Iran moves hundreds of millions in cryptocurrencies during nationwide internet outage
The analysis was conducted by cyber intelligence firm RAKIA, whose researchers began real-time monitoring of cryptocurrency activity associated with Iran after the attacks began.
Cryptocurrencies
A cryptocurrency network linked to Iran's Islamic Revolutionary Guard Corps (IRGC) continued to operate even during that country's internet blackout that followed the Feb. 28 attacks on Iran. According to a cyber intelligence report reviewed by Fox News Digital, the infrastructure allowed large sums of cryptocurrencies to leave the country during that period.
The analysis was conducted by cyber intelligence firm RAKIA, whose researchers began real-time monitoring of cryptocurrency activity associated with Iran after the attacks began. According to the firm's founder and CEO Omri Raiter, the team quickly detected an increase in the movement of funds from accounts linked to the country.
"We've seen a surge of funds since the first hours of the war," Raiter said. "It started with tens of millions in the first hours, and it grew to hundreds of millions and more. Money was just flowing out from Iranian crypto accounts."
Politics
Trump says Iran's newly appointed supreme leader is 'probably alive in some form'
Emmanuel Alejandro Rondón
Activity detected during internet outage
Researchers identified more than 1,100 active cryptocurrency nodes inside Iran. Tom Malca, head of cybersecurity and artificial intelligence research at RAKIA, noted that the scale of such activity indicates the existence of specialized infrastructure.
"Those nodes require dedicated bandwidth, stable power and deliberate exemption from the shutdown," he said.
The analysis notes that the largest concentration of nodes was located in the corridor between Tehran and Qom, with additional activity detected in cities such as Isfahan, Mashhad, Tabriz and Kermanshah.
Growth in crypto activity
Data cited in the report indicates that IRGC-linked wallets received more than $3 billion in cryptocurrencies during 2025. The paper also cites estimates from blockchain analytics firm Chainalysis, which calculated that total cryptocurrency ecosystem activity in Iran reached approximately $7.78 billion that same year.
According to Raiter, this data reflects the development of a significant digital financial infrastructure that can continue to operate despite international sanctions and communications restrictions.
"The IRGC has been financing proxy operations through the very same crypto corridors that sanctions were designed to shut down," he noted.
JNS
Iranian-linked hacker group targets Michigan-based technology company
JNS (Jewish News Syndicate)
Sanctions from Washington
Treasury Secretary Scott Bessent indicated at the time that the move was part of a broader effort to disrupt Tehran-connected financial networks.
"The Treasury will continue to pursue Iranian networks and corrupt elites who enrich themselves at the expense of the people," Bessent said in an official statement.
LATEST
