Debate among blockchain experts regarding Iran’s cryptocurrency withdrawals: Exodus or firewall?

Following the airstrikes in Iran on February 28, there was an 873% surge in crypto outflows from Nobitex, indicating a possible “digital bank run.” However, the situation may be more nuanced.

(Amos K/Unsplash/Modified by CoinDesk)

Key points:

• Minutes after the airstrikes on February 28, there was an 873% increase in crypto outflows from Iran’s Nobitex exchange, suggesting a potential “digital bank run.”
• TRM Labs contends that the data indicates Nobitex was merely performing routine “hot-to-cold” wallet rebalancing to safeguard its assets as tensions rose.
• Elliptic asserts that capital flight is indeed happening, observing a steady daily outflow of funds to foreign exchanges despite widespread internet shutdowns.

Immediately after missiles impacted Iranian territory on February 28, blockchain monitors observed significant movements in the cryptocurrency markets.

There was a noticeable increase in withdrawals from the nation’s crypto exchanges that Saturday, especially from Nobitex, the largest exchange in the country. Chainalysis reported that outflows rose by 873%, a figure well above typical volatility levels.

The narrative appeared straightforward: during a crisis, Iranians hurried to secure their cryptocurrencies by withdrawing from centralized platforms and transferring their assets into self-custody wallets. This behavior was reminiscent of historical patterns of capital flight, resembling a digital bank run.

However, the situation may not be so clear-cut.

While certain firms, such as Chainalysis and Elliptic, interpreted the outflows as signs of panic and risk aversion, others suggested that these movements were consistent with standard operational security protocols.

Is it capital flight?

TRM Labs, a blockchain intelligence firm, is among those with a differing view.

TRM argues that the magnitude of the outflow spike is deceptive. Due to the unusually low exchange activity at the time of the strikes, around 10 a.m. local time, even a slight uptick in withdrawals resulted in a significant percentage increase.

“Percentages without context can misrepresent the actual situation,” stated Ari Redbord, the global head of policy at TRM Labs, emphasizing that the spike represented only a few million dollars overall.

“In a market that processes billions annually, that level of activity is not, on its own, indicative of wartime capital flight,” Redbord noted. Instead, TRM’s tracing at the wallet level indicated a pattern more aligned with routine internal exchange operations, specifically hot-to-cold wallet rebalancing.

This type of rebalancing aims to safeguard funds from potential cyber threats by transferring them to offline wallets, which are less susceptible to hacking. TRM asserted that this was precisely what occurred in this instance.

Nobitex has valid reasons to adopt a defensive stance. In June 2025, the exchange suffered a $90 million cyberattack associated with a pro-Israel hacktivist group. This group not only drained the exchange’s hot wallets but also leaked its internal source code and effectively ruined the stolen cryptocurrency, making recovery impossible.

Since that incident, security measures have become increasingly crucial. Viewed from this perspective, Nobitex’s actions following the airstrikes that initiated Operation Epic Fury may not indicate user panic but rather a calculated effort by the exchange to prevent a similar breach during a period of geopolitical tension.

“Capital flight exhibits a distinct behavioral pattern. It generally shows sustained net outflows over several days, clustering around identifiable self-custody destinations, and eventual cashout pathways or offshore exchange routing,” Redbord explained.

“It also tends to occur in circumstances where users can actually access platforms. In this instance, widespread internet disruptions and withdrawal batching at the exchange level significantly limited retail engagement.”

While he recognized that some users might have moved funds in response to the strikes, the flows observed are “limited in size and consistent with operational changes within the exchange.”

The impact of the blackout

Not everyone shares this skepticism. Elliptic maintains that the trends it observes align with capital flight, albeit on a smaller scale than initially indicated. The firm reports ongoing, steady outflows from Nobitex to international wallets, averaging around $1 million daily.

Even amid restricted conditions, including a national internet blackout, transactions have continued. Tom Robinson, Elliptic’s founder and chief scientist, informed CoinDesk that the trend resembles previous blackouts, where volume decreased but outflows to foreign exchanges persisted.

The blackout plays a crucial role in this discussion. TRM argues that with many parts of the country offline, a mass withdrawal of funds by average users would be challenging, if not impossible.

The firm interprets the absence of sustained retail outflows, transaction clustering, or routing through known offshore cashout locations as evidence that this is not a widespread exit.

Chainalysis remains uncertain. While it has flagged the spike as a potential indicator of capital flight, the company believes it is premature to discern the balance between retail user activity and institutional wallet movements.

What is evident is that even in times of crisis, cryptocurrency markets can be difficult to interpret and analyze in real time. The transparent nature of blockchain ledgers offers visibility, but without context, the same data can support various interpretations.

Nonetheless, the Iranian regime’s $7.8 billion cryptocurrency shadow economy is currently under scrutiny. The government has utilized cryptocurrency infrastructure for international trade previously, while many individuals in Iran view it as a crucial lifeline.