5 Minutes
Cryptocurrency Volumes Decline Amid Geopolitical and Cyber Disruption
Total cryptocurrency flows tied to Iranian entities dropped to roughly $3.7 billion from January through July 2025, an 11% decline versus the same period in 2024, according to analysis by blockchain intelligence firm TRM Labs. The contraction steepened after April: inflows in June fell by more than 50% year-over-year, and July volumes were down over 76% compared with July 2024.
TRM links the downturn to a cluster of shocks: the collapse of nuclear diplomacy, a 12-day confrontation with Israel beginning June 13, and extensive power outages inside Iran triggered by a mix of kinetic and cyber operations as well as government-mandated blackouts. These events coincided with heightened enforcement, liquidity stress, and declining confidence in domestic platforms.
Nobitex: Market Dominance and Systemic Vulnerability
Nobitex market share and TRON usage
Despite market stress, Nobitex — Iran’s largest exchange — remained central in 2025. TRM data shows Nobitex accounted for more than 87% of Iranian-linked transaction volume during the period, with about $2 billion of roughly $3 billion of its activity moving across the TRON network (notably TRC-20 USDT and TRX).
June hack and short-term fallout
On June 18, Nobitex was hit by a roughly $90 million breach attributed by some investigators to the pro-Israel hacking group Predatory Sparrow. The incident froze platform liquidity, slowed settlements, and prompted many users to seek alternative venues. TRM observed outflows from Nobitex spiking about 150% in the week before the Iran–Israel hostilities, as users shifted funds to global exchanges with looser Know Your Customer (KYC) requirements or to high-risk, no-KYC platforms.
Stablecoin Freeze and Shifts in Settlement Practices
On July 2, 2025, the stablecoin issuer Tether froze 42 crypto addresses associated with Iranian entities — the largest such action the company had taken to date. More than half of those frozen wallets showed exposure to Nobitex; some were also tied to actors previously flagged by Israeli authorities, including accounts linked to IRGC-affiliated individuals.
TRM noted the freeze disrupted established settlement channels, forcing both retail and institutional actors to diversify. Some government-aligned networks and domestic exchanges advised users to move away from USDT and adopt DAI on Polygon (MATIC) as a lower-cost and allegedly more resilient option against sanction-driven freezes. This shift illustrates how network choice, transaction fees and smart-contract architecture can shape crypto settlement behavior under pressure.
Illicit Use, Sanctions Evasion and Everyday Hedging
TRM emphasized that illicit activity at Iranian exchanges remained a relatively small share of total volume — about 0.9% — roughly comparable to global averages. However, crypto still functions as a vector for sanctions evasion and procurement of restricted goods in some cases. On the consumer side, many Iranians continue to use cryptocurrencies as a hedge against inflation and as an alternative store of value amid currency depreciation and limited access to international banking.
TRM’s chain-level forensic work also linked on-chain flows at Nobitex to specific sanctioned actors, including IRGC-linked Amir Hossein Nikaeen Ravari and Gaza Now, a group sanctioned after the October 2023 attacks. Investigators uncovered code within Nobitex infrastructure that raised concerns about warrantless surveillance, which further undermined public confidence.
A Fragile but Adaptable Ecosystem
Amid contraction, Iran’s crypto ecosystem has shown adaptation. Bitcoin mining continues to be a meaningful revenue stream for state and non-state actors; TRM observed previously dormant miner wallets moving funds into Nobitex’s replacement hot wallet after the hack. Underground services such as Novin Verify — offering forged IDs and KYC-bypass tools — are expanding to help sanctioned users access foreign platforms. TRM also reported early documented instances of crypto payments used to compensate foreign operatives, indicating an expanding geopolitical role for digital assets.
Expert Insight: Dr. Sara Emadi, a blockchain security researcher, notes: 'The situation highlights how interconnected blockchain protocols, custodial exchanges and nation-state cyber operations have become. The technical resilience of networks like TRON or Polygon matters, but so do off-chain controls — custody, KYC, and exchange governance. Expect accelerated diversification of stablecoins and cross-chain settlement tools in response to these shocks.'
Conclusion
Iran’s crypto flows contracted in early 2025 as geopolitical conflict, a major exchange hack and a large-scale stablecoin freeze disrupted settlement channels and eroded trust in domestic platforms. While illicit activity on exchanges remains a small fraction of total volume, crypto is still used for sanctions circumvention and as a household hedge against inflation. The ecosystem is fragile but adaptive: miners, alternative stablecoins and underground identity services are reshaping how Iranian actors store, move and settle digital value under persistent external pressure.
Comments