Iran moved hundreds of millions in crypto during blackout, report claims
NEWYou can now listen to Fox News articles!
SPECIAL: A cyber intelligence report reviewed by Fox News Digital alleges that Iran’s Islamic Revolutionary Guard Corps (IRGC) cryptocurrency infrastructure continued to operate during the nationwide internet outage following the February 28 US-Israeli attacks, allowing hundreds of millions of dollars of cryptocurrency to move out of the country.
Omri Raiter, founder and CEO of RAKIA, a cyber intelligence firm that develops data analysis platforms used by governments and security agencies, told Fox News Digital that his team began monitoring cryptocurrency activity in Iran in real time after the attacks and detected an increase in funds leaving Iran-linked crypto accounts.
“We have seen an increase in funds since the first hours of the war,” Raiter said. “It started with tens of millions in the first hours, grew to hundreds of millions and more. Money was flowing through Iran’s crypto accounts.”
Wallets affiliated with the IRGC received more than $3 billion in cryptocurrencies in 2025, according to the internal report based on blockchain intelligence data cited by RAKIA. The report also includes publicly available data from blockchain analysis firm Chainalysis, which estimates Iran’s cryptocurrency ecosystem to reach $7.78 billion in activity by 2025.
IRANIAN PROXYS ARE DECISIONING WAR ON ISRAEL, THREATENING US INTERESTS WHILE IRAQ IS BEING PUNISHED FOR NOT DISARMING THEM
Attacks on the Iranian leadership, the Revolutionary Guard, Iranian navy ships and oil infrastructure have roiled markets. (Sasan / Middle East Images / AFP via Getty Images)
Raiter said the data shows that Iran has developed a significant crypto-based financial infrastructure that can operate even during heavy sanctions and communications blackouts.
“IRGC funds proxy operations through the same crypto corridors that sanctions were designed to close,” Raiter said.
The US Treasury Department approved cryptocurrency exchanges linked to Iranian actors on January 30; This marked one of the first examples of the US targeting entire digital asset platforms rather than individual wallets to avoid sanctions linked to the Islamic Revolutionary Guard Corps.
Treasury Secretary Scott Bessent said the move was part of a broader effort to disrupt financial networks tied to Tehran, Iran.
“Treasury will continue to pursue Iranian networks and corrupt elites who enrich themselves at the expense of the public,” Bessent said in a Treasury Department press release in January. “This also applies to the regime’s attempts to use digital assets to circumvent sanctions.”
According to RAKIA’s analysis, the recent increase appears to reflect two parallel trends: funds moved to support Iran’s regional proxy networks and money moved by regime-linked individuals seeking to protect their personal wealth.
“Proxy war financing and personal capital flight are two sides of the same coin,” Raiter said. “They go through the same pipelines.”
IRAN WAR, IN 11 DAYS: US SKIES CONTROL OIL INCREASES AND THE REGION IS PREPARING FOR WHAT’S NEXT
Tehran’s skyline, including the Azadi Tower, has become the backdrop to a crisis shaped as much by cyber disruptions as by missiles in the sky. (Kurt “CyberGuy” Knutsson)
Raiter said the firm had previously detected cryptocurrency flows linked to networks associated with Iranian-backed groups.
“Some of the accounts we’re seeing are linked to areas where money has historically flowed into proxy wars,” he told Fox News Digital, referring to activities linked to Lebanon and Yemen.
“Some of them may be individuals within the IRGC who are trying to move their own money,” Raiter said. “But when you see the scale and timing, it looks coordinated.”
The report prepared by RAKIA claims that the activity continued even after Iran comprehensively shut down the internet across the country. National connectivity dropped to roughly 1% of normal levels during the outage, according to internet monitoring group NetBlocks.
FROM MISSILES TO MINERALS: THE STRATEGIC MEANING BEHIND THE IRAN ATTACK
Military members of the Islamic Revolutionary Guard Corps (IRGC) in western Tehran, Iran (Morteza Nikoubazl/NurPhoto via Getty Images)
Despite this closure, RAKIA researchers said they identified more than 1,100 active cryptocurrency nodes operating in Iran.
“When the internet is at one percent and you still see over a thousand active crypto nodes, you’re not looking at retail users,” RAKIA’s head of cyber and artificial intelligence research, Tom Malca, said in the report. “These nodes require dedicated bandwidth, stable power, and intentional immunity from shutdown.”
RAKIA researchers said the activity shows that private infrastructure continues to operate even as millions of Iranian civilians lose their internet connection.
According to the report, most of the nodes were concentrated in the Tehran-Qom corridor, which includes major government and Revolutionary Guard institutions. According to the analysis, smaller clusters were detected in Iranian cities such as Isfahan, Mashhad, Tabriz and Kermanshah.
CLICK TO DOWNLOAD FOX NEWS APPLICATION
Islamic Revolutionary Guard Corps (IRGC) special forces march on the US flag during a rally commemorating International Quds Day, also known as Quds Day, in Tehran, Iran, on March 28, 2025. (Morteza Nikoubazl/NurPhoto via Getty Images)
RAKIA said its investigation was based on a combination of network monitoring and publicly available blockchain intelligence.
Fox News Digital has reached out to Iran’s delegation to the United Nations in New York for comment on the allegations contained in the report. The mission did not respond.
