Within minutes of missiles hitting Iranian soil on February 28, blockchain monitors detected the shock waves in the crypto markets.
Withdrawals from the country’s crypto exchanges increased that Saturday, especially from the country’s largest, Nobitex. According to Chainalysis, outflows increased by 873%, well beyond what is considered normal volatility.
The story seemed clear: in a moment of crisis, the Iranians rushed to secure their crypto by withdrawing it from centralized platforms and moving the funds to self-deposit funds. To observers of historical patterns of capital flight, the comparison was obvious. It was a digital bank run.
The picture may not be so simple.
While some firms, including Chainalysis and Elliptic, saw the outflow as evidence of panic and flight from risk, others believed the move was in line with operational security measures.
Capital flight?
TRM Labs, a blockchain intelligence firm, is one of the opponents.
According to TRM, the size of the outflow spike is misleading. Because exchange activity was unusually low at the time of the bombardment, around 10 local time, even a modest increase in withdrawals created a large percentage change.
“Percentages without context can distort what’s actually happening,” Ari Redbord, the global head of policy at TRM Labs, told CoinDesk, noting that the increase only amounted to a few million dollars in total.
“In a market that processes billions annually, this scale of activity is not in itself evidence of wartime capital flight,” Redbord said. Instead, TRM’s wallet-level tracking revealed a pattern more typical of internal exchange operations, specifically wallet rebalancing from hot to cold.
This kind of rebalancing is usually meant to protect funds from potential cyber attacks by moving them to offline wallets that are less vulnerable to hacks. TRM said that’s exactly what happened here.
Nobitex has strong reasons to act defensively. In June 2025, the stock exchange was hit by a $90 million cyberattack linked to a pro-Israel hacktivist group. The group not only drained the exchange’s hot wallets, but also leaked its internal source code, effectively destroying the stolen crypto, rendering it unrecoverable.
Since then, security measures have taken on a new urgency. Seen through that lens, Nobitex’s behavior following the airstrikes that opened Operation Epic Fury may not reflect panic among users, but a calculated attempt by the exchange to avoid a repeat breakout at a time of geopolitical instability.
“Capital flight has a distinct behavioral signature. It tends to show sustained net outflows over several days, clustering into identifiable self-destinations and eventual disbursement pathways or offshore exchange routes,” Redbord said.
“It also tends to occur in environments where users can actually access platforms. In this case, widespread internet outages and exchange-level withdrawals significantly limited retail participation.”
While he acknowledged that some of the platform’s users could have moved funds in response to the strikes, the flows so far are “limited in size and consistent with operational adjustments inside the exchange.”
The blackout factor
Not everyone is convinced. Elliptic said what it is seeing is consistent with capital flight, albeit on a smaller scale than originally suggested. The firm said it tracks steady, ongoing outflows from Nobitex to overseas wallets, averaging about $1 million a day.
Even under limited conditions, including a nationwide internet blackout, transactions have continued. Elliptic’s founder and chief researcher, Tom Robinson, told CoinDesk that the pattern mirrors previous blackouts, when volume dropped but outflows to offshore exchanges continued.
“Outflows from Nobitex continue, but at a relatively low level of approximately $1 million per day. This follows the pattern we saw during the previous internet blackout, in January this year – transactions continue, but at a lower level,” Robinson said. “We continue to see outflows to overseas exchanges.”
The blackout is a decisive factor in the debate. TRM argues that with large parts of the country offline, a mass exodus of funds from average users would be difficult, if not impossible.
The firm sees the lack of sustained retail outflows, grouping of transactions or routing through known offshore disbursement hubs as signs that this is not a broad-based exit.
Chain light, on the other hand, is unclear. While flagging the increase as a possible capital flight indicator, the company said it is too early to determine the breakdown between retail user behavior and institutional wallet movements.
What is clear is that even in a crisis, crypto markets remain hard to read and harder to interpret in real time. The open nature of blockchain ledgers provides visibility, but without context, the same data can support competing narratives.
Yet the Iranian regime’s $7.8 billion crypto shadow economy is now in the spotlight. The government has previously leveraged crypto infrastructure for international trade, while many Iranians see it as a lifeline.
