How Iran’s Crypto Market is Reacting to Conflict

Key takeaways

• Iran’s biggest exchange Nobitex recorded roughly USD 3 million more in total inflows and outflows following the initiation of US-Israeli strikes, however these flows are not necessarily outliers in the context of routine operations, and TRM cautions against drawing conclusions regarding capital flight at this time.
• After US-Israeli strikes on Iran began on February 28, observers reported wide internet outages impacting the ability to actively trade or participate in crypto markets in Iran – contracting the market overall.
• Major domestic exchanges remained operational but moved into risk containment mode, suspending or batching withdrawals, reducing market depth, and issuing risk guidance — signaling infrastructure stress management.
• Under direction from Iran’s Central Bank, several exchanges temporarily halted the USDT–toman pair — the primary crypto–fiat bridge — effectively slowing fiat repricing during peak volatility. Upon the reopening of USDT-toman trading, thin order books and short-lived price dislocations showed impaired liquidity.
• The Iranian cryptocurrency economy is one of the largest crypto markets in the world, having processed over USD 11 billion in volume from the beginning of 2025 to the present.

‍

{{horizontal-line}}

Following US strikes on Iran this past weekend and the initiation of a larger regional conflict, Iran’s domestic crypto ecosystem has slowed sharply and shifted into a defensive posture. It appears that the country’s crypto ecosystem is not showing signs of acceleration or capital flight, but instead experiencing a downturn in both transactions and volume as the regime enforces strict internet blackouts. 

While broader activity contracted, it is probable that regime-linked actors could utilize available crypto infrastructure to reposition capital opportunistically; distinguishing that behavior from the broader liquidity freeze requires transactional analysis beyond aggregate flow trends and is likely to reveal itself in time. The current picture shows a market adjusting to severe functional limitations – how that will change going forward depends on the evolution of the situation on the ground.

Internet disruption limits activity

Iran’s internet connectivity reportedly declined by approximately 99% following regime-implemented restrictive measures as the conflict began. This is a routine occurrence during times of unrest – observers noted the same decline during the Iran-Israel conflict in summer 2025 and during the mass protests in January 2025. Connectivity disruptions cause retail users to lose reliable access, market makers to lose API connectivity, automated trading systems to disconnect, and arbitrage activity to slow. 

Iranian exchange Wallex[.]ir attributed the temporary platform outage to a power disruption at the Asiatech data center — infrastructure that is also referenced in Nobitex’s source code as part of its hosting environment. This example shows the shared physical infrastructure dependencies across major Iranian exchanges.

The decline in total transaction volume between February 27 and March 1 aligns with both general liquidity withdrawal and mechanical access constraints. The shift toward withdrawal batching and pacing is also consistent with exchanges operating without stable internet access.

What the on-chain data show

TRM data show three clear trends in early movement – simultaneous contraction of inbound and outbound flows, fragmentation of transfer sizes, and visible thinning of market depth upon reopening. 

These trends are consistent with liquidity compression, temporary crypto to fiat stabilization measures, withdrawal pacing to avoid a run, and severe functional constraints such as the lack of stable internet. 

Iranian exchange Nobitex has higher incoming and outgoing activity in days around the strikes – but within normal range

Iran’s largest exchange Nobitex shows larger incoming and outgoing activity on the days around the initiation of US-Israeli strikes on February 28. Specifically, TRM identified an increase of nearly USD 3 million on February 28 relative to February 27 – TRM analysts attribute this increase to an internal movement of funds on Polygon from a Nobitex hot wallet to a cold storage wallet. TRM also identified a separate, large cold storage movement from a Nobitex hot wallet to a Nobitex cold wallet – over USD 35 million in transfers – however, we assess this was within the normal course of internal infrastructure liquidity movement, and is not indicative of capital flight.

Nobitex is Iran’s largest cryptocurrency exchange and the central hub of the country’s digital asset ecosystem, with volumes of approximately USD 5 billion from 2025 to the present, and these transactions are not necessarily total outliers when taken in the broader context of routine movement.

All domestic exchanges move into risk containment mode

As on-chain activity declined, many major Iranian exchanges announced operational adjustments, citing the conflict and instability in international internet connectivity:

• Bitpin issued risk-management guidance encouraging users to avoid emotionally driven trading and prepare for possible connectivity disruption
• Wallex suspended crypto withdrawals until further notice, referencing infrastructure instability
• Nobitex stated that deposits and withdrawals remained available “to the extent possible,” but warned of delays and reduced market depth
• Aban Tether temporarily suspended both crypto and rial withdrawals
• Ramzinex suspended crypto deposits and withdrawals while maintaining that user assets were secured in cold wallets
• Tabdeal shifted crypto withdrawals to twice-daily batch processing, warning of delays of up to 24 hour

Exchanges remained operational across the board but tightened controls, paced withdrawals, and emphasized their approach to risk management.

Temporary halt of the USDT–toman market

Over the last few days, coordinated action occurred across several of the above exchanges.

