Nobitex, Iran’s biggest crypto exchange, showed no signs of a sustained, user-driven run after US-Israeli strikes on Iran, even as blockchain data indicated a brief spike in activity and higher outflows from Iranian exchanges more broadly, according to separate analyses from TRM Labs and Chainalysis.
The TRM report, which examined onchain activity around Nobitex after US-Israeli strikes on Iran began on Feb. 28, found that the platform recorded a noticeable increase in activity in the immediate aftermath, including transfers exceeding $35 million from hot wallets to cold storage. However, TRM said the transfers were likely part of the exchange’s internal treasury operations.
“Based on historical behavior and wallet attribution, these movements aligned with routine liquidity management rather than user-driven withdrawals,” the report said.
Activity across Nobitex. Source: TRM
Nobitex sits at the center of Iran’s crypto ecosystem. TRM estimated that the exchange has processed tens of billions of dollars in transaction volume since 2019, including more than $5 billion since 2025 alone.
Related: US military used Anthropic in Iran strike despite ban order by Trump: WSJ
Nobitex uses Bitcoin mining reserves to recover from hack
In June 2025, Nobitex suffered a $90 million hack after a cyberattack attributed to the Israel-linked hacking group Predatory Sparrow. The breach exposed details of Nobitex’s internal architecture, including a multi-layer custody structure separating hot, warm and cold wallets, as well as automated routing systems designed to manage transactions across different networks.
Following the hack, Nobitex relied in part on reserves tied to earlier Bitcoin (BTC) mining activity to stabilize operations. TRM revealed that about $2.7 million was consolidated from more than 100 dormant mining-linked wallets shortly after the incident, suggesting the exchange mobilized previously unused funds while restoring services.
Despite operational disruptions, Nobitex resumed activity in stages later in 2025.
Related: 6 Polymarket traders net $1M on US-Iran strike, spark insider fears: Report
Crypto outflows from Iranian exchanges jump
Meanwhile, the Chainalysis report revealed that about $10.3 million in digital assets left Iranian exchanges between Feb. 28 and Monday. Hourly outflows briefly surged to levels as much as 873% higher than the 2026 average.
Iranian crypto outflows. Source: Chainalysis
The report said that the transfers may represent ordinary Iranians moving funds into self-custody to hedge against economic instability, while others may involve exchanges shifting liquidity or creating new wallets to obscure activity under sanctions pressure. Another possibility is that state-aligned actors are using domestic exchanges to move funds across borders.
Magazine: Bitcoin may take 7 years to upgrade to post-quantum — BIP-360 co-author
