TRM noted that the increase in activity in Nobitex wallets after the strike looked like normal liquidity moves, even though Chainalysis said that more money was leaving Iranian exchanges overall.
Separate studies by TRM Labs and Chainalysis found that Nobitex, Iran’s largest cryptocurrency exchange, did not show signs of a sustained, user-driven run after US-Israeli strikes on Iran. However, blockchain data did show a brief spike in activity and higher outflows from Iranian exchanges in general.
After US-Israeli strikes on Iran began on February 28, the TRM investigation looked at what was happening on-chain surrounding Nobitex. It found that the platform had a lot of activity right initially, with transfers of more than $35 million from hot wallets to cold storage. TRM claimed, though, that the transfers were probably part of the exchange’s internal treasury procedures.
The report stated that these movements aligned with routine liquidity management rather than user-driven withdrawals, based on historical behaviour and wallet attribution.
Nobitex is the most important part of Iran’s crypto ecosystem. TRM said that the exchange had handled tens of billions of dollars in transactions since 2019, with more than $5 billion coming in since 2025.
Source: TRM
Recovery efforts after $90 million hack
In June 2025, Nobitex was hacked for $90 million by a group of hackers affiliated to Israel called Predatory Sparrow. The breach revealed information about Nobitex’s internal architecture, such as a multi-layer custody structure that keeps hot, warm, and cold wallets separate and automated routing mechanisms that handle transactions across different networks.
After the hack, Nobitex used some of its reserves from earlier Bitcoin (BTC $70,758) mining activities to keep things running smoothly. TRM said that shortly after the occurrence, they moved about $2.7 million from more than 100 inactive mining-linked wallets. This implies that the exchange used previously untapped funds to rectify the situation. Even though there were problems with operations, Nobitex started working again in stages later in 2025.
Higher outflows on Iranian exchanges
Chainalysis‘s study also found that around $10.3 million in digital assets left Iranian markets between February 28 and Monday. Hourly outflows shot up to levels that were up to 873% greater than the average for 2026.
The research added that the transfers might be regular Iranians moving money to self-custody to protect themselves from economic upheaval. Others might be exchanges moving money around or making new wallets to hide activities because of sanctions. Another option is that people who work for the government are using domestic exchanges to send money across borders.