TL;DR:
- TRM analyzed Nobitex’s activity following U.S. and Israeli attacks and found no clear signs of capital flight from the Iranian exchange.
- Transfers of over $35 million to cold storage were classified as routine liquidity management, not mass user withdrawals.
- Chainalysis detected $10.3 million in outflows from Iranian exchanges between February 28 and Monday, with peaks 873% above the 2026 average.
TRM Labs published an analysis on the activity of Nobitex, the largest cryptocurrency exchange in Iran, following the military strikes launched by the United States and Israel on February 28. The report concluded that the increase recorded in onchain flows does not constitute evidence of user-driven capital flight, but rather reflects internal fund management operations.
According to TRM, the platform recorded transfers exceeding $35 million from hot wallets to cold storage during the analyzed period. The report noted that, when evaluated against historical behavior and wallet attribution, the operations align with the exchange’s standard operational rebalancing. Nobitex has processed tens of billions of dollars in volume since 2019 and more than $5 billion since 2025 alone, making the platform the primary gateway for crypto assets entering and exiting the country.
The 2025 Hack and the Mining Reserves
In June 2025, Nobitex suffered an exploit attributed to the Israel-linked hacker group Predatory Sparrow, with losses of approximately $90 million. The attack exposed the exchange’s internal architecture: a multi-layered custody system with hot, warm, and cold wallets, alongside automated routing logic designed to manage transactions across different networks and circumvent U.S. regulatory controls.
Following the incident, TRM identified that the exchange consolidated around $2.7 million from more than 100 wallets tied to Bitcoin mining that had remained dormant since 2021 and 2022. Most of those funds originated from the mining pools EMCD and ViaBTC. The timing of the consolidation, immediately after the hack and prior to the restoration of withdrawals, suggests that Nobitex mobilized dormant reserves to stabilize its operations.
TRM Will Closely Monitor All of Nobitex’s Operations
In parallel, a report by Chainalysis offered a different reading of the broader picture. According to the firm, approximately $10.3 million left Iranian exchanges between February 28 and Monday, with flows reaching as much as 873% above the average recorded in 2026. Its analysis presents three hypotheses: ordinary Iranians moving funds to self-custody solutions as a hedge against economic instability, exchanges repositioning liquidity under sanctions pressure, or regime-aligned actors using domestic platforms to move funds across borders.
TRM indicated it will continue monitoring Nobitex’s liquidity position and its onchain counterparties as the conflict evolves.
