Iran transferred hundreds of millions of dollars in cryptocurrency during a nationwide internet blackout following U.S.–Israeli strikes, according to a cyber intelligence report reviewed by Fox News Digital. The report indicates that cryptocurrency infrastructure linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) continued operating despite the blackout, enabling significant funds to move out of the country.
Cryptocurrency Activity Persists Amid Sanctions and Shutdown
Omri Raiter, founder and CEO of cyber intelligence firm RAKIA, stated his team monitored Iranian cryptocurrency activity in real time after the February 28 attacks and observed a surge of funds departing Iranian-linked crypto wallets. “It started with tens of millions in the first hours and grew to hundreds of millions,” Raiter said. The report notes that wallets tied to the IRGC received over $3 billion in cryptocurrency in 2025, while blockchain analysis firm Chainalysis estimated Iran’s crypto ecosystem reached nearly $7.78 billion in activity that year.
RAKIA’s data suggests Iran has developed a crypto-financial network capable of functioning despite heavy sanctions and communications restrictions. Treasury Secretary Scott Bessent highlighted U.S. efforts to target cryptocurrency exchanges linked to Iranian actors as part of sanction enforcement, including a January 30 sanction on entire digital asset platforms connected to the IRGC.
Specialized Crypto Infrastructure Remains Operational During Blackout
The report found that over 1,100 active cryptocurrency nodes persisted in Iran even when national internet connectivity dropped to around 1%, according to monitoring group NetBlocks. These nodes, concentrated mainly in the Tehran–Qom corridor—a zone housing major government and IRGC institutions—require dedicated bandwidth and power, indicating they were deliberately exempted from the shutdown. Smaller node clusters appeared in cities including Isfahan, Mashhad, Tabriz, and Kermanshah.
RAKIA researchers also linked crypto flows to Iran-backed proxy regions such as Lebanon and Yemen, suggesting the transfers covered both proxy network funding and the movement of regime-linked individuals’ personal wealth. This dual purpose was described by Raiter as “two sides of the same coin” moving through shared channels.
For more stories on this topic, visit our category page.
