EXCLUSIVE: A current cyber intelligence report reviewed by Fox Information Digital signifies that cryptocurrency methods linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) remained energetic throughout the country-wide web blackout following the U.S.-Israeli strikes on February 28. This allowed the switch of a whole bunch of hundreds of thousands of {dollars} in cryptocurrency out of Iran.
Omri Raiter, the founder and CEO of RAKIA, a cyber intelligence agency specializing in knowledge evaluation for presidency and safety businesses, revealed that his crew started carefully monitoring Iranian cryptocurrency actions in real-time after the battle started. They rapidly observed a major outflow of funds from accounts linked to Iran.
“Because the onset of the battle, we’ve noticed a fast enhance in fund transfers,” Raiter said. “Initially, tens of hundreds of thousands have been moved throughout the first hours, ultimately escalating to a whole bunch of hundreds of thousands. The cash was persistently exiting Iranian crypto accounts.”
In line with an inside report using blockchain intelligence knowledge and cited by RAKIA, wallets related to the IRGC obtained over $3 billion in cryptocurrency in 2025. The report additional references public knowledge from the blockchain evaluation agency Chainalysis, which estimated that Iran’s cryptocurrency transactions reached $7.78 billion that yr.
Market turmoil has been triggered by current strikes concentrating on Iranian management, the IRGC, and significant naval and oil infrastructure. (Picture credit score: Sasan/Center East Photographs / AFP by way of Getty Photographs)
Raiter emphasised that the findings point out Iran has established a sturdy, crypto-based monetary community that continues to perform regardless of extreme sanctions and communication disruptions.
“The IRGC has been financing proxy operations by the exact same crypto corridors that sanctions have been designed to close down,” Raiter stated.
The U.S. Division of the Treasury sanctioned cryptocurrency exchanges tied to Iranian actors Jan. 30, marking one of many first occasions the U.S. focused total digital asset platforms somewhat than particular person wallets for sanctions evasion linked to the Islamic Revolutionary Guard Corps.
Treasury Secretary Scott Bessent stated the transfer was a part of a broader effort to disrupt monetary networks linked to Tehran, Iran.
“The Treasury will proceed to pursue Iranian networks and corrupt elites who enrich themselves on the expense of the folks,” Bessent stated in a Treasury press launch in January. “This additionally applies to makes an attempt by the regime to make use of digital property to bypass sanctions.”
The current surge seems to mirror two parallel traits: funds transferring to assist Iran’s regional proxy networks and cash being moved by people linked to the regime looking for to guard their private wealth, in keeping with RAKIA’s evaluation.
“The proxy warfare funding and the non-public capital flight are two sides of the identical coin,” Raiter stated. “They transfer by the identical pipelines.”
Tehran’s skyline, together with the Azadi Tower, grew to become the backdrop to a disaster formed as a lot by cyber disruption as by missiles within the sky. (Kurt “CyberGuy” Knutsson)
Raiter stated the agency recognized cryptocurrency flows linked to networks beforehand related to Iran-backed teams.
“A few of the accounts we noticed are linked to areas the place cash traditionally flows to proxy wars,” he informed Fox Information Digital, citing exercise linked to Lebanon and Yemen.
“A few of it may very well be folks contained in the IRGC attempting to maneuver their very own cash,” Raiter stated. “However while you see the size and the timing, it appears coordinated.”
The report produced by RAKIA claims the exercise continued even after Iran imposed a sweeping web shutdown throughout the nation. Nationwide connectivity dropped to roughly 1% of regular ranges throughout the blackout, in keeping with web monitoring group NetBlocks.
Army members of the Islamic Revolutionary Guard Corps in western Tehran, Iran (Morteza Nikoubazl/NurPhoto by way of Getty Photographs)
Regardless of that shutdown, RAKIA researchers stated they detected greater than 1,100 energetic cryptocurrency nodes working inside Iran.
“When the web is at one % and you continue to see over a thousand energetic crypto nodes, you’re not retail customers,” Tom Malca, RAKIA’s head of cyber and AI analysis, stated within the report. “These nodes require devoted bandwidth, steady energy and deliberate exemption from the shutdown.”
RAKIA researchers stated the exercise suggests specialised infrastructure continued working at the same time as hundreds of thousands of Iranian civilians have been minimize off from the web.
Many of the nodes have been concentrated within the Tehran–Qom hall, in keeping with the report, an space that features main authorities and IRGC establishments. Smaller clusters have been detected in Iranian cities, together with Isfahan, Mashhad, Tabriz and Kermanshah, in keeping with the evaluation.
Islamic Revolutionary Guard Corps particular forces stroll on the U.S. flag throughout a rally commemorating Worldwide Quds Day, also referred to as Jerusalem Day, in Tehran, Iran, March 28, 2025. (Morteza Nikoubazl/NurPhoto by way of Getty Photographs)
RAKIA stated its investigation relied on a mix of community monitoring and publicly obtainable blockchain intelligence.
The Iranian mission to the United Nations in New York declined to touch upon the report’s claims.
