“We have seen a tremendous increase in funding since the first hours of the war,” Raiter said. “It started with tens of millions in the first hours, and it grew to hundreds of millions and more. Money just flowed out of Iranian crypto accounts.”
Wallets linked to the IRGC received more than $3 billion worth of cryptocurrency in 2025, according to the internal report based on blockchain intelligence data cited by RAKIA. The report also cites publicly available data from blockchain analytics firm Chainalysis, which estimated that Iran’s cryptocurrency ecosystem would reach $7.78 billion in activity by 2025.
IRANIAN PROXIES WAGE WAR AGAINST ISRAEL, THREATEN US INTERESTS, WHILE STRIKES IRAQ FOR NOT DISARMING THEM
Strikes on the Iranian leadership, the IRGC and Iranian naval vessels and oil infrastructure have roiled markets. (Images Sasan / Middle East / AFP via Getty Images)
Raiter said the data suggests Iran has developed a significant cryptocurrency-based financial infrastructure that can function even during heavy sanctions and communications disruptions.
“The IRGC has funded proxy operations through the same crypto corridors that the sanctions were intended to close,” Raiter said.
The US Treasury Department sanctioned cryptocurrency exchanges linked to Iranian actors on January 30, marking one of the first times the US targeted entire digital asset platforms rather than individual wallets for evading sanctions linked to the Islamic Revolutionary Guard Corps.
Treasury Secretary Scott Bessent said the move is part of a broader effort to disrupt financial networks linked to Tehran, Iran.
“The Treasury Department will continue to pursue Iranian networks and corrupt elites who enrich themselves at the expense of the people,” Bessent said in a Treasury Department press release in January. “This includes attempts by the regime to use digital means to circumvent sanctions.”
The recent increase appears to reflect two parallel trends: money moved to support Iran’s regional proxy networks and money moved by individuals linked to the regime who want to protect their personal wealth, according to RAKIA’s analysis.
“The proxy war financing and the personal capital flight are two sides of the same coin,” Raiter said. “They move through the same pipelines.”
WAR IN IRAN, 11 DAYS IN: US CONTROLS AIR, OIL FLOWS AND REGION SUPPORTS FOR WHAT’S NEXT
Tehran’s skyline, including the Azadi Tower, became the backdrop for a crisis shaped as much by cyber disruption as by missiles in the air. (Kurt “CyberGuy” Knutsson)
Raiter said the company identified cryptocurrency flows connected to networks previously associated with Iranian-backed groups.
“Some of these could be people within the IRGC trying to move their own money,” Raiter said. “But when you see the scale and the timing, it seems coordinated.”
RAKIA’s report claims that the activity continued even after Iran imposed a sweeping internet shutdown across the country. According to internet monitoring group NetBlocks, national connectivity fell to around 1% of normal levels during the blackout.
FROM MISSILES TO MINERALS: THE STRATEGIC MEANING BEHIND THE IRAN ATTACK
Military members of the Islamic Revolutionary Guards Corps in western Tehran, Iran (Morteza Nikoubazl/NurPhoto via Getty Images)
Despite this closure, RAKIA researchers said they have detected more than 1,100 active cryptocurrency nodes operating in Iran.
“If the internet is at one percent and you still see over a thousand active crypto nodes, you’re not looking at private users,” Tom Malca, RAKIA’s head of cyber and AI research, said in the report. “These nodes require dedicated bandwidth, stable power, and purposeful relief from shutdown.”
RAKIA researchers said the activity suggests the specialized infrastructure continued to function even as millions of Iranian citizens were cut off from the internet.
Most of the nodes, according to the report, were concentrated in the Tehran-Qom corridor, an area that includes major government and IRGC institutions. According to the analysis, smaller clusters were detected in Iranian cities including Isfahan, Mashhad, Tabriz and Kermanshah.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Islamic Revolutionary Guard Corps special forces walk on the American flag during a rally commemorating International Quds Day, also known as Jerusalem Day, in Tehran, Iran, March 28, 2025. (Morteza Nikoubazl/NurPhoto via Getty Images)
RAKIA said the investigation relied on a combination of network monitoring and publicly available blockchain intelligence.
The Iranian mission to the United Nations in New York declined to comment on the report’s claims.
