Iran moves hundreds of millions in crypto during nationwide internet blackout, report reveals

EXCLUSIVE: Cryptocurrency infrastructure linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) continued operating during the country’s nationwide internet blackout after the Feb. 28 U.S.–Israeli strikes, a cyber intelligence report reviewed by Fox News Digital claims. It allowed hundreds of millions of dollars in crypto to move out of the country.

Omri Raiter, founder and CEO of RAKIA, a cyber intelligence firm that develops data analysis platforms used by governments and security agencies, told Fox News Digital his team began monitoring Iranian cryptocurrency activity in real time after the attacks and quickly detected a surge of funds leaving Iranian-linked crypto accounts.

"We've seen a surge of funds since the first hours of the war," Raiter said. "It started with tens of millions in the first hours, and it grew to hundreds of millions and more. Money was just flowing out from Iranian crypto accounts."

Wallets linked to the IRGC received more than $3 billion in cryptocurrency in 2025, according to the internal report based on blockchain intelligence data cited by RAKIA. The report also cites publicly available data from blockchain analysis firm Chainalysis, which estimated Iran’s cryptocurrency ecosystem reached $7.78 billion in activity in 2025.

IRAN PROXIES WAGE WAR ON ISRAEL, THREATEN US INTERESTS AS IRAQ SLAMMED FOR NOT DISARMING THEM

Raiter said the data suggests Iran has developed a significant crypto-based financial infrastructure capable of operating even during heavy sanctions and communications shutdowns.

"The IRGC has been financing proxy operations through the very same crypto corridors that sanctions were designed to shut down," Raiter said.

The U.S. Department of the Treasury sanctioned cryptocurrency exchanges tied to Iranian actors Jan. 30, marking one of the first times the U.S. targeted entire digital asset platforms rather than individual wallets for sanctions evasion linked to the Islamic Revolutionary Guard Corps.

Treasury Secretary Scott Bessent said the move was part of a broader effort to disrupt financial networks connected to Tehran, Iran. 

"The Treasury will continue to pursue Iranian networks and corrupt elites who enrich themselves at the expense of the people," Bessent said in a Treasury press release in January. "This also applies to attempts by the regime to use digital assets to circumvent sanctions."

The recent surge appears to reflect two parallel trends: funds moving to support Iran’s regional proxy networks and money being moved by individuals connected to the regime seeking to protect their personal wealth, according to RAKIA’s analysis. 

"The proxy war funding and the personal capital flight are two sides of the same coin," Raiter said. "They move through the same pipelines."

IRAN WAR, 11 DAYS IN: US CONTROLS SKIES, OIL SURGES AND THE REGION BRACES FOR WHAT’S NEXT

Raiter said the firm identified cryptocurrency flows connected to networks previously associated with Iran-backed groups. 

"Some of the accounts we saw are connected to areas where money historically flows to proxy wars," he told Fox News Digital, citing activity linked to Lebanon and Yemen.

"Some of it could be people inside the IRGC trying to move their own money," Raiter said. "But when you see the scale and the timing, it looks coordinated."

The report produced by RAKIA claims the activity continued even after Iran imposed a sweeping internet shutdown across the country. National connectivity dropped to roughly 1% of normal levels during the blackout, according to internet monitoring group NetBlocks. 

FROM MISSILES TO MINERALS: THE STRATEGIC MEANING BEHIND THE IRAN STRIKE

Despite that shutdown, RAKIA researchers said they detected more than 1,100 active cryptocurrency nodes operating inside Iran.

"When the internet is at one percent and you still see over a thousand active crypto nodes, you're not looking at retail users," Tom Malca, RAKIA’s head of cyber and AI research, said in the report. "Those nodes require dedicated bandwidth, stable power and deliberate exemption from the shutdown."

RAKIA researchers said the activity suggests specialized infrastructure continued operating even as millions of Iranian civilians were cut off from the internet.

Most of the nodes were concentrated in the Tehran–Qom corridor, according to the report, an area that includes major government and IRGC institutions. Smaller clusters were detected in Iranian cities, including Isfahan, Mashhad, Tabriz and Kermanshah, according to the analysis.

RAKIA said its investigation relied on a combination of network monitoring and publicly available blockchain intelligence.

The Iranian mission to the United Nations in New York declined to comment on the report’s claims.