On February 28, 2026, within minutes of the first American-Israeli airstrikes hitting Tehran, blockchain monitoring platforms were already flagging an anomaly: cryptocurrency outflows from Iranian exchanges were skyrocketing. In just a matter of hours, $10.3 million had left Iranian wallets, with withdrawal volumes on Nobitex — the country’s largest crypto exchange — surging by a staggering +700%. A striking figure, but hardly a surprise for anyone who has been closely watching Iranian crypto markets since 2024.
A Recurring Pattern, Documented by Chainalysis
This isn’t the first time blockchain researchers have observed this type of reaction. Since 2024, Chainalysis has been documenting a recurring pattern: whenever Iran faces a major geopolitical shock — whether reinforced sanctions, domestic unrest, or military strikes — cryptocurrency outflows from Iranian territory spike almost instantaneously.
Chainalysis data on the February 2026 events confirms this correlation: withdrawals began within minutes of the first explosions, well before traditional media outlets had time to even publish initial reports. This ultra-fast reaction time suggests that many Iranians had pre-positioned exit strategies, acutely aware of their financial environment’s fragility.
Economic Context: A Currency in Freefall
To understand why Bitcoin has become a refuge for millions of Iranians, one must first grasp the scale of the economic disaster gripping the country. The Iranian rial has collapsed to 1.5 million rials per US dollar — a dizzying depreciation that erodes purchasing power on a daily basis. Official inflation exceeds 40%, and independent economists suggest the real figure is considerably higher.
In this context, holding rials is tantamount to watching one’s savings evaporate. Cryptocurrency — and Bitcoin in particular — is perceived as a lifeline: a way to preserve value independent of a government whose monetary policy is seen as dangerously unpredictable.
« When your national currency loses half its value in a year, Bitcoin at 5% weekly volatility starts to feel like the safest store of value in the world. »
— Anonymous analyst, Tehran, 2026
Three Possible Readings of the Capital Flows
Blockchain experts do not agree on the true nature of these massive outflows. Three main interpretations are competing:
- Ordinary citizens: The majority of flows are believed to come from private individuals seeking to protect their savings against rial depreciation and political instability. This is the most widely accepted interpretation and the most difficult to disprove.
- Local exchanges: A portion of the movements may be Iranian exchange platforms rebalancing their portfolios in anticipation of potential government-mandated shutdowns or prolonged internet blackouts — a form of institutional precaution.
- State-linked actors: Some analysts hypothesize that entities connected to the Iranian government exploit these periods of tension to move funds tied to sanctions evasion, using the ambient noise of a crisis to obscure transactions.
The Elliptic vs. TRM Labs Debate: Who Is Really Moving the Money?
The question of what is actually driving these flows sits at the heart of a sharp disagreement between two leading blockchain analytics firms. Elliptic, which reported the 700% surge in outflows, primarily attributes the movements to private actors seeking asset protection. The firm notes that individual transaction amounts are generally modest, fitting the profile of ordinary citizens rather than institutional or state-level operators.
TRM Labs takes a more cautious stance. Its analysts note that certain transaction patterns — particularly the speed of fund movement and the nature of destination addresses — display characteristics consistent with more sophisticated sanctions-evasion operations. TRM Labs is calling on international exchanges to significantly increase vigilance around counterparties potentially linked to Iran.
This debate underscores a fundamental truth of blockchain analysis: even with complete on-chain data, attributing motivations remains an exercise in interpretation rather than certainty.
Internet Blackouts: A Tool for Digital Capital Controls
One of the most revealing aspects of this episode is the Iranian government’s response to the capital outflows: internet shutdowns. In the hours following the strikes, connectivity in Iran dropped to below 1% of normal levels in certain regions, according to NetBlocks data.
This strategy is not new. The Iranian government has historically deployed internet blackouts as a dual-purpose tool: to prevent the coordination of protesters on one hand, and to block digital financial transactions during periods of tension on the other. By cutting off internet access, authorities hope to stem the tide of capital fleeing into cryptocurrencies.
In response, some Iranians are turning to alternative solutions such as mesh networks and VPNs, illustrating a technological cat-and-mouse game between citizens and the state over the control of financial flows.
What This Reveals About Bitcoin’s Role in Times of Crisis
Beyond the Iranian case, the events of February 28, 2026 provide a concrete demonstration of a thesis that Bitcoin advocates have argued for years: in a world where governments can freeze accounts, devalue currencies, or cut access to financial infrastructure, decentralized assets represent a genuine form of insurance.
Yet this reality raises complex questions for the international community. How do you distinguish legitimate personal savings protection from sanctions evasion? How do you design regulation that shields oppressed citizens without simultaneously opening the door to bad actors?
The events in Tehran offer no simple answers to these questions. They serve as a stark reminder that for millions of people around the world, cryptocurrency is now far more than a speculative investment. It has become survival-grade financial infrastructure.
Sources: Chainalysis, Elliptic, TRM Labs, BeInCrypto, Al Jazeera, Forbes, DW, Yahoo Finance, The Block, Forklog
