The cryptocurrency market in Iran reacted within hours of joint U.S.–Israeli airstrikes on February 28, with on-chain data showing a sharp spike in outflows from major domestic exchanges, reinforcing the role of digital assets as a financial escape valve during geopolitical shocks.

According to a March 3 report by blockchain analytics firm Chainalysis, approximately $10.3 million in cryptoassets flowed out of Iranian exchanges between February 28 and March 2.

Hourly outflows surged to nearly $2 million within several hours of news of the strikes breaking, exceeding typical volume patterns for that time frame.

The movements echo a broader trend identified by Chainalysis earlier this year, which stated that Iran’s crypto ecosystem tends to see bursts of on-chain activity during moments of military escalation, domestic unrest, and sanctions pressure.

Crypto As A Real-Time Geopolitical Pressure Gauge

Chainalysis previously analyzed Iran’s $7.8 billion crypto ecosystem in 2025, finding that trading volumes and blockchain transfers consistently spike around major political events, including the Kerman bombings in early 2024 and direct clashes with Israel during 2024–2025.

“On-chain data shows a sharp increase in activity from major Iranian exchanges in the hours following the February 28, 2026 US-Israeli airstrikes, with roughly $10.3M in cryptoasset outflows between February 28 and March 2," the report stated.

During a recent protest wave, Bitcoin (BTC) withdrawals climbed steadily in the days leading up to a January 8 internet blackout, then flattened while connectivity was cut, before resuming once access returned.

That pattern suggested that users were anticipating instability and moving funds into self-custody when possible.

The new surge following the airstrikes appears to follow the same template: geopolitical escalation followed by rapid liquidity movement.

For observers, the speed of the response stands out.

Where currency crises once unfolded over days or weeks, blockchain activity now offers near real-time signals of economic anxiety and risk management behavior.

Three Plausible Drivers Behind The Outflows

While the spike in withdrawals is clear, the motivations behind it remain uncertain. Chainalysis emphasizes that multiple interpretations are possible.

Also Read: Exclusive: Crypto Firms Shouldn’t Assume Enforcement Is Over, SEC’s Hester Peirce Warns

A breakdown of transactions shows substantial flows to overseas mainstream exchanges, other domestic Iranian exchanges, and a significant portion to what the firm categorizes as “other wallets.”

“In the immediate aftermath of events like this weekend’s strikes, it’s too early to say how much of the activity reflects each. As more time passes, onward funds movements will sharpen the picture,” Chainalysis explained.

The firm outlined three potential drivers.

First, ordinary Iranian citizens may be withdrawing funds from centralized platforms into self-custodial wallets as a hedge against instability, sanctions tightening, or potential restrictions on exchange access.

Second, exchanges themselves may be moving liquidity into new wallets to obfuscate activity.

Platforms operating in sanctioned jurisdictions frequently rotate addresses to reduce exposure to enforcement scrutiny and cyber risk. In 2025, hackers exploited Nobitex, Iran’s largest crypto exchange, resulting in the theft of more than $90 million in assets, highlighting operational vulnerabilities.

Third, state-aligned actors may be using mainstream Iranian exchanges as conduits for cross-border transfers tied to sanctions evasion or trade activity.

Historically, local platforms have served as rails for such activity during periods of heightened financial pressure.

Sanctions Enforcement Enters A Real-Time Blockchain Era

The report highlights the growing complexity facing regulators and intelligence agencies attempting to interpret blockchain signals during geopolitical crises.

Internet disruptions can distort retail participation while leaving sophisticated actors operational. Service-controlled wallets can resemble user withdrawals.

Liquidity reshuffling for operational security reasons can appear politically motivated when viewed externally.

“From this close to the events, it’s extremely difficult to confidently separate retail flight from service-level wallet management, from state-related activity,” Chainalysis noted.

Read Next: Tramplin Data Shows Dormant Retail Capital As Solana’s Next Major Catalyst