Nobitex Sees No Sustained User Withdrawal Surge After Iran Strikes, Reports Show
Nobitex, Iran’s largest cryptocurrency exchange, did not experience a prolonged, customer-driven withdrawal surge following the U.S.-Israeli strikes on Iran that began on February 28, 2026, according to separate blockchain forensic analyses. While on-chain data initially showed a spike in activity and broader outflows from Iranian trading platforms, the movements were later attributed to routine operations rather than a panic-driven capital flight by everyday users.
Initial On-Chain Activity Interpreted as Treasury Management
A report from TRM Labs, which analyzed on-chain transactions around Nobitex in the immediate aftermath of the strikes, documented a noticeable uptick in activity. This included transfers of over $35 million from the exchange’s hot wallets to cold storage. However, TRM’s investigation, referencing the exchange’s historical wallet behavior and attribution data, concluded these transfers were consistent with standard liquidity management practices.
“Based on historical behavior and wallet attribution, these movements aligned with routine liquidity management rather than user-driven withdrawals,” the TRM report stated. This distinction is critical: internal treasury rebalancing by an exchange differs significantly from a mass exodus of customer funds, which would typically involve a much higher volume of diverse, external wallet addresses.
Nobitex’s Central Role and Recent Recovery from a Major Hack
Nobitex operates at the heart of Iran’s cryptocurrency ecosystem. TRM Labs estimates the platform has processed transaction volumes totaling tens of billions of dollars since its inception in 2019, with over $5 billion in volume recorded in 2025 alone.
The exchange’s operational resilience was tested in June 2025 when it suffered a $90 million cyberattack attributed to the Israel-linked hacking group Predatory Sparrow. The breach exposed Nobitex’s multi-layer custody architecture, which segregates assets across hot, warm, and cold wallets, and its automated transaction routing systems.
In a notable recovery step, Nobitex mobilized approximately $2.7 million from more than 100 dormant wallets linked to earlier Bitcoin (BTC) mining activities. This move, revealed by TRM, helped stabilize operations post-hack. The exchange subsequently restored services in phases later in 2025.
Broader Outflows from Iranian Exchanges Observed
While Nobitex itself did not see sustained user withdrawals, Chainalysis reported a significant, short-lived spike in outflows from Iranian cryptocurrency exchanges overall. Between February 28 and the following Monday, an estimated $10.3 million in digital assets departed these platforms. At its peak, hourly outflow volumes surged to levels 873% higher than the 2026 average.
Chainalysis outlined several plausible explanations for these broader movements. They may reflect ordinary Iranian citizens transferring funds to self-custody wallets as a hedge against economic and geopolitical instability. Alternatively, the activity could involve exchanges themselves repositioning liquidity or creating new addresses to obfuscate transactions amid intensified sanctions scrutiny. A further possibility is that state-aligned actors are utilizing domestic exchange infrastructure to facilitate cross-border fund transfers.
These findings illustrate a nuanced on-chain landscape: while the immediate geopolitical event triggered measurable blockchain activity, the patterns for the market leader, Nobitex, were internally driven. The broader outflow trend from Iran’s exchange sector, however, points to a more complex mix of user precaution, institutional maneuvering, and potential sanctioned evasion tactics.
This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently. Read our Editorial Policy.
