Nobitex, Iran’s largest cryptocurrency exchange, showed no signs of sustained user-driven operations after the US and Israeli attacks on Iran, even though blockchain data showed a temporary spike in activity and increased outflows from broader Iranian exchanges, according to separate analyzes by TRM Labs and Chainalysis.
The TRM report examined on-chain activity around Nobitex following the US and Israeli attacks on Iran that began on February 28, and found that the platform recorded a significant increase in activity immediately thereafter, including more than $35 million in transfers from hot wallets to cold storage. However, TRM said the transfer was likely part of the exchange’s internal financial operations.
“Based on past behavior and wallet attribution, these movements are consistent with routine liquidity management rather than user-directed withdrawals,” the report said.
Activities across Novitex. Source: TRM
Nobitex is located at the heart of Iran’s cryptocurrency ecosystem. TRM estimates that the exchange has processed tens of billions of dollars in trade value since 2019, including more than $5 billion in trade value from 2025 alone.
Related: U.S. military uses Antropics in attack on Iran despite President Trump’s ban: WSJ
Nobitex uses Bitcoin mining reserves to recover from hack
In June 2025, Nobitex suffered a cyberattack by the Israeli-affiliated hacker group Predatory Sparrow, resulting in a hacking loss of $90 million. The breach exposed details of Nobitex’s internal architecture, including a multi-layered custody structure that separates hot, warm, and cold wallets, as well as an automated routing system designed to manage transactions across various networks.
After the hack, Nobitex relied in part on reserves related to its initial Bitcoin (BTC) mining activities to stabilize its operations. TRM revealed that approximately $2.7 million was consolidated from more than 100 dormant mining-related wallets immediately after the incident, suggesting that the exchange mobilized unspent funds as it restored service.
Despite the operational disruption, Nobitex resumed its activities in a phased manner in the second half of 2025.
Related: 6 Polymarket traders profit $1 million from US and Iranian attacks, raising insider concerns: report
Cryptocurrency outflows from Iranian exchanges are rapidly increasing
Meanwhile, a Chainalysis report revealed that approximately $10.3 million in digital assets were leaked from Iranian exchanges between February 28 and Monday. At one point, hourly outflows soared to a level 873% higher than the 2026 average.
Iranian virtual currency leak. Source: Chainalysis
The report said that while these transfers may indicate that ordinary Iranians are self-storing funds to avoid economic instability, they may also alter exchange liquidity or create new wallets to obscure activity under sanctions pressure. Another possibility is that state-aligned actors are using domestic exchanges to move funds across borders.
magazine: Bitcoin could take 7 years to upgrade to post-quantum — Co-author of BIP-360
