Between January and July 2025, total cryptocurrency flows involving Iranian entities fell to USD 3.7 billion, an 11% decrease compared with the same period in 2024. The sharpest declines occurred after April, with inflows in June down more than 50% year-over-year, and July volumes collapsing by over 76%. This downturn coincided with a breakdown in nuclear negotiations, a 12-day conflict with Israel beginning June 13, and widespread power outages in Iran — driven by a combination of Israeli kinetic and cyber operations, as well as regime-initiated shutdowns.
At the same time, confidence in Iran-based virtual asset service providers (VASPs) deteriorated after the USD 90 million hack of Nobitex, the country’s largest exchange, on June 18. Market disruption was further compounded by Tether’s largest-ever freeze of Iranian-linked wallets, which removed significant liquidity and disrupted settlement channels.
Outgoing volumes also fell, though less sharply. This persistence in outbound flows — even as inflows collapsed — underscores how cryptocurrency remains a vital channel for capital flight from Iran. It enables value to leave the country despite sanctions, cyber disruptions, and the erosion of domestic exchange credibility, as outlined in our July 2025 analysis.
While cryptocurrency is leveraged by Iranian actors for illicit activity — including sanctions evasion and to procure sensitive goods, such as drone components — illicit transactions at Iranian exchanges account for just 0.9% of activity. Many everyday Iranians continue to turn to digital assets as a hedge against inflation and financial instability. This blog examines how Iran’s crypto economy is adapting in 2025 amid a rapidly changing geopolitical landscape.
Key takeaways
- Between January and July 2025, Iran recorded roughly USD 3.7 billion in total cryptocurrency flows — an 11% decline from the same period in 2024. The sharpest declines occurred after April, with inflows in June falling more than 50% year-over-year — and July recording an even steeper drop of over 76%.
- Nobitex maintained its central role, handling over 87% of all Iranian-linked crypto transaction volume in 2025.
- Of the over USD 3 billion processed by Nobitex, USD 2 billion moved through the TRON network, reflecting a heavy concentration in both platform and chain choice.
- Illicit activity at Iranian exchanges accounted for about 0.9% of total volume — matching the global average reported in TRM’s 2025 Crypto Crime Report.
Nobitex remains Iran’s largest exchange, despite hack
In 2025, Nobitex remained Iran’s dominant and most systemically important exchange, handling more than 87% of all cryptocurrency transaction volume linked to Iranian entities. Of the USD 3 billion processed through the platform during this period, approximately USD 2 billion flowed over the TRON network — primarily in TRC-20 USDT and TRX — highlighting a pronounced concentration in both platform and chain. While this concentration offers efficiency for Iranian users, it also amplifies systemic risk, as demonstrated when the Nobitex hack froze liquidity and temporarily diverted transaction flows.
TRM Labs analysis shows that the June 2025 escalation between Iran and Israel triggered a sharp wave of capital flight from Iranian cryptocurrency exchanges. In the week leading up to the conflict, outflows from Nobitex surged more than 150% over the prior week, with much of the volume moving to global exchanges or payment service providers offering limited Know Your Customer (KYC) measures for smaller transactions — and to high-risk platforms operating with no KYC requirements at all.
Nobitex hack exposes regime’s dual priorities
The Nobitex breach, unfolding at the peak of the Iran–Israel hostilities and attributed to pro-Israel group Predatory Sparrow, exposed tens of millions of dollars in user funds and underscored serious weaknesses in the exchange’s security infrastructure. The attack disrupted liquidity, slowed transaction processing, and temporarily pushed users toward alternative platforms.
Unlike most state-linked or state-aligned crypto heists, Predatory Sparrow’s operation was driven primarily by political objectives. By striking a central node in Iran’s sanctioned financial architecture, the group both inflicted operational damage and created opportunities for intelligence collection. The USD 90 million haul was transferred into vanity addresses referencing the Islamic Revolutionary Guard Corps (IRGC), effectively ensuring the funds would remain frozen and unusable.
Leaked source code from the incident pointed to the regime’s dual priorities: enabling warrantless state surveillance while protecting the privacy of VIP users. TRM Labs also traced on-chain activity at Nobitex to IRGC-linked actor Amir Hossein Nikaeen Ravari and to Gaza Now, a pro-Hamas media outlet sanctioned in the wake of the October 7, 2023, attack on Israel.
Hack shakes Iranians’ confidence in domestic exchanges
While Nobitex has resumed operations, the breach had a disproportionate impact on Iran’s crypto economy, accelerating a decline already fueled by geopolitical instability and sanctions pressure. The incident laid bare gaps in user protections and cybersecurity, likely eroding public confidence not only in Nobitex but in Iranian VASPs more broadly.
In the weeks following the hack, TRM Labs observed previously dormant wallets tied to bitcoin mining activity moving funds, which ultimately consolidated into Nobitex’s new hot wallet. This movement highlights how Tehran continues to rely on crypto mining as a sanctions-evasion tool and revenue source, even amid market and operational disruption.
IRGC-linked wallets included in Tether blocklist
On July 2, 2025, Tether carried out its largest-ever freeze of Iranian-linked funds, freezing 42 cryptocurrency addresses — more than half with substantial exposure to Nobitex. Many of these wallets also had transactional flows to both Nobitex and IRGC-affiliated addresses previously flagged by the Israeli National Bureau for Counter Terrorist Financing, underscoring the persistent role of cryptocurrency in financing sanctioned entities.
