Main Points：
- Between January and July 2025, cryptocurrency inflows into Iran fell to USD 3.7 billion, down 11 % year‑on‑year.
- The sharpest declines occurred in June (‑50 % YoY) and July (‑76 % YoY), driven by geopolitical tensions, outages, and internal disruptions.
- The USD 90 million hack on Nobitex—responsible for 87 % of Iran’s crypto volume—crippled domestic confidence and liquidity.
- Tether’s largest‑ever freeze of 42 Iranian-linked wallets disrupted transaction channels, pushing users to migrate to DAI on Polygon.
- Despite disruptions, illicit activity remains limited to ~0.9 % of volume, while crypto continues as a tool for inflation hedging, sanctions evasion, and even espionage payments.
- IRGC-linked procurement and state surveillance risks highlight both political and financial dimensions of Iran’s crypto use.
- Iran’s crypto ecosystem shows resilience and adaptability, with clear shifts in user behavior and platforms.
1. Declining Inflows: From USD 4+ Billion Outflows to Now Shrinking Inflows
Between January and July 2025, Iran’s cryptocurrency inflows totaled approximately USD 3.7 billion, marking an 11% decline compared to the same period in 2024. The situation became more pronounced from June, when inflows dropped more than 50% year‑on‑year, and by July they had collapsed by over 76%.
This downturn coincided with the collapse of nuclear negotiations, a 12‑day conflict with Israel beginning June 13, and widespread power outages in Iran—attributed to a mix of Israeli kinetic and cyber operations and regime‑initiated shutdowns.
2. Nobitex Hack: A Blow to Trust and Liquidity
Nobitex, Iran’s largest cryptocurrency exchange handling over 87% of Iran‑linked crypto volume in 2025, was hacked on June 18, resulting in the loss of about USD 90 million. The hack was carried out by a pro‑Israel hacker group known as Predatory Sparrow (Gonjeshke Darande), who transferred the stolen assets to “burner” wallets bearing IRGC slogans, effectively making them irretrievable.
Following the breach, outflows from Nobitex surged more than 150% in one week as users rushed to move assets to global or high‑risk offshore exchanges with lax or no KYC restrictions. TRM Labs emphasized that the hack did not appear financially motivated but served as a political strike—damaging user confidence, compromising liquidity, and exposing surveillance features embedded in the platform .
3. Tether Freeze Shakes Settlement Channels
On July 2, Tether conducted its largest-ever freeze of 42 Iranian-linked wallets, including accounts associated with Nobitex and IRGC-linked actors. This sudden liquidity disruption triggered widespread concern.
In response, Tehran-based exchanges, influencers, and government channels advised users to shift away from TRON-based USDT (being widely used) toward DAI on the Polygon network, reflecting a broader shift in settlement strategies.
4. Crypto Use Persists: Hedge, Evasion, Espionage
Despite these disruptions, TRM Labs notes that illicit activity on Iranian exchanges remains low, at approximately 0.9% of total transaction volume—on par with global averages.
For ordinary Iranians, cryptocurrencies are still a vital tool to hedge against inflation and financial instability. At the same time, state-linked actors (notably the IRGC) continue to use crypto for sanctions evasion, procurement of AI and drone parts, and, increasingly, foreign intelligence payments. In fact, TRM documented the first known instances of espionage-related crypto payments between Iran and foreign operatives.
5. Adaptation: Shifts in Chains, Platforms, and Behavior
The combined shocks—geopolitical instability, Nobitex hack, and Tether freeze—spurred swift adaptation within Iran’s crypto ecosystem.
- Major migration from TRON/USDT to Polygon/DAI as a workaround to preserve liquidity and avoid freezes.
- Outbound flows remained more resilient than inward flows, highlighting crypto’s continued role in capital flight amid sanctions.
- Even with Nobitex’s compromised security, it continues to dominate Iran’s crypto volume, underlining structural reliance on a single platform.
6. Broader Context: Energy, Economy, Regulation
Iran’s broader economic crisis—hyperinflation over 40%, rising poverty, chronic power shortages, and energy infrastructure strain—forms the backdrop to these crypto trends. Unauthorized cryptocurrency mining has been blamed for contributing to rolling blackouts.
Meanwhile, regulatory shifts—including the central bank’s past blocking of crypto‑to‑rial payments and controlled reopening via government APIs starting in January 2025—highlight regulatory volatility.
Summary & Outlook
Despite the turbulence of mid‑2025, Iran’s crypto ecosystem has shown remarkable resilience. Inflows have declined sharply, domestic trust in exchanges has been shaken, and settlement channels disrupted—yet citizens still rely on digital assets for economic survival, and state actors continue to leverage crypto for strategic objectives.
Moving forward, the ecosystem’s sensitivity to external shocks suggests further volatility ahead. However, the rapid shift toward alternative platforms like Polygon/DAI, continued capital flight, and crypto’s embedded role in statecraft and daily finance indicate enduring adaptation.
