Iran moves hundreds of millions in crypto during nationwide internet blackout, report reveals

This post was originally published on this site.

EXCLUSIVE:Cryptocurrency infrastructure linked toIran’s Islamic Revolutionary Guard Corps (IRGC)continued operating during the country’s nationwide internet blackout after the Feb.28 U.S.�It allowed hundreds of millions of dollars in crypto to move out of the country.

“We’ve seen a surge of funds since the first hours of the war,” Raiter said.“It started with tens of millions in the first hours, and it grew to hundreds of millions and more.Money was just flowing out from Iranian crypto accounts.”

Wallets linked to the IRGC received more than $3 billion in cryptocurrency in 2025, according to the internal report based on blockchain intelligence data cited by RAKIA.The report also cites publicly available data from blockchain analysis firm Chainalysis, which estimated Iran’s cryptocurrency ecosystem reached $7.78 billion in activity in 2025.

IRAN PROXIES WAGE WAR ON ISRAEL, THREATEN US INTERESTS AS IRAQ SLAMMED FOR NOT DISARMING THEM

Smoke and flames rise at the site of airstrikes on an oil depot in Tehran on March 7, 2026. The United States and Israel launched strikes against Iran on February 28, prompting Iranian retaliation with missile attacks across the region and intensifying concerns about disruption to global energy and transport.

Strikes on the Iranian leadership, the IRGC and Iranian naval vessels and oil infrastructure have roiled the markets.( Sasan/Middle East Images / AFP via Getty Images)

Raiter said the data suggests Iran has developed a significant crypto-based financial infrastructure capable of operating even duringheavy sanctionsand communications shutdowns.

“The IRGC has been financing proxy operations through the very same crypto corridors that sanctions were designed to shut down,” Raiter said.

The U.S.Department of the Treasury sanctioned cryptocurrency exchanges tied to Iranian actors Jan.30, marking one of the first times the U.S.targeted entire digital asset platforms rather than individual wallets for sanctions evasion linked to the Islamic Revolutionary Guard Corps.

Treasury SecretaryScott Bessentsaid the move was part of a broader effort to disrupt financial networks connected to Tehran, Iran.

“The Treasury will continue to pursue Iranian networks and corrupt elites who enrich themselves at the expense of the people,” Bessent said in a Treasury press release in January.“This also applies to attempts by the regime to use digital assets to circumvent sanctions.”

The recent surge appears to reflect two parallel trends: funds moving to support Iran’s regional proxy networks and money being moved by individuals connected to the regime seeking to protect their personal wealth, according to RAKIA’s analysis.

“The proxy war funding and the personal capital flight are two sides of the same coin,” Raiter said.“They move through the same pipelines.”

IRAN WAR, 11 DAYS IN: US CONTROLS SKIES, OIL SURGES AND THE REGION BRACES FOR WHAT’S NEXT

Tehran’s skyline, including the Azadi Tower, became the backdrop to a crisis shaped as much by cyber disruption as by missiles in the sky. (Kurt “CyberGuy” Knutsson)

Raiter said the firm identified cryptocurrency flows connected to networks previously associated with Iran-backed groups.

“Some of the accounts we saw are connected to areas where money historically flows to proxy wars,�com/category/world/world-regions/middle-east/lebanon" target="_blank" rel="noopener">linked to Lebanonand Yemen.

“Some of it could be people inside the IRGC trying to move their own money,” Raiter said.“But when you see the scale and the timing, it looks coordinated.”

The report produced by RAKIA claims the activity continued even after Iran imposed a sweepinginternet shutdown across the country.National connectivity dropped to roughly 1% of normal levels during the blackout, according to internet monitoring group NetBlocks.

FROM MISSILES TO MINERALS: THE STRATEGIC MEANING BEHIND THE IRAN STRIKE

Military members of the Islamic Revolutionary Guard Corps in western Tehran, Iran(Morteza Nikoubazl/NurPhoto via Getty Images)

Despite that shutdown, RAKIA researchers said they detected more than 1,100 active cryptocurrency nodes operating inside Iran.

“When the internet is at one percent and you still see over a thousand active crypto nodes, you’re not looking at retail users,” Tom Malca, RAKIA’s head of cyber and AI research, said in the report.“Those nodes require dedicated bandwidth, stable power and deliberate exemption from the shutdown.”

RAKIA researchers said the activity suggests specialized infrastructure continued operating even as millions of Iranian civilians were cut off from the internet.

Most of the nodes were concentrated in the Tehran–Qom corridor, according to the report, an area that includes major government and IRGC institutions.Smaller clusters were detected in Iranian cities, including Isfahan, Mashhad, Tabriz and Kermanshah, according to the analysis.

onelink.me/xLDS?pid=AppArticleLink&af_web_dp=https%3A%2F%2Fwww.

Islamic Revolutionary Guard Corps special forces walk on the U.S.flag during a rally commemorating International Quds Day, also known as Jerusalem Day, in Tehran, Iran, March 28, 2025. (Morteza Nikoubazl/NurPhoto via Getty Images)

RAKIA said its investigation relied on a combination of network monitoring and publicly available blockchain intelligence.

The Iranian mission to theUnited Nations in New Yorkdeclined to comment on the report’s claims.

Follow her on X @efratlachter.Stories can be sent toefrat.com.