Cryptocurrency Ties to Iran’s Revolutionary Guards Persist During Internet Blackout
A cyberintelligence report reveals that cryptocurrency operations linked to Iran’s Islamic Revolutionary Guards Corps (IRGC) continued functioning throughout the widespread internet outage following the U.S.-Israeli assaults on February 28. This persistence enabled the movement of hundreds of millions of dollars in virtual currency outside the country.
Omri Leiter, CEO of RAKIA, a cyber intelligence firm that creates analytical tools for governments and security agencies, noted that his team began tracking Iranian crypto activity in real time immediately after the attack. They quickly observed a significant increase in funds being withdrawn from crypto accounts associated with Iran.
“From the onset of the conflict, we’ve seen an increase in funding,” Leiter explained. “Initially, it was in the tens of millions, but it escalated to over hundreds of millions. The outflow from Iranian crypto accounts has continued.”
According to an internal report referenced by RAKIA, IRGC-affiliated wallets are projected to have received more than $3 billion in cryptocurrency by 2025. This aligns with estimates from blockchain analysis firm Chainalysis, which indicates that Iran’s cryptocurrency sector could hit $7.78 billion by 2025.
Despite sanctions aiming to cut off funds to the IRGC, Leiter asserted that Iran has successfully established a robust crypto financial network that remains operational, even amid strict communication restrictions.
“The Revolutionary Guards are funding their operations through these very crypto channels that sanctions were intended to restrict,” he stated.
On January 30, the U.S. Treasury Department sanctioned a cryptocurrency exchange linked to Iranian entities, marking a rare move to target an entire digital asset platform rather than just individual wallets tied to sanctions evasion concerning the IRGC.
Treasury Secretary Scott Bessent remarked that this action is part of a larger strategy to disrupt Iran’s financial networks associated with Tehran, emphasizing the commitment to pursue Iranian networks profiting at the population’s expense.
RAKIA’s analysis suggests that the uptick in cryptocurrency movement reflects two main trends: one involves funds supporting Iran’s regional proxy networks, while the other entails regime officials moving their assets to safeguard personal wealth. Leiter remarked, “Funding for proxy wars and personal capital flight are interconnected phenomena, flow through the same channels.”
Despite an extensive internet blackout, which saw connectivity drop to about 1% of normal levels, RAKIA found over 1,100 active cryptocurrency nodes operating in Iran. “With only 1% internet usage and over a thousand crypto nodes, it’s clear these activities are not for casual users,” Tom Malka, head of cyber and AI research at RAKIA, stated. “These nodes require stable bandwidth, reliable power, and deliberate resilience against shutdowns.”
Most nodes were identified in the Tehran-Qom corridor, home to key government and IRGC facilities, with additional nodes located in cities like Isfahan, Mashhad, Tabriz, and Kermanshah.
RAKIA’s findings were based on a combination of network tracking and publicly available blockchain intelligence. However, Iran’s mission to the United Nations opted not to comment on the report’s assertions.
