Before the strikes: A shadow economy emerges
A month before bombs fell on Iran, U.S. Treasury investigators were already looking into whether crypto platforms helped Iranian officials evade sanctions. When airstrikes began on February 28, that investigation got what you might call a live stress test. The results were revealing, I think.
Reuters reported in early February that Iran’s crypto transaction volumes had reached an estimated $8 to $10 billion in 2025. Nobitex, Iran’s largest crypto exchange, serves about 15 million users. But those headline numbers hid something more significant happening underneath.
UK-based analytics firm Elliptic told Reuters it found Iran’s Central Bank acquired at least $507 million in USDT last year. They called it a “sophisticated strategy to bypass the global banking system.” Chainalysis estimated that half of Iran’s crypto volumes were linked to the Islamic Revolutionary Guard Corps. TRM Labs put the figure lower at around 5%, but still identified over 5,000 IRGC-connected wallet addresses that moved $3 billion since 2023.
A separate TRM report from January showed two UK-registered companies, Zedcex and Zedxion, funneled $619 million in stablecoins to IRGC-linked wallets in 2024 alone. That’s a 2,500% increase from the previous year.
“This is not opportunistic crypto misuse — it’s a sanctioned military organization operating exchange-branded infrastructure offshore,” TRM’s global head of policy Ari Redbord said.
What the war revealed about crypto resilience
According to TRM Labs analysis published after the strikes, Iran’s internet connectivity dropped by roughly 99% when U.S.-Israeli strikes hit on February 28. Crypto transaction volumes collapsed by 80% within days. Exchanges went into defensive mode — some suspended withdrawals entirely, others froze withdrawals in both crypto and Iran’s national currency, and several moved to twice-daily batch processing.
But the most telling move came from Iran’s Central Bank. They directed exchanges to temporarily halt trading in the USDT-toman pair overnight. The toman, a commonly used denomination of the rial, serves as the primary bridge between crypto and fiat in Iran.
With panic driving Iranians to swap rials for dollar-pegged USDT, the pair was effectively becoming a real-time gauge of currency collapse. Halting it was the Central Bank’s attempt to slow that repricing — the crypto equivalent of shutting down a foreign exchange market during a crisis.
When trading resumed, order books were thin, and prices briefly dislocated. These were signs of a market struggling to function without its most critical pair. The episode showed just how deeply USDT had embedded itself in Iran’s financial plumbing.
TRM’s overall assessment was “evidence of stress, not failure.” Iran’s crypto ecosystem shrank but did not break.
But TRM added an important caveat: ordinary Iranians lost access when the internet went dark, but state-linked actors may not have. The overall drop in volume could be masking quieter moves by regime-connected players repositioning funds through whatever infrastructure remained online. TRM said this would “likely reveal itself in time” as transaction-level data is analyzed.
Regulatory responses and the stablecoin paradox
Days after TRM published its findings, the Financial Action Task Force released a targeted report on stablecoins and unhosted wallets on March 3. The timing was notable.
The FATF report cited Chainalysis data showing stablecoins accounted for 84% of all illicit crypto transaction volume in 2025. It explicitly named Iranian actors leveraging stablecoins for proliferation financing and recommended that issuers adopt freeze, burn, and deny-listing capabilities.
With over 250 stablecoins in circulation and market capitalization exceeding $300 billion, the FATF urged countries to implement “proportionate and effective mitigating measures.” This was an acknowledgment that most jurisdictions have yet to build regulatory frameworks specifically addressing stablecoin risks.
Iran’s case exposes a fundamental tension in the stablecoin ecosystem. USDT’s dollar peg — the same feature that makes it useful for legitimate cross-border payments — also makes it the instrument of choice for sanctions evasion. Tether maintains a “zero-tolerance policy toward criminal use,” but as RUSI’s Tom Keatinge told Reuters in February: “The harder one squeezes the Iranian economy, the more one better be ready to deal with the consequences, one of which is the expanding use of crypto.”
The war didn’t create Iran’s dependence on stablecoins. It simply made it impossible to ignore. The infrastructure held up under pressure, which perhaps says something about how these systems work in crisis situations. Not perfectly, but well enough to keep functioning when traditional systems might have failed completely.
What happens next with regulation and enforcement remains to be seen. But the events of late February showed that crypto infrastructure, for better or worse, can withstand significant stress. That’s worth thinking about, I suppose.