While the ultimate ownership of these addresses remains unconfirmed, their connections to Iranian exchanges and sanctioned actors are well established. The freezes disrupted entrenched transaction patterns and triggered a rapid diversification of settlement methods, mirroring the adaptations seen after the loss of traditional cross-border banking channels.
Iran encourages USDT exit and enacts capital gains tax on crypto trading
July 2025 saw a coordinated push by some domestic exchanges, crypto influencers, and government-aligned channels urging users to offload USDT holdings — both inside and outside Iran — after Tether froze addresses with Iranian exposure. Users were steered toward swapping into DAI via the Polygon network, a shift that underscored the agility of both retail and institutional participants in adapting to enforcement measures. By moving to a faster, lower-cost network, Iranians and Iranian exchanges can preserve access to liquid stablecoins despite heightened sanctions pressure.
Then in August 2025, Iran enacted the Law on Taxation of Speculation and Profiteering, which for the first time will see the regime impose capital gains tax on cryptocurrency trading. Although implementation will be phased, the law positions crypto alongside other speculative assets such as gold, real estate, and forex — signaling Tehran’s intent to formally regulate and tax digital asset markets.
Iran leveraging crypto to procure drone components, AI hardware, and KYC bypass tools
Beyond capital flight and personal savings, Iran continues to use cryptocurrency to source sensitive goods. Chinese chip resellers have shown both the willingness and capability to supply drone components, electrical equipment, and artificial intelligence (AI)-critical hardware to Iranian buyers via crypto transactions — allowing Tehran to bypass sanctions and advance its unmanned systems and AI development.
Supporting this activity is a thriving underground KYC bypass industry inside Iran. One of the most prominent actors, Novin Verify, runs one of the country’s largest such networks. Operating via its website and Telegram channel, the group sells forged passports, driver’s licenses, and utility bills, along with step-by-step instructions to help sanctioned users skirt identity checks on major cryptocurrency exchanges. While marketed for virtual asset onboarding, the quality and range of the documents make them equally useful for financial fraud, immigration schemes, and other forms of international sanctions evasion.
I-spy: Regime using crypto to fund espionage operations
In 2025, investigators documented the first known instances of cryptocurrency being used for direct espionage payments between Iran and foreign operatives. In one case, three Israeli citizens were arrested for allegedly spying on Tehran’s behalf, with compensation delivered in digital assets. The case underscores that cryptocurrency’s role in Iran’s playbook extends beyond sanctions evasion and procurement — into covert statecraft and intelligence operations.
Conclusion – An ecosystem under strain, shaped by geopolitical turmoil, and declining public trust
Iran’s 2025 cryptocurrency economy has been defined by disruption and adaptation. Overall flows have contracted, yet the ecosystem has shown striking resilience — from large-scale migrations to Polygon/DAI to the continued market dominance of Nobitex. Digital assets remain a vital economic artery for sanctioned entities engaged in procurement and covert operations, as well as for ordinary Iranians seeking stability amid inflation.
Though trust in domestic VASPs is eroding. The Nobitex hack not only exposed gaps in security, but also its role in enabling warrantless surveillance, deepening public doubts about the safety and independence of local platforms. Capital flight to foreign exchanges and a surge in KYC bypass activity signal that while crypto remains indispensable for many Iranians, confidence in the regime’s custodianship has largely collapsed.
As geopolitical tensions persist and enforcement actions evolve, Iran’s crypto sector — already a pressure valve and geopolitical tool — will remain highly sensitive to external shocks, with future disruptions likely to reshape both state strategy and citizen behavior on-chain.
{{horizontal-line}}
Frequently asked questions (FAQs)
What caused the sharp drop in crypto inflows to Iran in mid-2025?
The most significant declines followed a June 2025 escalation between Iran and Israel, marked by kinetic and cyberattacks, regime-initiated internet shutdowns, and broader instability. These events disrupted transaction processing and eroded confidence in domestic exchanges, accelerating capital flight and suppressing inflows.
Is cryptocurrency still used for sanctions evasion in Iran?
Yes — Iranian actors continue to leverage crypto for sanctions evasion, procurement of sensitive goods, and, more recently, espionage payments. However, illicit activity at Iranian exchanges accounts for just 0.9% of total volume — roughly in line with global averages.
What role does Nobitex play in Iran’s crypto ecosystem?
Nobitex remains the most systemically important exchange in Iran, responsible for over 87% of all Iranian-linked transaction volume in 2025. Roughly two-thirds of this activity flows through the TRON network, primarily in TRC-20 USDT, underscoring the platform’s centrality and associated systemic risks.
How did the Nobitex hack affect the crypto market in Iran?
The June 2025 hack — attributed to pro-Israel group Predatory Sparrow — disrupted liquidity, revealed surveillance features embedded in the platform, and significantly undermined public trust in domestic exchanges. It also triggered a migration of users and funds to global platforms with less stringent identity checks.
How are Iranian users and exchanges adapting to ecosystem shocks?
Following liquidity disruptions and the loss of trust in domestic exchanges, many Iranians have pivoted to alternative stablecoins like DAI and faster, lower-cost chains such as Polygon. These shifts reflect a broader pattern of rapid adaptation — not just by retail users, but also institutional actors seeking to preserve access to liquid crypto channels amid operational setbacks.
Related posts
Access our coverage of TRON, Solana and 23 other blockchains
Fill out the form to speak with our team about investigative professional services.
