Something strange occurred on the blockchain in the days that followed the initial American-Israeli airstrikes on Tehran on February 28, 2026. In a matter of days, more than $10 million in cryptocurrency departed Iranian exchange platforms. According to Kaitlin Martin of Chainalysis, this unusually large and concentrated outflow was probably caused by “regime actors” acting swiftly to shield assets from potential cyberattacks or additional sanctions. Almost one-third of those funds had already been transferred to foreign exchanges by March 5. The movement’s volume and speed indicated coordination rather than panic. Someone was prepared with the necessary infrastructure and knew what needed to be done.
This is the most obvious manifestation of the resistance economy, a financial structure designed to withstand the kind of pressure the West has been putting on Iran for decades and now modified to function during an open military conflict. Tehran came up with the term “resistance economy,” which refers to an economic strategy based on the presumption that the dollar-based financial system is hostile, that sanctions are permanent, and that survival necessitates the creation of parallel structures that cannot be frozen, seized, or monitored through traditional channels. It turns out that cryptocurrency more closely matches that description than practically any other type of financial instrument.
| Field | Details |
|---|---|
| Topic | Iran’s Use of Cryptocurrency to Evade Sanctions and Fund Proxy Warfare |
| Iran’s Total Crypto Ecosystem Value (2025) | $7.78 billion — growing faster than the prior year |
| IRGC Share of Iran’s Crypto Economy (Q4 2025) | Over 50% of total values received |
| IRGC Crypto Inflows (2024) | $2+ billion; grew to $3+ billion in 2025 |
| Crypto Outflows During U.S.-Israeli Strikes (Feb 28–Mar 2, 2026) | $10.3 million left Iranian exchanges within days |
| Funds Transferred to Foreign Exchanges by March 5 | ~One-third of the $10.3 million outflow |
| Nobitex Hack (June 2025) | $90 million stolen by hackers linked to Israel (per TRM Labs) |
| Iranian Rial Depreciation Since 2018 | ~90% loss in value |
| Inflation Rate (Pre-War) | ~40–50% |
| Iran’s Preferred State Crypto | Stablecoins (particularly Tether/USDT) — favored for price stability |
| Civilian Preference | Bitcoin — self-custodied, censorship-resistant, portable |
| Proxy Groups Funded via Crypto | Houthis (Yemen), Hezbollah (Lebanon), Hamas, Shia Iraqi militias |
| Weapons Sold for Crypto | Ballistic missiles, drones, warships — reported by Financial Times (Jan 2026) |
| Key Analytical Sources | Chainalysis, TRM Labs, Elliptic, ACAMS |
| Reference 1 | Chainalysis — Inside Iran’s Growing $7.8 Billion Crypto Ecosystem |
| Reference 2 | TRM Labs — New Drones, Old Tactics: How Iran Is Experimenting With Crypto to Fund Conflict |
According to Chainalysis, Iran’s digital asset ecosystem grew at a faster rate than the previous year, reaching $7.78 billion in 2025. Just that number would be noteworthy. The breakdown is what’s concerning. As of the fourth quarter of 2025, more than half of Iran’s total cryptocurrency flows came from the Islamic Revolutionary Guard Corps, the paramilitary group that manages the country’s proxy networks, supervises its weapons programs, and controls a sizable portion of its economy. In 2024, wallets connected to IRGC received over $2 billion. By 2025, that amount had risen to more than $3 billion. Additionally, Chainalysis’s blockchain analysts are cautious to point out that these figures only include addresses that have already been identified by Israeli counterterrorism designations and the U.S. Treasury. This means that the real number is most likely higher, possibly significantly so, because shell companies and unidentified facilitators are not counted.
Since the system’s mechanics are not improvised, it is worthwhile to comprehend them in some detail. Iran has been the fifth-largest Bitcoin miner in the world. Mining operations that directly convert natural resources into globally usable digital currency are powered by subsidized domestic energy, which is electricity priced below market rates because it comes from state-controlled infrastructure. SWIFT and correspondent banking are circumvented, and no foreign counterparty is needed to facilitate the output. Oil is sold through cryptocurrency-denominated transactions that are routed through exchanges like Nobitex, Iran’s biggest cryptocurrency platform, which processes billions of transactions every year. TRM Labs has documented the use of sophisticated fund-movement techniques to conceal the origin and destination of flows. The Financial Times revealed in January 2026 that Iran had made a formal offer to sell warships, drones, and ballistic missiles to foreign governments in exchange for cryptocurrency. This arms market is completely independent of the dollar system.
This becomes a conflict-financing story instead of a sanctions-evasion one because of the proxy warfare component. By using privacy tools like mixers and cross-chain bridges to hide the trail, TRM Labs’ on-chain analysis of Houthi-linked wallets has revealed clusters of addresses receiving money through small-denomination inflows routed via unregistered exchanges. Anonymous wallets transacting across multiple blockchains, large transfers divided into smaller movements, and a consistent use of privacy-enhancing protocols to reduce traceability are all patterns that analysts have seen in Iran-aligned networks more generally. Hezbollah, Hamas, and Shia militias in Iraq have all been linked to comparable funding schemes, with Iran providing support not only in the form of weapons and training but also in the form of digital money via channels that were not intended for large-scale detection by current anti-money-laundering frameworks.
Bitcoin is not the preferred medium for state-level transactions in Iran. Stablecoins—more especially, Tether, the dollar-pegged token that offers price stability and is extensively traded on international markets—are the cause. Stablecoins are preferred by the Iranian central bank and the Revolutionary Guards because they remove the volatility risk that makes Bitcoin unsuitable for big, timed transactions like proxy payroll or the purchase of weapons. In contrast, ordinary Iranians have come to favor Bitcoin because of its censorship-resistant, self-custodied nature rather than leaving their savings in a currency that has lost 90% of its value since 2018 and was already experiencing 40% to 50% annual inflation prior to the start of the war. These individuals cannot, strictly speaking, afford the volatility either. Chainalysis recorded a notable increase in Bitcoin withdrawals from Iranian exchanges to personal wallets during the late 2025 mass protests, indicating that the populace was taking financial matters into their own hands before the next internet outage made it impossible.
The particular brutality of the circumstances for common Iranians caught between these systems is difficult to ignore. Millions of citizens attempting to protect their remaining savings rely on the same infrastructure that the IRGC uses to transfer money for weapons and avoid sanctions. The dual-use nature of cryptocurrency, which makes it both a legitimate hedge against economic collapse and a tool for state-sponsored conflict financing, makes the policy response extremely challenging. The IRGC would not be primarily harmed by the closure of Nobitex because it has other channels. The Iranians who use it to safeguard their savings from a declining currency would be the main victims.
Together, the Chainalysis data and TRM Labs analysis show that the financial system has been becoming more complex with every crisis. Every event, including the Kerman bombings in January 2024, Iran’s missile strikes against Israel in October 2024, the twelve-day war in June 2025, and the ongoing conflict, manifests as an increase in on-chain activity, with the IRGC’s share increasing each time. In a way, the only real-time window into the development of this parallel financial system is blockchain analytics. The chain displays the transactions. Over time, the wallets can be recognized. It is possible to trace the patterns. The issue is that tracing is not the same as stopping, and there is still a long way to go between comprehending how the resistance economy functions and actually disrupting it.
