Iran moves hundreds of millions in crypto during nationwide internet blackout, report reveals

EXCLUSIVE: Cryptocurrency infrastructure linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) continued operating during the country’s nationwide net blackout pursuing the Feb. 28 U.S.–Israeli strikes, a cyber quality study reviewed by Fox News Digital claims, allowing hundreds of millions of dollars successful crypto to determination retired of the country.

Omri Raiter, laminitis and CEO of RAKIA, a cyber quality steadfast that develops information investigation platforms utilized by governments and information agencies, told Fox News Digital his squad began monitoring Iranian cryptocurrency enactment successful existent clip aft the attacks and rapidly detected a surge of funds leaving Iranian-linked crypto accounts.

"We've seen a surge of funds since the archetypal hours of the war," Raiter said. "It started with tens of millions successful the archetypal hours and it grew to hundreds of millions and more. Money was conscionable flowing retired from Iranian crypto accounts."

Wallets linked to the IRGC received much than $3 cardinal successful cryptocurrency successful 2025, according to the interior report, based connected blockchain quality information cited by RAKIA. The study besides cites publically disposable information from blockchain investigation steadfast Chainalysis, which estimated Iran’s cryptocurrency ecosystem reached $7.78 cardinal successful enactment successful 2025.

IRAN PROXIES WAGE WAR ON ISRAEL, THREATEN US INTERESTS AS IRAQ SLAMMED FOR NOT DISARMING THEM

Strikes connected the Iranian leadership, the IRGC, and Iranian naval vessels and lipid infrastructure person roiled the markets. ( Sasan / Middle East Images / AFP via Getty Images)

Raiter said the information suggests Iran has developed a important crypto-based fiscal infrastructure susceptible of operating adjacent during dense sanctions and communications shutdowns.

"The IRGC has been financing proxy operations done the precise aforesaid crypto corridors that sanctions were designed to unopen down," Raiter said.

The U.S. Department of the Treasury sanctioned cryptocurrency exchanges tied to Iranian actors Jan. 30, marking 1 of the archetypal times the U.S. targeted full integer plus platforms alternatively than idiosyncratic wallets for sanctions evasion linked to the Islamic Revolutionary Guard Corps.

Treasury Secretary Scott Bessent said the determination was portion of a broader effort to disrupt fiscal networks connected to Tehran, Iran. 

"The Treasury volition proceed to prosecute Iranian networks and corrupt elites who enrich themselves astatine the disbursal of the people," Bessent said successful a Treasury property merchandise successful January and added,x "This besides applies to attempts by the authorities to usage integer assets to circumvent sanctions."

The caller surge appears to bespeak 2 parallel trends: funds moving to enactment Iran’s determination proxy networks and wealth being moved by individuals connected to the authorities seeking to support their idiosyncratic wealth, according to RAKIA’s analysis. 

"The proxy warfare backing and the idiosyncratic superior formation are 2 sides of the aforesaid coin," Raiter said. "They determination done the aforesaid pipelines."

IRAN WAR, 11 DAYS IN: US CONTROLS SKIES, OIL SURGES AND THE REGION BRACES FOR WHAT’S NEXT

Tehran’s skyline, including the Azadi Tower, became the backdrop to a situation shaped arsenic overmuch by cyber disruption arsenic by missiles successful the sky.  (Kurt "CyberGuy" Knutsson)

Raiter said the steadfast identified cryptocurrency flows connected to networks antecedently associated with Iran-backed groups. 

"Some of the accounts we saw are connected to areas wherever wealth historically flows to proxy wars," helium told Fox News Digital, citing enactment linked to Lebanon and Yemen.

"Some of it could beryllium radical wrong the IRGC trying to determination their ain money," Raiter said. "But erstwhile you spot the standard and the timing, it looks coordinated."

The study produced by RAKIA claims the enactment continued adjacent aft Iran imposed a sweeping net shutdown crossed the country. National connectivity dropped to astir 1% of mean levels during the blackout, according to net monitoring radical NetBlocks. 

FROM MISSILES TO MINERALS: THE STRATEGIC MEANING BEHIND THE IRAN STRIKE

Military members of the Islamic Revolutionary Guard Corps (IRGC) successful occidental Tehran, Iran (Morteza Nikoubazl/NurPhoto via Getty Images)

Despite that shutdown, RAKIA researchers said they detected much than 1,100 progressive cryptocurrency nodes operating wrong Iran.

"When the net is astatine 1 percent and you inactive spot implicit a 1000 progressive crypto nodes, you're not looking astatine retail users," Tom Malca, RAKIA’s caput of cyber and AI research, said successful the report. "Those nodes necessitate dedicated bandwidth, unchangeable powerfulness and deliberate exemption from the shutdown."

RAKIA researchers said the enactment suggests specialized infrastructure continued operating adjacent arsenic millions of Iranian civilians were chopped disconnected from the internet.

Most of the nodes were concentrated successful the Tehran–Qom corridor, according to the report, an country that includes large authorities and IRGC institutions. Smaller clusters were detected successful Iranian cities including Isfahan, Mashhad, Tabriz and Kermanshah, according to the analysis.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Islamic Revolutionary Guard Corps (IRGC) Special forces locomotion connected the U.S. emblem during a rally commemorating International Quds Day, besides known arsenic Jerusalem Day, successful Tehran, Iran, connected March 28, 2025.  (Morteza Nikoubazl/NurPhoto via Getty Images)

RAKIA said its probe relied connected a operation of web monitoring and publically disposable blockchain intelligence.

Fox News Digital reached retired to the Iranian ngo to the United Nations successful New York for remark connected the claims made successful the report. The ngo did not respond.