EXCLUSIVE: A recent cyber intelligence report reviewed by Fox News Digital indicates that cryptocurrency systems linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) remained active during the country-wide internet blackout following the U.S.-Israeli strikes on February 28. This allowed the transfer of hundreds of millions of dollars in cryptocurrency out of Iran.
Omri Raiter, the founder and CEO of RAKIA, a cyber intelligence firm specializing in data analysis for government and security agencies, revealed that his team began closely monitoring Iranian cryptocurrency movements in real-time after the conflict began. They quickly noticed a significant outflow of funds from accounts connected to Iran.
“Since the onset of the conflict, we’ve observed a rapid increase in fund transfers,” Raiter stated. “Initially, tens of millions were moved within the first hours, eventually escalating to hundreds of millions. The money was consistently exiting Iranian crypto accounts.”
According to an internal report utilizing blockchain intelligence data and cited by RAKIA, wallets associated with the IRGC received over $3 billion in cryptocurrency in 2025. The report further references public data from the blockchain analysis firm Chainalysis, which estimated that Iran’s cryptocurrency transactions reached $7.78 billion that year.
Market turmoil has been triggered by recent strikes targeting Iranian leadership, the IRGC, and critical naval and oil infrastructure. (Image credit: Sasan/Middle East Images / AFP via Getty Images)
Raiter emphasized that the findings indicate Iran has established a robust, crypto-based financial network that continues to function despite severe sanctions and communication disruptions.
“The IRGC has been financing proxy operations through the very same crypto corridors that sanctions were designed to shut down,” Raiter said.
The U.S. Department of the Treasury sanctioned cryptocurrency exchanges tied to Iranian actors Jan. 30, marking one of the first times the U.S. targeted entire digital asset platforms rather than individual wallets for sanctions evasion linked to the Islamic Revolutionary Guard Corps.
Treasury Secretary Scott Bessent said the move was part of a broader effort to disrupt financial networks connected to Tehran, Iran.
“The Treasury will continue to pursue Iranian networks and corrupt elites who enrich themselves at the expense of the people,” Bessent said in a Treasury press release in January. “This also applies to attempts by the regime to use digital assets to circumvent sanctions.”
The recent surge appears to reflect two parallel trends: funds moving to support Iran’s regional proxy networks and money being moved by individuals connected to the regime seeking to protect their personal wealth, according to RAKIA’s analysis.
“The proxy war funding and the personal capital flight are two sides of the same coin,” Raiter said. “They move through the same pipelines.”
Tehran’s skyline, including the Azadi Tower, became the backdrop to a crisis shaped as much by cyber disruption as by missiles in the sky. (Kurt “CyberGuy” Knutsson)
Raiter said the firm identified cryptocurrency flows connected to networks previously associated with Iran-backed groups.
“Some of the accounts we saw are connected to areas where money historically flows to proxy wars,” he told Fox News Digital, citing activity linked to Lebanon and Yemen.
“Some of it could be people inside the IRGC trying to move their own money,” Raiter said. “But when you see the scale and the timing, it looks coordinated.”
The report produced by RAKIA claims the activity continued even after Iran imposed a sweeping internet shutdown across the country. National connectivity dropped to roughly 1% of normal levels during the blackout, according to internet monitoring group NetBlocks.
Military members of the Islamic Revolutionary Guard Corps in western Tehran, Iran (Morteza Nikoubazl/NurPhoto via Getty Images)
Despite that shutdown, RAKIA researchers said they detected more than 1,100 active cryptocurrency nodes operating inside Iran.
“When the internet is at one percent and you still see over a thousand active crypto nodes, you’re not looking at retail users,” Tom Malca, RAKIA’s head of cyber and AI research, said in the report. “Those nodes require dedicated bandwidth, stable power and deliberate exemption from the shutdown.”
RAKIA researchers said the activity suggests specialized infrastructure continued operating even as millions of Iranian civilians were cut off from the internet.
Most of the nodes were concentrated in the Tehran–Qom corridor, according to the report, an area that includes major government and IRGC institutions. Smaller clusters were detected in Iranian cities, including Isfahan, Mashhad, Tabriz and Kermanshah, according to the analysis.
Islamic Revolutionary Guard Corps special forces walk on the U.S. flag during a rally commemorating International Quds Day, also known as Jerusalem Day, in Tehran, Iran, March 28, 2025. (Morteza Nikoubazl/NurPhoto via Getty Images)
RAKIA said its investigation relied on a combination of network monitoring and publicly available blockchain intelligence.
The Iranian mission to the United Nations in New York declined to comment on the report’s claims.
