Brief: Cryptocurrency Tied to Iran’s IRGC Still Active Post-Internet Shutdown
Following airstrikes by the U.S. and Israel on February 28, a report reveals that cryptocurrency operations linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) remained active during a nationwide internet blackout. This allowed millions of dollars in cryptocurrency to be transferred out of Iran.
Omri Raiter, CEO of cyber intelligence firm RAKIA, stated that his team began tracking Iranian cryptocurrency activities in real time after the attacks. They noticed a significant increase in funds leaving Iranian accounts. “We saw tens of millions in the early hours, which quickly escalated to hundreds of millions,” Raiter explained, highlighting the swift movement of money from these accounts.
RAKIA’s report indicates that wallets connected to the IRGC received over $3 billion in cryptocurrencies in 2025. The company also cited data showing that Iran’s crypto activities hit $7.78 billion that same year.
Raiter emphasized that Iran appears to have established a robust crypto financial network that can function despite heavy sanctions and communication disruptions. He noted, “The IRGC uses the same crypto channels that sanctions aim to block for funding their operations.”
In response to this ongoing situation, the U.S. Department of the Treasury sanctioned several cryptocurrency exchanges associated with Iranian actors on January 30, marking a significant shift in U.S. strategy.
RAKIA’s analysis suggests that funds are being funneled into Iran’s proxy networks while individuals linked to the regime transfer personal wealth abroad. “This proxy funding and capital flight are intricately connected,” Raiter said.
Despite the government’s internet blackout, which limited connectivity to around 1%, RAKIA found more than 1,100 crypto nodes still active within Iran. Tom Malca, RAKIA’s head of cyber and AI research, mentioned that the continued operation of these nodes indicates a focused effort to maintain this infrastructure during widespread internet outages.
Most of the nodes were discovered in the Tehran–Qom area, home to major governmental and IRGC institutions. RAKIA conducted its research by monitoring networks and analyzing publicly accessible blockchain data.
The Iranian mission to the United Nations in New York has not commented on the report’s findings.
