Iran’s crypto rails held together through the U.S.–Israeli airstrikes on February 28, 2026, even as the country endured a near-total internet blackout and a sharp collapse in on-chain activity, according to post-strike analyses. The episode spotlighted how dollar-pegged stablecoins—especially USDT—had become a practical lifeline for fiat substitution and cross-border value movement when traditional channels failed.
The resilience mattered because it suggested more than hobbyist usage under stress. Analysts described active, state-linked reliance on stablecoins to keep liquidity moving and reposition capital during disruption, which in turn renewed calls from global watchdogs for stronger issuer-level control mechanisms.
What happened during the blackout
On the day of the strikes, Iran saw an estimated 99% drop in internet connectivity alongside an 80% collapse in crypto transaction volumes, creating a sudden contraction that forced exchanges into defensive operations. Platforms reportedly shifted to suspended or frozen withdrawals and even twice-daily batch processing, while the Central Bank of Iran ordered venues to halt trading in the USDT–toman pair overnight as an attempt to prevent real-time repricing pressure on the national currency.
TRM Labs described the system as strained but not broken. “Operational disruption did not equal systemic failure,” was the basic takeaway, even though the blackout meant ordinary users were effectively locked out while some well-positioned actors likely retained pathways to move funds. Ari Redbord, TRM’s global head of policy, framed it as “a sanctioned military organization operating exchange-branded infrastructure offshore,” arguing this was not a case of random opportunism. When activity resumed, thin order books and brief price dislocations were reported as part of the immediate normalization process.
What the forensics suggest about stablecoin flows
Post-strike tracing and earlier forensic work outlined a consistent pattern of stablecoin usage tied to sanctioned entities and state actors. Elliptic reported that Iran’s Central Bank purchased at least $507 million in USDT during 2025, while TRM Labs identified more than 5,000 wallet addresses linked to the IRGC that have moved roughly $3 billion since 2023. TRM also reported that two UK-registered firms routed about $619 million in stablecoins to IRGC-linked wallets in 2024, reinforcing the view that intermediaries outside Iran can be part of the same value pipeline.
Those claims fed directly into a Financial Action Task Force report dated March 3, 2026, which cited Chainalysis data stating that stablecoins represented 84% of illicit crypto transaction volume in 2025 and explicitly named Iranian actors as leveraging stablecoins for proliferation financing. FATF’s recommended response was not abstract: it urged issuers to support operational controls such as freezing, burning, and deny-listing to limit misuse where legal regimes permit.
Observers framed the situation as a structural paradox that policymakers can’t ignore. The same dollar peg that makes USDT useful for legitimate commerce can also make it effective for sanctions circumvention, and pressure on a national economy can accelerate adoption of crypto as an escape valve. RUSI analyst Tom Keatinge captured that dynamic by warning that “the harder one squeezes the Iranian economy, the more one better be ready to deal with the consequences,” with expanding crypto use among them.
Expect stronger demands for on-chain supervision, issuer-level tooling to contain tainted liquidity, and deeper forensic audits of intermediaries that touch high-risk flows. For custodians and service providers, the immediate discipline is clear: tighten counterparty controls, preserve audit-grade tracing capability, and be ready to implement freeze or deny-list workflows when legal authority and platform rules allow.
