Inside minutes of missiles hanging Iranian soil on Feb. 28, blockchain displays detected the shockwaves in crypto markets.
Withdrawals from the nation’s crypto exchanges spiked that Saturday, notably from the nation’s largest, Nobitex. Based on Chainalysis, outflows surged 873%, far past what’s thought of regular volatility.
The story appeared clear: In a second of disaster, Iranians rushed to safe their crypto by pulling it off centralized platforms and shifting the funds into self-custody wallets. To observers of historic patterns of capital flight, the comparability was apparent. It was a digital financial institution run.
The image might not be that easy.
Whereas some corporations, together with Chainalysis and Elliptic, noticed the outflows as proof of panic and flight from danger, others argued the motion was according to operational safety measures.
Capital flight?
TRM Labs, a blockchain intelligence firm, is without doubt one of the dissenters.
Based on TRM, the scale of the outflow spike is deceptive. As a result of alternate exercise was unusually low in the intervening time of the bombardment, about 10 a.m. native time, even a modest enhance in withdrawals created a big proportion change.
“Percentages with out context can distort what’s truly taking place,” Ari Redbord, the worldwide head of coverage at TRM Labs, instructed CoinDesk, declaring that the spike amounted to just a few million {dollars} in whole.
“In a market that processes billions yearly, that scale of exercise isn’t, by itself, proof of wartime capital flight,” Redbord stated. As a substitute, TRM’s wallet-level tracing revealed a sample extra typical of inner alternate operations, particularly, hot-to-cold pockets rebalancing.
That sort of rebalancing is normally meant to guard funds from potential cyberattacks by shifting them into offline wallets, that are much less susceptible to hacks. TRM stated that’s precisely what occurred right here.
Nobitex has sturdy causes to behave defensively. In June 2025, the alternate was hit by a $90 million cyberattack linked to a pro-Israel hacktivist group. The group not solely drained the alternate’s scorching wallets but in addition leaked its inner supply code and successfully destroyed the stolen crypto, rendering it unrecoverable.
Since then, safety precautions have taken on a brand new urgency. Seen via that lens, Nobitex’s conduct following the airstrikes that opened Operation Epic Fury might not replicate panic amongst customers, however a calculated try by the alternate to keep away from a repeat breach at a time of geopolitical instability.
“Capital flight has a definite behavioral signature. It tends to point out sustained web outflows over a number of days, clustering into identifiable self-custody locations, and eventual cashout pathways or offshore alternate routing,” Redbord stated.
“It additionally tends to happen in environments the place customers can truly entry platforms. On this case, widespread web disruptions and exchange-level withdrawal batching materially constrained retail participation.”
Whereas he acknowledged that a number of the platform’s customers might have moved funds in response to the strikes, to this point the flows are “restricted in measurement and according to operational changes contained in the alternate.”
The blackout issue
Not all are satisfied. Elliptic stated what it sees is according to capital flight, albeit on a smaller scale than initially instructed. The agency stated it’s monitoring regular, ongoing outflows from Nobitex to abroad wallets, averaging about $1 million per day.
Even below restricted situations, together with a nationwide web blackout, transactions have persevered. Elliptic’s founder and chief scientist, Tom Robinson, instructed CoinDesk that the sample mirrors earlier blackouts, when quantity dipped however outflows to offshore exchanges continued.
“Outflows from Nobitex proceed, however at comparatively low ranges of roughly $1 million per day. This follows the sample we noticed through the earlier web blackout, in January this yr – transactions proceed however at a decrease degree,” Robinson stated. “We proceed to see outflows to abroad exchanges.”
The blackout is an important issue within the debate. TRM argues that with giant parts of the nation offline, a mass exodus of funds by common customers could be tough, if not inconceivable.
The agency sees the shortage of sustained retail outflows, clustering of transactions or routing via identified offshore cashout hubs as indicators that this isn’t a broad-based exit.
Chainalysis, for its half, is undecided. Whereas flagging the spike as a attainable capital flight indicator, the corporate stated it’s too early to find out the breakdown between retail consumer conduct and institutional pockets actions.
What’s clear is that even in a disaster, crypto markets stay onerous to learn and tougher to interpret in actual time. The open nature of blockchain ledgers offers visibility, however with out context, the identical information can assist competing narratives.
Nonetheless, the Iranian regime’s $7.8 billion crypto shadow economic system is now within the highlight. The federal government has leveraged crypto infrastructure for worldwide commerce previously, whereas many Iranian folks see it as a lifeline.
