer are troublesome if not inconceivable.
The corporate views sustained retail outflows, focus of transactions, or lack of routing by means of recognized offshore money out hubs as indicators that this isn’t a widespread exit.
The Chainalysis aspect is undecided. The corporate warned that the spike could possibly be an indicator of capital flight, however mentioned it was too early to find out the breakdown of retail consumer habits and institutional pockets actions.
What is evident is that even in disaster, cryptocurrency markets stay troublesome to learn and interpret in actual time. The open nature of blockchain ledgers offers visibility, however with out context, the identical information can assist competing narratives.
Nonetheless, the Iranian regime's $7.8 billion crypto shadow financial system is now within the highlight. Whereas the federal government has traditionally relied on cryptographic infrastructure for worldwide commerce, many Iranians see it as a lifeline.
