Iran’s crypto market has faced another stress test under the combined pressure of geopolitical shocks and long-standing sanctions. Within hours of reports of the attack, a wave of commentary emerged around crypto outflows, with Nobitex becoming the focal point for interpreting investor behavior. Some observers framed the spike as a sign of capital flight. Others cautioned that the raw numbers could be shaped by routine operational transfers and severe connectivity constraints inside the country.
What the On Chain Data Shows
According to Elliptic’s assessment, the first signs of stress appeared almost immediately after news of the strike spread. Outflows from Nobitex, measured as transfers from exchange linked addresses to external wallets, rose abruptly. The firm said the flow increased by more than 700%, pushing above $500,000 shortly after the incident. Later in the day, a peak of roughly $3 million was recorded within a narrow time window.
In moments of crisis, sudden exchange outflows are often interpreted as a shift toward self custody, as users try to reduce counterparty risk. However, outflow data alone does not settle the question of intent. The same pattern can be produced by customers withdrawing funds, or by an exchange moving assets between its own wallets as part of risk controls.
Elliptic Points to Capital Flight Risk Under Sanctions Pressure
Elliptic placed the surge in the broader context of Iran’s restricted financial system, where crypto can function as an alternative rail for moving value. The firm suggested that spikes like these can coincide with efforts to bypass banking controls and route funds through channels that are less dependent on domestic intermediaries.
A key factor behind the market’s sensitivity is Nobitex’s dominance. Elliptic notes that the exchange processed $7.2 billion in crypto transactions in 2025 and serves a user base of more than 11 million. With such a large share of local liquidity concentrated on one platform, abnormal flows at Nobitex are often read as a country level signal, even when transfers can reflect different types of activity.
TRM Labs Sees Internal Transfers and a Broader Activity Decline
TRM Labs offered a more cautious interpretation. While acknowledging unusual movement around the time of the strike, the firm argued it is premature to label the episode as capital flight. TRM’s analysis suggested that part of the observed surge could be explained by internal movements from hot wallets to cold storage, rather than mass customer withdrawals.
TRM highlighted large transfers on the Polygon network that may reflect exchange controlled treasury operations. The firm also referenced other sizable movements that could align with security and liquidity management, especially in a high risk environment where exchanges may consolidate funds to reduce exposure.
TRM’s broader takeaway focused on market function rather than outflow totals alone. The firm emphasized that Iran’s trading and transfer activity appeared to contract sharply, pointing to a period of significantly reduced overall volume. In that framework, the story is not only about funds leaving, but also about the market’s ability to operate under exceptional constraints.
Internet Disruptions Added a Second Shock
One of the defining features of the episode was the scale of internet disruption reported in Iran. A steep drop in connectivity can limit access to exchanges, reduce the number of active traders, and delay withdrawals. This can produce a pattern where early spikes are followed by quiet periods, not because stress has eased, but because the system is partially immobilized.
This dynamic can pull the data in two directions. At first, fear can drive demand for withdrawals and self custody. But connectivity restrictions can prevent that demand from fully translating into executed transfers, complicating attempts to read intent from the blockchain alone.
Pressure on the USDT Toman Corridor
TRM also highlighted steps affecting the USDT to toman market, a key bridge between crypto and Iran’s local currency. The firm said some exchanges temporarily halted the pair. Such a move can hinder price discovery, squeeze liquidity, and amplify stress, particularly in a market where stablecoins play a central role in day to day transactions and value preservation.
Any disruption to this corridor can ripple quickly across the ecosystem, influencing on chain flows and user behavior as traders adjust to limited fiat on ramps and off ramps.
Why Nobitex Is at the Center of the Story
Nobitex’s position in Iran’s crypto landscape makes it the natural lens for tracking market reactions. Years of sanctions, capital controls, and currency weakness have pushed many users toward crypto for trading, hedging, and transfers. As a result, what happens on Iran’s largest exchange is frequently treated as a proxy for financial stress, especially in periods of political or security turmoil.
At the same time, the exchange’s operational choices can shape on chain patterns. How it manages wallet security, liquidity, and withdrawal processing during crises can materially influence the flows analysts see. That is also why interpretations diverge, since similar blockchain footprints can emerge from different underlying causes.
What to Watch Next
Analysts say the most important question is destination. If funds leaving Nobitex flow predominantly to addresses linked with overseas exchanges, it would strengthen the case for a capital flight narrative. If transfers are largely moving into exchange controlled cold wallets, the episode may look more like a defensive operational response.
In the near term, attention is likely to remain on three signals. Markets will watch whether the USDT to toman channel normalizes, how quickly connectivity stabilizes, and whether subsequent on chain flows show sustained migration away from domestic platforms. Iran’s crypto market is navigating geopolitical shock and technical constraint at the same time, making the next set of data points crucial for separating panic driven withdrawals from routine risk management.
