Recent findings reveal that cryptocurrency infrastructure associated with Iran’s Islamic Revolutionary Guard Corps (IRGC) remained operational during the recent nationwide internet blackout in Iran, which followed U.S.-Israeli airstrikes on February 28. This ongoing activity facilitated the movement of hundreds of millions of dollars in cryptocurrency out of the country, according to a cyber intelligence report reviewed by Fox News Digital.
Omri Raiter, the founder and CEO of RAKIA, a cyber intelligence firm specializing in data analysis for governmental and security agencies, reported a significant uptick in funds leaving Iranian cryptocurrency accounts. The analysis indicated that initial transactions began immediately after the strikes, with tens of millions migrating out within hours, eventually surging into the hundreds of millions. Raiter emphasized the implications of this activity, stating, “Money was just flowing out from Iranian crypto accounts.”
RAKIA’s internal report found that wallets associated with the IRGC received over $3 billion in cryptocurrency in 2025 alone. Further data indicated that Iran’s overall cryptocurrency ecosystem reached an estimated $7.78 billion during the same year, supported by blockchain analysis from Chainalysis.
The situation has exacerbated tensions, particularly as the IRGC has reportedly utilized these financial channels—specifically designed to evade sanctions—to fund its proxy operations in the region. Raiter noted the significance of the crypto infrastructure, which appears resilient despite the heavy sanctions and communication shutdowns imposed during conflicts.
In response to this evolving situation, the U.S. Department of the Treasury announced sanctions against several cryptocurrency exchanges linked to Iranian actors back on January 30. This marked a strategic shift, targeting entire digital asset platforms rather than individual accounts, in an effort to disrupt the financial networks linked to Tehran. Treasury Secretary Scott Bessent articulated a commitment to pursuing Iranian networks that enrich corrupt elites at the expense of the populace, including measures to disrupt their digital asset operations.
The surge in cryptocurrency transactions likely reflects two intersecting trends: funding for Iran’s regional proxies and capital flight by individuals connected to the regime looking to safeguard their wealth. Raiter explained, “The proxy war funding and the personal capital flight are two sides of the same coin. They move through the same pipelines.”
During the recent period of conflict, as Tehran faced a near-total internet blackout—operating at just 1% of normal capacity—RAKIA identified over 1,100 active cryptocurrency nodes within the country. This resilience suggests a specialized infrastructure capable of circumventing the communication breakdown that affected civilians. RAKIA’s research highlighted that a majority of these nodes were located in the Tehran–Qom corridor, an area significant for its governmental and IRGC presence, with additional nodes scattered in other cities like Isfahan, Mashhad, Tabriz, and Kermanshah.
Tom Malca, RAKIA’s head of cyber and AI research, remarked on the implications of finding numerous active cryptocurrency nodes during such an extreme communications shutdown. He indicated that this activity requires stable power and intentional exemption from the internet blackout, suggesting a well-organized operation rather than casual or retail use.
In light of the gravity of these allegations, the Iranian mission to the United Nations in New York opted not to comment on the claims surrounding its cryptocurrency activities, leaving many to speculate on the potential ramifications for regional stability and international relations.
