Incident Summary
Within minutes of missiles striking Iranian soil on Feb. 28, blockchain monitors detected the shockwaves in crypto markets.
Withdrawals from the country’s crypto exchanges spiked that Saturday, particularly from the country’s largest, Nobitex. According to Chainalysis, outflows surged 873%, far beyond what’s considered normal volatility.
The story seemed clear: In a moment of crisis, Iranians rushed to secure their crypto by pulling it off centralized platforms and moving the funds into self-custody wallets. To observers of historical patterns of capital flight, the comparison was obvious. It was a digital bank run.
The picture may not be that simple.
While some firms, including Chainalysis and Elliptic, saw the outflows as evidence of panic and flight from risk, others argued the movement was consistent with operational security measures.
TRM Labs, a blockchain intelligence company, is one of the dissenters.
According to TRM, the size of the outflow spike is misleading. Because exchange activity was unusually low at the moment of the bombardment, about 10 a.m. local time, even a modest increase in withdrawals created a large percentage change.
Technical Context
“Percentages without context can distort what’s actually happening,” Ari Redbord, the global head of policy at TRM Labs, told CoinDesk, pointing out that the spike amounted to only a few million dollars in total.
“In a market that processes billions annually, that scale of activity is not, by itself, evidence of wartime capital flight,” Redbord said. Instead, TRM’s wallet-level tracing revealed a pattern more typical of internal exchange operations, specifically, hot-to-cold wallet rebalancing.
That kind of rebalancing is usually meant to protect funds from potential cyberattacks by moving them into offline wallets, which are less vulnerable to hacks. TRM said that’s exactly what happened here.
Nobitex has strong reasons to act defensively. In June 2025, the exchange was hit by a $90 million cyberattack linked to a pro-Israel hacktivist group. The group not only drained the exchange’s hot wallets but also leaked its internal source code and effectively destroyed the stolen crypto, rendering it unrecoverable.
Since then, security precautions have taken on a new urgency. Viewed through that lens, Nobitex’s behavior following the airstrikes that opened Operation Epic Fury may not reflect panic among users, but a calculated attempt by the exchange to avoid a repeat breach at a time of geopolitical instability.
“Capital flight has a distinct behavioral signature. It tends to show sustained net outflows over multiple days, clustering into identifiable self-custody destinations, and eventual cashout pathways or offshore exchange routing,” Redbord said.
“It also tends to occur in environments where users can actually access platforms. In this case, widespread internet disruptions and exchange-level withdrawal batching materially constrained retail participation.”
While he acknowledged that some of the platform’s users could have moved funds in response to the strikes, so far the flows are “limited in size and consistent with operational adjustments inside the exchange.”
What To Watch
Not all are convinced. Elliptic said what it sees is consistent with capital flight, albeit on a smaller scale than originally suggested. The firm said it’s tracking steady, ongoing outflows from Nobitex to overseas wallets. Total outflows off the exchange are averaging about $1 million per day.
Even under restricted conditions, including a nationwide internet blackout, transactions have persisted. Elliptic’s founder and chief scientist, Tom Robinson, told CoinDesk that the pattern mirrors earlier blackouts, when volume dipped but outflows to offshore exchanges continued.
“Outflows from Nobitex continue, but at relatively low levels of approximately $1 million per day. This follows the pattern wesaw during the previous internet blackout, in January this year – transactions continue but at alowerlevel,” Robinson said. “We continue to see outflows to overseas exchanges.”
The blackout is a crucial factor in the debate. TRM argues that with large portions of the country offline, a mass exodus of funds by average users would be difficult, if not impossible.
The firm sees the lack of sustained retail outflows, clustering of transactions or routing through known offshore cashout hubs as signs that this is not a broad-based exit.
Chainalysis, for its part, is undecided. While flagging the spike as a possible capital flight indicator, the company said it’s too early to determine the breakdown between retail user behavior and institutional wallet movements.
What’s clear is that even in a crisis, crypto markets remain hard to read and harder to interpret in real time. The open nature of blockchain ledgers provides visibility, but without context, the same data can support competing narratives.
Still, the Iranian regime’s $7.8 billion crypto shadow economy is now in the spotlight. The government has leveraged crypto infrastructure for international trade in the past, while many Iranian people see it as a lifeline.
Related: More from Security & Hacks | Crypto Pros Face Risks in ClickFix Scam Spread in Crypto Security | OpenZeppelin: EVMbench Dataset Breaches Trust in Crypto Security
