Airstrikes, Internet Blackouts, and Iran’s Crypto Exit Valve
After the Feb. 28, 2026 airstrikes on Iran, blockchain analysts reported a sharp jump in crypto outflows from Nobitex, the country’s biggest exchange. Elliptic described a 700% spike in outgoing activity within minutes, interpreting it as possible capital flight. TRM Labs looked at the same window and argued the market mostly froze under a near-total internet disruption, with much of the visible movement consistent with internal exchange operations. The gap between those readings is the real story: in a crisis, on-chain data can be clear, but the meaning can still be contested.Elliptic: outflows spiked within minutes of the first strikes
Elliptic’s core claim is that Nobitex saw an immediate, abnormal jump in outgoing transaction volumes right after the first US-Israeli strikes on Feb. 28, with outflows “spiking by 700%.”Hash Telegraph’s summary of Elliptic’s post adds scale: more than $500,000 reportedly left within minutes, and the total outflow over roughly the first hour approached $3 million. Elliptic’s early tracing suggested a meaningful share of those funds flowed onward to overseas exchanges that have historically received inflows from Iran, which is why Elliptic framed the move as potential capital flight that bypasses traditional banking scrutiny.
Takeaway: the timing matters. A surge that begins immediately after a shock event tends to be read as urgent repositioning, not ordinary trading flow.
TRM Labs: connectivity collapse makes “capital flight” hard to prove
TRM’s core point is that Iran’s crypto market did not uniformly accelerate after the strikes - it contracted under severe operational constraints. TRM reported that Iran’s internet connectivity fell by about 99% as restrictive measures were implemented, and warned that this routinely breaks retail access, API connectivity, market making, and arbitrage.On Nobitex specifically, TRM said activity was higher in the days around Feb. 28 but still within a normal operational range for the exchange. TRM attributed a roughly $3 million day-to-day increase on Feb. 28 to an internal movement of funds on Polygon from a hot wallet to cold storage, and cited other large hot-to-cold transfers (including tens of millions of dollars) as consistent with routine infrastructure liquidity management rather than a user-driven run.
Takeaway: the same “outflow number” can be user withdrawals, or it can be exchange plumbing. Without granular labeling, both narratives can appear plausible.
Why an internet shutdown changes what on-chain signals mean
When connectivity collapses, “less activity” does not automatically mean “less fear.” It can mean people simply cannot execute transactions reliably. TRM notes that disruptions disconnect market makers and automated systems, slow arbitrage, and reduce market depth - all of which can reshape flows even if user intent stays the same.In practice, a shutdown can create a two-phase pattern: an initial burst from those who still have access, followed by a sharp drop once the wider user base is locked out. It can also force exchanges into withdrawal pacing and batching, which changes how transfers appear on-chain and can inflate single-transaction sizes or compress activity into bursts.
Takeaway: during blackouts, flow charts are partly behavioral data and partly outage telemetry.
Why Nobitex is the pressure point in Iran’s crypto system
Nobitex matters because it is the main conversion pipe between local money and crypto. Elliptic says the exchange sent or received $7.2 billion in cryptoasset transactions in 2025 and has more than 11 million users, calling it a critical part of Iran’s crypto ecosystem and noting it has been linked to IRGC-aligned financial activity.Hash Telegraph goes further, reporting Nobitex accounts for about 87% of Iran’s domestic crypto transaction volume, which would make any shock-era movement on Nobitex disproportionately important for interpreting “what Iranians are doing.” The platform also carries operational risk: Hash Telegraph previously reported a June 2025 hack that drained more than $81 million from Nobitex hot wallets, reinforcing why users and authorities may treat exchange access as a vulnerability in conflict conditions.
Takeaway: if most local liquidity funnels through one venue, you should expect dramatic-looking on-chain patterns - and fierce debate over what they mean.
Stablecoins and the USDT-toman bridge become a policy lever
TRM highlights that domestic risk controls were not limited to internet access. It reported coordinated exchange actions that temporarily halted trading in the USDT-toman pair under direction from Iran’s central bank, calling it the primary crypto-fiat bridge where dollar-linked stablecoins are bought and sold against the rial.TRM’s interpretation is straightforward: pausing the key stablecoin pair slows repricing during a volatile window, especially when order books are thin and market depth is impaired. TRM also reported temporary price dislocations after reopening, with exchanges describing supply-demand imbalance, pricing anomalies, and reversals of certain liquidations in response to disorderly conditions.
Takeaway: in stressed markets, the “exit valve” is often stablecoins - and that makes stablecoin rails a natural target for controls.
What to watch next if you track Iran-related crypto flows
The near-term question is not whether a spike happened, but whether it represents sustained user withdrawal or short-lived operational churn. Elliptic points to apparent onward flows to overseas exchanges, which would support the capital-flight thesis. TRM points to internal hot-to-cold movements, withdrawal pacing, and liquidity containment across multiple exchanges, which supports the “market freeze” thesis.For analysts, the most informative signals will be persistent net outflows that continue after connectivity stabilizes, repeated transfers to identifiable external venues, and stablecoin market behavior once USDT-toman trading resumes under normal conditions. For users, the practical risk is execution risk: outages, widening spreads, delayed withdrawals, and thin order books can be more damaging than price moves when access is unreliable.
Takeaway: the cleanest read comes after the immediate fog - watch what flows do when people can actually transact.
FAQ
A few questions come up whenever “capital flight” and “internet blackouts” collide with on-chain data.- Q: What does “outflow” from an exchange mean on-chain? A: It usually means funds left wallets associated with the exchange, but it can be user withdrawals or internal transfers to cold storage.
- Q: Why do analysts disagree even with the same blockchain data? A: Labels and context matter. Without knowing which transfers are operational, attribution becomes probabilistic, not certain.
- Q: How does an internet shutdown affect crypto markets? A: It disrupts access, market making, APIs, and arbitrage, which can shrink liquidity and force exchanges into batching and withdrawal pacing.
- Q: What is the USDT-toman pair and why is it important? A: It is the main stablecoin-to-local-currency bridge in Iran, so pausing it can slow repricing and reduce immediate exit capacity.
- Q: Is a short spike proof of capital flight? A: Not by itself. A stronger case requires sustained net flows to external venues after access stabilizes.
- Q: What is the user-level risk in these moments? A: Execution and custody risk: delayed withdrawals, thin order books, sudden rule changes, and outage-driven slippage.
Conclusion
The Nobitex story is a reminder that crypto can function as a parallel financial rail during geopolitical shocks, but it is still constrained by infrastructure and policy. Elliptic’s reading emphasizes immediate outward movement consistent with urgent capital relocation, while TRM’s reading emphasizes a liquidity freeze driven by a near-total connectivity collapse and exchange risk controls.Both can be partially true at once: some users can rush for the exit while the broader market is locked out. The next useful data point is what happens after the first shockwave - when stablecoin markets reopen, internet access normalizes, and any sustained net outflow either persists or fades as an artifact of the outage.
Editorial Team - CoinBotLab
🔵 Bitcoin Mix — Anonymous BTC Mixing Since 2017
🌐 Official Website
🧅 TOR Mirror
✉️ [email protected]
No logs • SegWit/bech32 • Instant payouts • Dynamic fees
TOR access is recommended for maximum anonymity.
🌐 Official Website
🧅 TOR Mirror
✉️ [email protected]
No logs • SegWit/bech32 • Instant payouts • Dynamic fees
TOR access is recommended for maximum anonymity.