Just 12 hours before the United States and Israel began attacking Iran in late February, Firouz, a crypto user in Tehran, decided to act. “I was feeling all week the war would start soon,” he said.

Trusting his instincts, he moved all his crypto savings out of Nobitex – Iran’s largest digital asset platform and the central hub of the sanctions-hit country’s crypto ecosystem – to his personal digital wallet. “My main thinking was that I could potentially be forfeiting true ownership of any money left in a state-linked or state-monitored Iranian crypto service in the event of war, whether through an action taken by state authorities or as a consequence of cyberattacks,” he said.

Iran’s crypto ecosystem was valued at more than $7.78bn last year, growing at a faster pace compared with 2024, according to crypto transaction monitoring firm Chainalysis. But the data suggests it is not just Iranian citizens who have turned to crypto in a bid to offset the impact of rampant inflation and a weakening currency.

The Islamic Revolutionary Guard Corps (IRGC) accounted for about 50 percent of on-chain activity in the fourth quarter, mirroring its dominance in the country’s economy. Harder to trace and easier to transfer than traditional bank payments, crypto offers a way to sell oil, buy weapons and commodities, circumventing sanctions. And it has also been a method of payment for imports of goods.

Yet Iran’s turn to crypto has also set off a new cat-and-mouse race with the US, with Washington trying to strangle Tehran’s economic options, already limited because of decades of sanctions.

‘Target all financial lifelines’

In early April, Iranian authorities said they would ask oil ships seeking passage through the Strait of Hormuz to pay a toll in cryptocurrency. Reports have emerged of Iran already receiving a number of payments in crypto for ships transiting through the strait.

“It is common for jurisdictions subject to heavy sanctions to naturally gravitate toward cryptocurrency because it provides alternative rail that gives access to finance they are otherwise restricted by sanctions,” said Kaitlin Martin, a senior intelligence analyst at Chainalysis. The estimate that the IRGC hold about half of crypto activities likely reflects a fraction of the true extent of authority-controlled wallets, since many have not yet been identified by regulatory bodies, Martin said.

But earlier this week, the US announced sanctions on a network of Iran-linked crypto wallets, freezing $344m in digital assets, as the Trump administration tries to increase economic pressure on Iran amid negotiations to end their war. “We will follow the money that Tehran is desperately attempting to move outside of the country and target all financial lifelines tied to the regime,” said US Treasury Secretary Scott Bessent on X.

Iran’s economy has for decades operated under a heavy sanctions regime that has barred Iranians from accessing the international financial system. This has helped create a vibrant local cryptocurrency ecosystem that is being used as an alternative channel to bypass economic restrictions.

For Iranians crypto offers a way to hold and preserve the value of their salaries and savings. Keeping their income and savings within the state-controlled financial system would risk losing their hard-earned money to galloping inflation and the collapse of the rial, which has lost about 90 percent of its value since 2018.

But for the past years, it has become harder for the average Iranian to navigate the crypto sphere, too, as IRGC-affiliated entities have taken over crypto mining operations, driving others out and using crypto to evade sanctions.

“By using subsidised electricity, the IRGC engages in crypto mining and is effectively converting energy into non-sanctionable money,” a Tehran-based cryptocurrency and blockchain researcher said, adding that state-linked ransomware operations are also used to generate revenue.

Against that backdrop, the US enforcement agency, Office of Foreign Assets Control (OFAC), classified Iran’s entire crypto ecosystem as high-risk.

“As a result, ordinary people’s connections with international businesses and crypto communities have been almost entirely cut off. Major exchanges freeze Iranian accounts, foreign companies avoid working with counterparts inside the country, and prominent experts with relevant knowledge are unwilling to share that knowledge with Iranians,” the source said. “This is the cost ordinary people are forced to bear.”

On top of that, internet shutdowns – since the start of the war, Iranian authorities have imposed strict internet restrictions – lack of trust towards state-linked entities and cyberattacks have made it more difficult to trade in cryptocurrencies.

What happens when war happens?

Still, two years of successive shocks, including two wars and nationwide protests, have led to a spike in crypto activity. Between February 28 – when joint US-Israel strikes hit Iran – and March 2, monitoring crypto groups detected about $10.3m in cryptoasset outflow, a separate Chainalysis report said. A number of digital wallets used during this surge in cryptocurrency activity were linked to the IRGC.

“Some of the wallets that withdrew funds during the spike have historical upstream or downstream exposure to wallets that have been identified as belonging to the IRGC or services processing IRGC funds, indicating that at least a portion of the activity following the strikes could represent Iranian state movement of funds,” read the report.

Before Israel’s 12-day war in June 2025, crypto crime monitoring group TRM Labs identified a more than 150 percent spike in outflows from Nobitex.

The platform has more than 11 million users and allows Iranians to swap rials for cryptocurrencies, which can then be transferred to digital wallets. In practice, this makes it easier to move money out of Iran while bypassing some of the checks and oversight associated with the global banking system. Within minutes of the first US-Israeli attack last June, outgoing transaction volumes from Nobitex surged by 700 percent, said Elliptic, a blockchain analytics firm.

On June 18, $90m in cryptoassets stored in Nobitex were stolen in a cyberattack widely attributed to the Israel-linked group Predatory Sparrow. The group destroyed the stolen cryptoassets by sending them to a wallet with no known private keys.

Highlighting the importance of cryptocurrency in the Iranian economy, the Central Bank of Iran bought last year more than $500m in USDT, the US dollar-backed stablecoin, according to a January report by Elliptic. That, read the report, indicated “a sophisticated strategy to bypass the global banking system”.

But the US is trying to keep up, too. Before freezing hundreds of millions in cryptocurrency on Wednesday, OFAC in January sanctioned two UK-registered companies, Zedcex and Zedxion, that were operating as unauthorised crypto exchanges. They were accused of involvement in facilitating financial activity that allowed Iran to evade sanctions, Elliptic said.

According to Martin, there will be more of these actions as regulators in the public sector in the US and beyond “are coming to understand” that cryptocurrencies are being used “at scale”.