TRM Labs finds no evidence of mass capital exodus from Nobitex, Iran's top crypto platform
According to TRM Labs, increased wallet activity on Nobitex following recent strikes appears consistent with standard liquidity operations, despite Chainalysis reporting elevated withdrawal volumes across Iranian crypto platforms.
Iran's leading cryptocurrency exchange, Nobitex, did not experience evidence of a persistent, customer-initiated exodus following US-Israeli military strikes against Iran, despite blockchain intelligence revealing a temporary uptick in platform operations and elevated fund withdrawals from Iranian trading platforms in general, based on independent assessments conducted by TRM Labs and Chainalysis.
The analysis, which scrutinized blockchain transactions associated with Nobitex following the commencement of US-Israeli strikes on Iran starting Feb. 28, discovered that the exchange experienced a marked uptick in operational activity immediately following the military action, including fund movements surpassing $35 million transferred from hot wallet infrastructure to cold storage facilities. TRM Labs indicated, however, that these transactions appeared consistent with the platform's standard internal financial management procedures.
Based on historical behavior and wallet attribution, these movements aligned with routine liquidity management rather than user-driven withdrawals.
TRM report
Nobitex occupies a central position within Iran's cryptocurrency infrastructure. According to TRM's estimates, the trading platform has facilitated transaction volumes reaching tens of billions of dollars from 2019 onward, with more than $5 billion in volume recorded from 2025 to the present alone.
Nobitex uses Bitcoin mining reserves to recover from hack
During June 2025, Nobitex experienced a devastating $90 million security breach following a sophisticated cyberattack that security experts attributed to Predatory Sparrow, a hacking collective believed to have connections to Israel. The security compromise revealed sensitive information regarding Nobitex's underlying technical framework, including details about a sophisticated multi-tiered custody infrastructure that segregates hot, warm and cold wallet storage, alongside automated transaction routing mechanisms engineered to facilitate fund management across multiple blockchain networks.
In the aftermath of the security incident, Nobitex drew upon financial reserves connected to previous Bitcoin (BTC) mining operations to maintain platform stability. TRM's investigation uncovered that approximately $2.7 million in assets was aggregated from over 100 inactive wallets with historical links to mining activities shortly following the breach, indicating the platform activated previously dormant capital reserves during the service restoration process.
Notwithstanding the operational challenges created by the security incident, Nobitex gradually reestablished full functionality in phases throughout the latter portion of 2025.
Crypto outflows from Iranian exchanges jump
In parallel findings, a separate analysis published by Chainalysis disclosed that approximately $10.3 million worth of cryptocurrency assets departed Iranian cryptocurrency exchanges during the window spanning Feb. 28 through March 2. Withdrawal rates measured on an hourly basis temporarily escalated to volumes reaching as high as 873% above the established 2026 baseline average.
According to the Chainalysis assessment, the fund movements could potentially represent everyday Iranian citizens relocating digital assets into self-custodial solutions as a protective measure against potential economic volatility, while alternative scenarios could involve cryptocurrency exchanges rebalancing liquidity positions or establishing fresh wallet addresses to conceal transactional patterns amid intensifying sanctions enforcement. A third potential explanation considers the possibility that government-affiliated entities may be leveraging domestic trading platforms to facilitate cross-border fund transfers.