TRM Labs says that Iran's biggest crypto exchange shows no clear signs of large amounts of mone

Iran's Top Crypto Exchange Nobitex Stood Firm After Airstrikes, Data Shows—No User Panic, Just Internal Moves

When the U.S. and Israel launched strikes on Iran, you might have expected a mad rush to pull crypto out of the country's biggest exchange. But according to fresh data from TRM Labs and Chainalysis, that's not what happened. At least not at Nobitex.

Sure, there was a brief spike in activity across Iranian exchanges overall. And yeah, some money did flow out. But TRM's deep dive into Nobitex's on-chain activity after the February 28 strikes tells a different story than a user-driven exodus.

Right after the attacks, things did get busy. TRM spotted over $35 million moving from Nobitex's hot wallets into cold storage. That might sound like people pulling their funds, but TRM says hold on—this looks like the exchange itself managing its own assets, not users rushing for the exits.

"Based on historical behavior and wallet attributions, these flows are consistent with routine liquidity management operations, rather than user-initiated withdrawals," the report explains. Nobitex is a giant in Iran's crypto scene. TRM figures it's processed tens of billions of dollars since 2019, with over $5 billion of that just since the start of 2025.

This isn't the first time Nobitex has faced heat. Back in June 2025, they got hit hard by a cyberattack blamed on an Israel-linked group called Predatory Sparrow. The hackers made off with a whopping $90 million. That breach actually spilled the beans on Nobitex's internal setup—their multi-layer custody system with hot, warm, and cold wallets, plus an automatic router for handling different network transactions.

After that hack, Nobitex had to get creative. TRM found they tapped into some old Bitcoin mining reserves to stay afloat. More than 100 wallets that had been sitting idle, linked to mining operations, suddenly consolidated about $2.7 million. It's a pretty clear sign the platform was digging into untouched funds to keep things running while they worked on recovery.

And despite all that chaos, Nobitex managed to phase back in its trading services over the course of 2025.

But while Nobitex held steady, the broader picture across Iranian exchanges is a bit different. Chainalysis crunched the numbers and found that between February 28 and this Monday, about $10.3 million in crypto flowed out of various Iranian platforms. At its peak, the hourly outflow rate was a staggering 873% higher than the 2026 average.

So what's behind that? Chainalysis floats a few theories. It could be regular Iranians moving their money into self-custodial wallets, trying to protect themselves from economic uncertainty. Or maybe it's exchanges shuffling their own liquidity behind the scenes. Another possibility is people creating fresh wallets to dodge sanctions and hide their transaction trails. And then there's the more serious angle: state-affiliated players potentially using local exchanges to sneak funds across borders.