Flows into Iranian crypto trading platforms have fallen in 2025 due to a breakdown in nuclear negotiations with Israel, a $90 million hack on Iran’s largest crypto exchange, and a major stablecoin blacklisting, says blockchain analytics firm TRM Labs.

Iranian crypto flows hit $3.7 billion between January and July, an 11% decrease compared to the same period last year, with the worst drop off coming in June and July, TRM Labs said in a report on Tuesday.

“This downturn coincided with a breakdown in nuclear negotiations, a 12-day conflict with Israel beginning June 13, and widespread power outages in Iran — driven by a combination of Israeli kinetic and cyber operations, as well as regime-initiated shutdowns.”

Iran’s crypto flows started to sharply drop in June, just after the $90 million hack on Nobitex, which handles 87% of the country’s crypto transactions. 

Many Iranians rely on US dollar stablecoins as a store of value amid skyrocketing inflation and to skirt tough sanctions on the country, which has largely cut it off from the global economy.

Nobitex hack big contributor to Iran’s crypto shake-up

Confidence in Iran-based virtual asset service providers (VASPs) deteriorated following Nobitex’s security breach, which came at the hands of pro-Israel group Predatory Sparrow on June 18 — when tensions between Iran and Israel were at their peak.

While Nobitex continues to dominate Iran crypto transaction volume, the incident disrupted liquidity, slowed transaction processing and temporarily pushed users toward alternative platforms, TRM said.

Heightened Iran-Israel tensions further amplified the outflows, which surged more than 150% in the worst week and a large percentage of that volume headed to high-risk foreign exchanges with little to no Know Your Customer checks, TRM said.

Tether’s blacklisting slowed flows

Stablecoin issuer Tether also carried out its largest-ever freeze of Iranian-linked funds, blacklisting 42 crypto addresses with Tether (USDT) balances on July 2.

The incident sparked a coordinated push from Iranian exchanges, influencers and state-backed channels for users to offload their TRON-based USDT balances — Iran’s most widely used network and token — and move funds into Dai (DAI) on Polygon.

Related: UAE reportedly holds $700M in mined Bitcoin: Arkham

Many everyday Iranians continue to turn to crypto as a hedge against inflation, TRM said, highlighting Iran’s strong reliance on stablecoins.

Iran continues to use crypto for political objectives

Iran is still relying on crypto to pay for sensitive goods from Chinese chip resellers, including hardware critical for artificial intelligence, drone components, and other electrical equipment — enabling it to effectively bypass sanctions, TRM noted.

It has also used crypto to fund espionage payments with foreign operatives, the crypto analytics firm added.

However, illicit crypto transactions in Iran still only account for less than 1% of total volume.

Magazine: Bitcoin is ‘funny internet money’ during a crisis: Tezos co-founder

]]> https://earlybirdsinvest.com/iranian-crypto-flows-fall-11-on-israel-conflict-nobitex-hack-trm-labs/feed/ 0 55297 https://earlybirdsinvest.com/u-s-warns-of-iranian-cyber-threats-on-critical-infrastructure/ https://earlybirdsinvest.com/u-s-warns-of-iranian-cyber-threats-on-critical-infrastructure/#respond Tue, 01 Jul 2025 09:27:41 +0000 https://earlybirdsinvest.com/u-s-warns-of-iranian-cyber-threats-on-critical-infrastructure/

U.S. cyber agencies, the FBI, and NSA issued an urgent warning today about potential cyberattacks from Iranian-affiliated hackers targeting U.S. critical infrastructure.

CISA says there are no indications of an ongoing campaign but urges critical infrastructure organizations and other potential targets to monitor their defense due to the current unrest in the Middle East and cyber attacks previously linked to Iran.

In a joint fact sheet, the cyber agencies warn that Defense Industrial Base (DIB) companies with ties to Israeli defense and research, are at increased risk at being targeted. Other organizations in critical infrastructure sectors, including energy, water, and healthcare, are also considered potential targets.

The advisory warns that Iranian threat actors are Iran are known to exploit unpatched vulnerabilities or utilize default passwords to gain breach systems. This was seen last year when IRGC-affiliated Iranian threat actors breached a Pennsylvania water facility in November 2023 by hacking into Unitronics programmable logic controllers (PLCs) exposed online. 

Iranian-affiliated hackers also work with or act as hacktivists, performing distributed denial-of-service (DDoS) attacks or defacing websites. These attacks are often conducted in conjunction with politically motivated messages, with the attackers promoting their activities on X and Telegram.

Iranian threat actors have also been observed utilizing ransomware or working as affiliates with Russian ransomware gangs, such as NoEscape, Ransomhouse, and ALPHV (also known as BlackCat). Many of these attacks were focused on Israeli companies, where they encrypted devices and leaked stolen data.

In some cases, the attackers used data wipers instead of ransomware to conduct destructive attacks on organizations.

Mitigating attacks

CISA, the DoD, the FBI, and the NSA are urging organizations to adopt the following best practices to protect against these threats:

• Isolate OT and ICS systems from the public internet and restrict remote access.
• Use strong, unique passwords for all online accounts and systems, changing all default account passwords.
• Enable multi-factor authentication (MFA) for critical systems and authentication platforms.
• Install all software updates, especially on internet-facing systems to fix known vulnerabilities.
• Monitor networks and servers for unusual activity.
• Develop and test incident response plans to make sure that all backups and recovery plans are working.

For more information, organizations can read CISA’s Iran Threat Overview and the FBI’s Iran Threat web pages.

An Iranian man is pleading guilty to being the mastermind behind the Robbinhood ransomware scam.

According to a recent press release by the U.S. Department of Justice (DOJ), 37-year-old Sina Gholinejad of Iran has pleaded guilty to participating in a hack of multiple cities across the US, causing widespread disruption and tens of millions of dollars in losses.

Authorities say that in January 2019, Gholinejad and his co-conspirators gained and maintained illegal access to the victims’ computers, stealing sensitive data and uploading the Robbinhood malware, which in turn would take over a victim’s PC, encrypt its files, and attempt to extort crypto assets out of them in exchange for the release of the data.

Gholinejad and his team would then attempt to launder the stolen funds through crypto mixing services and chain-hopping and hide their identities using advanced methods.

As stated by Matthew R. Galeotti, Head of the Justice Department’s Criminal Division, in the press release,

“The ransomware attack against the City of Baltimore forced the city to take hundreds of computers offline and prevented the city from performing basic functions for months.

Gholinejad’s conviction reflects the Criminal Division’s commitment to bringing cybercriminals who target our cities, healthcare system, and businesses to justice no matter where they are located. There will be no impunity for these destructive attacks.”

Other cities affected included Greenville, North Carolina, as well as Yonkers, New York, and Gresham, Oregon.

Gholinejad is scheduled to be sentenced in August and could face a maximum penalty of up to 30 years behind bars.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Featured Image: Shutterstock/ne2pi