Iran moves hundreds of millions in crypto during nationwide internet blackout, report reveals

Omri Raiter, founder and CEO of RAKIA, a cyber intelligence firm that develops data analysis platforms used by governments and security agencies, told Fox News Digital his team began monitoring Iranian cryptocurrency activity in real time after the attacks and quickly detected a surge of funds leaving Iranian-linked crypto accounts.

"We've seen a surge of funds since the first hours of the war," Raiter said. "It started with tens of millions in the first hours, and it grew to hundreds of millions and more. Money was just flowing out from Iranian crypto accounts."

Wallets linked to the IRGC received more than $3 billion in cryptocurrency in 2025, according to the internal report based on blockchain intelligence data cited by RAKIA. The report also cites publicly available data from blockchain analysis firm Chainalysis, which estimated Iran's cryptocurrency ecosystem reached $7.78 billion in activity in 2025.

"The IRGC has been financing proxy operations through the very same crypto corridors that sanctions were designed to shut down," Raiter said.

The U.S. Department of the Treasury sanctioned cryptocurrency exchanges tied to Iranian actors Jan. 30, marking one of the first times the U.S. targeted entire digital asset platforms rather than individual wallets for sanctions evasion linked to the Islamic Revolutionary Guard Corps.

"The Treasury will continue to pursue Iranian networks and corrupt elites who enrich themselves at the expense of the people," Bessent said in a Treasury press release in January. "This also applies to attempts by the regime to use digital assets to circumvent sanctions."

The recent surge appears to reflect two parallel trends: funds moving to support Iran's regional proxy networks and money being moved by individuals connected to the regime seeking to protect their personal wealth, according to RAKIA's analysis. 

"The proxy war funding and the personal capital flight are two sides of the same coin," Raiter said. "They move through the same pipelines."

Raiter said the firm identified cryptocurrency flows connected to networks previously associated with Iran-backed groups. 

"Some of it could be people inside the IRGC trying to move their own money," Raiter said. "But when you see the scale and the timing, it looks coordinated."

Despite that shutdown, RAKIA researchers said they detected more than 1,100 active cryptocurrency nodes operating inside Iran.

"When the internet is at one percent and you still see over a thousand active crypto nodes, you're not looking at retail users," Tom Malca, RAKIA's head of cyber and AI research, said in the report. "Those nodes require dedicated bandwidth, stable power and deliberate exemption from the shutdown."

RAKIA researchers said the activity suggests specialized infrastructure continued operating even as millions of Iranian civilians were cut off from the internet.

Most of the nodes were concentrated in the Tehran-Qom corridor, according to the report, an area that includes major government and IRGC institutions. Smaller clusters were detected in Iranian cities, including Isfahan, Mashhad, Tabriz and Kermanshah, according to the analysis.

RAKIA said its investigation relied on a combination of network monitoring and publicly available blockchain intelligence.