Exchanges including Nobitex, Wallex, Bitcoin, and Tabdeal stated that they were temporarily halting trading of the Tether (USDT)–toman pair under direction from Iran’s Central Bank.The  USDT–toman pair is the primary crypto-fiat exchange in Iran, where dollar-linked stablecoins are bought and sold against the rial. Exchanges canceled open orders and paused the primary crypto–fiat bridge pair overnight. The central bank likely halted the USDT–toman market because it is the most common and systemically important stablecoin pair, and it is dollar-pegged – pausing this pair effectively slowed repricing during a highly volatile window.

Upon reopening trading of the USDT-toman pair, exchanges reported temporary price dislocations:

• Nobitex cited supply–demand imbalance and reversed certain liquidations
  
• Bitpin reported a brief pricing anomaly and committed to compensating affected users
  
• Tabdeal activated internal risk controls and insurance mechanisms to limit cascading liquidations

These developments are consistent with thin order books and impaired liquidity — reduced depth under stress.

Background: Iran’s crypto economy

TRM has observed approximately USD 11 billion in total crypto activity linked to Iran from the beginning of 2025 to the present, including both inbound and outbound flows. While all crypto activity associated with Iran is technically considered sanctioned exposure due to broad sanctions on Iran’s financial sector, digital assets also function as a financial lifeline for everyday Iranians navigating currency instability and restricted access to the traditional banking system.

At the same time, we have seen the Iranian regime increasingly leverage crypto infrastructure at scale for sanctions evasion. TRM recently highlighted the case of Zedcex and related UK-registered exchanges — later sanctioned by the US Treasury — which processed significant stablecoin flows linked to Iran’s Islamic Revolutionary Guard Corps and operated as offshore financial infrastructure facilitating sanctions evasion. The case illustrates a broader shift: state-linked actors embedding themselves within exchange-branded crypto platforms to move value through shadow financial channels that directly implicate sanctions enforcement efforts.

So far: evidence of stress, not failure

Since the escalation of hostilities, Iran’s crypto ecosystem has remained operational, though in a highly constrained and risk-managed state.

Exchanges tightened infrastructure controls, limited leverage, managed liquidation risk, and implemented temporary USDT market suspensions. At the same time, on-chain activity contracted sharply — a pattern consistent with liquidity stress compounded by near-total connectivity disruption. Whether activity normalizes will depend on the restoration of stable internet access and how inbound and outbound flows rebalance as volatility subsides - or increases.

{{horizontal-line}}

‍

Frequently asked questions (FAQs)

1. Why did Iran’s crypto activity decline after February 28?

Transaction volume fell sharply — approximately 80% between February 27 and March 1 — largely due to regime-imposed internet restrictions. Connectivity disruptions limit retail access, disconnect automated trading systems, reduce arbitrage activity, and constrain exchange APIs. This appears consistent with mechanical access limitations rather than a collapse in market infrastructure.

2. Did Iranian crypto exchanges shut down?

No. Major domestic exchanges remained operational but shifted into risk containment mode. This included suspending or batching withdrawals, reducing leverage, managing liquidation risk, and issuing user guidance. These measures are consistent with stress management during periods of volatility and infrastructure disruption.

3. Why was the USDT–toman trading pair temporarily halted?

Under direction from Iran’s Central Bank, several exchanges paused trading of the USDT–toman pair — the primary crypto–fiat bridge in Iran. Because USDT is dollar-pegged and systemically important to domestic pricing, halting this pair likely slowed rapid FX repricing during peak volatility.

4. What happened when USDT–toman trading resumed?

Upon reopening, exchanges reported thin order books and short-lived price dislocations. Some platforms reversed liquidations or activated internal safeguards. These conditions are consistent with impaired liquidity and supply–demand imbalance, rather than structural exchange insolvency.

5. Were large transactions from Nobitex linked to the strikes?

TRM observed a USD 40 million cold storage transfer from a Nobitex hot wallet to a cold wallet on February 28. However, this movement fell within the exchange’s historical range of normal operational activity and does not appear to be an outlier event based on available data.

6. Is Iran’s crypto market collapsing?

Current indicators suggest stress, not systemic failure. On-chain flows contracted and liquidity thinned, but exchanges remained operational and implemented risk controls. Whether activity normalizes will likely depend on restoration of stable internet access and broader geopolitical developments.

7. How large is Iran’s crypto economy?

Iran is among the larger global crypto markets, processing over USD 11 billion in transaction volume from the beginning of 2025 to the present. Activity has historically fluctuated during periods of domestic unrest and sanctions-related developments.

8.How does sanctions risk factor into Iran’s crypto activity?

All crypto activity associated with Iran is technically designated as sanctioned exposure under broad regional sanctions frameworks. While much activity reflects everyday users, past enforcement actions — including US Treasury designations of exchanges linked to the Islamic Revolutionary Guard Corps — illustrate how state-linked actors have used crypto infrastructure to facilitate sanctions evasion.

‍