How To Understand And Track Iranian Crypto Exchange Outflows

‍

Outflows from Iranian crypto exchanges – like Nobitex – spiked aggressively in the hours after the launch of the US/Israeli airstrikes. 

‍Nobitex is Iran’s biggest exchange with $86 million in digital assets, most of which is held in BTC. You can interact with Nobitex’s Arkham entity page below:

‍

Using the Arkham ‘Portfolio Archive’ feature (visible above), it is possible to see a $2.13 million portfolio swing from 27th February, the day before the strikes began, and 28th February. The airstrikes began on 28th February at 06:15 GMT. 

Nobitex’s portfolio went from $84.5 million to $82.4 million in the space of a day. It has since recovered to $85.8 million, largely due to an improvement in the crypto markets. 

When looking just at BTC, we can see how Nobitex’s holdings of BTC have slid over the course of the conflict:

‍

‍

What Explains The Outflows? 

While the Arkham data shows a clear surge in outflows from Nobitex, the "why" behind the movement typically falls into three categories:

Retail Flight to Self-Custody: Ordinary Iranian citizens pull assets off centralized exchanges into private wallets as a hedge against domestic instability, currency collapse, or internet blackouts.

Exchange Liquidity Management: Exchanges like Nobitex may move funds to new addresses to obfuscate activity from sanctions monitors. Given that Nobitex suffered a $90 million exploit in 2025, cybersecurity and wallet rotation are now standard operational procedures.

State-Linked Activity: Historically, state-aligned actors and entities linked to the IRGC have utilized mainstream domestic exchanges to move funds for sanctions evasion or proxy financing. During a military escalation, these actors may move liquidity through domestic rails to ensure theater-ready capital.

Nobitex has links to sanctioned Russian crypto exchange Garantex as well as the company behind the ruble stablecoin A7A5. We wrote an explainer on A7A5 here.