TRM stated that the surge in wallet activity on Nobitex following the airstrikes appears to be normal liquidation movements, although Chainalysis noted an increase in outflows from Iranian exchanges in general.
Nobitex – Iran's largest crypto exchange – shows no signs of a prolonged wave of mass withdrawals caused by users following the US-Israeli airstrikes on Iran, although blockchain data suggests a short-term increase in activity and outflows from Iranian exchanges in general. This conclusion is reached by two separate analyses from TRM Labs and Chainalysis.
A report by TRM, XEM on-chain activity around Nobitex following the US-Israel attacks on February 28th, shows the platform recorded a notable increase in activity shortly afterward, including transactions transferring over $35 million from hot to Cold Storage wallets. However, TRM believes these transactions were most likely part of the exchange's internal treasury management operations.
"Based on historical behavior and wallet identification, these movements are consistent with routine liquidation management activities rather than user-driven withdrawals," the report stated.
Operating across the entire Nobitex system. Source: TRM
Nobitex plays a central Vai in Iran's crypto ecosystem. TRM estimates that the exchange has processed tens of billions of dollars in volume since 2019, with over $5 billion of that already processed since 2019.
Nobitex uses its Bitcoin mining reserves to recover after the hack.
In June 2025, Nobitex suffered a $90 million cyberattack, believed to have been carried out by the Israeli-linked hacker group Predatory Sparrow. The intrusion exposed details of Nobitex's internal architecture, including a multi-layered custody structure separating hot, warm, and Cold Storage wallets, and automated routing systems for managing transactions across multiple networks.
Following the hack, Nobitex relied in part on reserves associated with its previous Bitcoin mining operations to stabilize its activities. TRM revealed that approximately $2.7 million was recovered from over 100 dormant mining wallets immediately after the incident, indicating that the exchange mobilized unused funds during the service restoration process.
Despite operational disruptions, Nobitex has gradually restored operations in stages towards the end of 2025.
Outflows from Iranian stock exchanges have surged.
Meanwhile, a report by Chainalysis indicated that approximately $10.3 million worth of digital assets left Iranian exchanges between February 28 and Monday. Hourly withdrawals at times were as high as 873% above the 2026 Medium .
Cryptocurrency is flowing out of Iran. Source: Chainalysis
The report suggests these transactions may reflect Iranian citizens transferring assets to self-custody as a hedge against economic instability. Additionally, it's possible that exchanges are shifting liquidation or creating new wallets to conceal activity under sanctions pressure. Another possibility is that state-linked entities are using domestic exchanges to transfer funds abroad.
