Share and Follow
EXCLUSIVE: A recent cyber intelligence report, accessed by Fox News Digital, reveals that cryptocurrency networks linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) remained active amidst a nationwide internet outage following the joint U.S.–Israeli attacks on February 28. This enabled the movement of hundreds of millions in cryptocurrency out of the nation.
Omri Raiter, who established and heads RAKIA—a cyber intelligence company that creates data analysis tools for governments and security organizations—shared with Fox News Digital that his team began tracking Iran’s crypto transactions in real-time post-attacks. They swiftly observed a marked increase in funds exiting crypto accounts associated with Iran.
“From the onset of the conflict, we’ve noticed a significant outflow of funds,” Raiter explained. “Initially, it was tens of millions, but it escalated into hundreds of millions and beyond. The money appeared to be rapidly exiting Iranian crypto accounts.”
According to an internal report relying on blockchain intelligence data provided by RAKIA, crypto wallets affiliated with the IRGC received over $3 billion in cryptocurrency by 2025. The report also uses publicly accessible data from blockchain analysis firm Chainalysis, which estimated that Iran’s cryptocurrency activity reached $7.78 billion in 2025.
Market instability has followed the strikes on Iran’s leadership, the IRGC, and its naval and oil infrastructure. (Sasan/Middle East Images / AFP via Getty Images)
Raiter said the data suggests Iran has developed a significant crypto-based financial infrastructure capable of operating even during heavy sanctions and communications shutdowns.
“The IRGC has been financing proxy operations through the very same crypto corridors that sanctions were designed to shut down,” Raiter said.
The U.S. Department of the Treasury sanctioned cryptocurrency exchanges tied to Iranian actors Jan. 30, marking one of the first times the U.S. targeted entire digital asset platforms rather than individual wallets for sanctions evasion linked to the Islamic Revolutionary Guard Corps.
Treasury Secretary Scott Bessent said the move was part of a broader effort to disrupt financial networks connected to Tehran, Iran.
“The Treasury will continue to pursue Iranian networks and corrupt elites who enrich themselves at the expense of the people,” Bessent said in a Treasury press release in January. “This also applies to attempts by the regime to use digital assets to circumvent sanctions.”
The recent surge appears to reflect two parallel trends: funds moving to support Iran’s regional proxy networks and money being moved by individuals connected to the regime seeking to protect their personal wealth, according to RAKIA’s analysis.
“The proxy war funding and the personal capital flight are two sides of the same coin,” Raiter said. “They move through the same pipelines.”
Tehran’s skyline, including the Azadi Tower, became the backdrop to a crisis shaped as much by cyber disruption as by missiles in the sky. (Kurt “CyberGuy” Knutsson)
Raiter said the firm identified cryptocurrency flows connected to networks previously associated with Iran-backed groups.
“Some of the accounts we saw are connected to areas where money historically flows to proxy wars,” he told Fox News Digital, citing activity linked to Lebanon and Yemen.
“Some of it could be people inside the IRGC trying to move their own money,” Raiter said. “But when you see the scale and the timing, it looks coordinated.”
The report produced by RAKIA claims the activity continued even after Iran imposed a sweeping internet shutdown across the country. National connectivity dropped to roughly 1% of normal levels during the blackout, according to internet monitoring group NetBlocks.
Military members of the Islamic Revolutionary Guard Corps in western Tehran, Iran (Morteza Nikoubazl/NurPhoto via Getty Images)
Despite that shutdown, RAKIA researchers said they detected more than 1,100 active cryptocurrency nodes operating inside Iran.
“When the internet is at one percent and you still see over a thousand active crypto nodes, you’re not looking at retail users,” Tom Malca, RAKIA’s head of cyber and AI research, said in the report. “Those nodes require dedicated bandwidth, stable power and deliberate exemption from the shutdown.”
RAKIA researchers said the activity suggests specialized infrastructure continued operating even as millions of Iranian civilians were cut off from the internet.
Most of the nodes were concentrated in the Tehran–Qom corridor, according to the report, an area that includes major government and IRGC institutions. Smaller clusters were detected in Iranian cities, including Isfahan, Mashhad, Tabriz and Kermanshah, according to the analysis.
Islamic Revolutionary Guard Corps special forces walk on the U.S. flag during a rally commemorating International Quds Day, also known as Jerusalem Day, in Tehran, Iran, March 28, 2025. (Morteza Nikoubazl/NurPhoto via Getty Images)
RAKIA said its investigation relied on a combination of network monitoring and publicly available blockchain intelligence.
The Iranian mission to the United Nations in New York declined to comment on the report’s claims.