Loading story…
Reporting on Iran’s domestic instability and state pressure indicates cryptocurrency usage has expanded sharply as both a financial outlet for citizens and a funding channel for regime-linked actors. Chainalysis assessed Iran’s crypto ecosystem at ~$7.78B in 2025, with activity correlating to political events and conflict; it also reported that IRGC-linked on-chain activity represented ~50% of Iran’s total crypto activity in Q4 2025 and has been increasing over time. The same analysis noted that during recent mass protests, Iranians increased Bitcoin withdrawals to personal wallets, consistent with capital flight behavior amid currency collapse and political instability.
Separately, AlphaHunt reported telemetry consistent with an intentional national internet shutdown in Iran on 2026-01-08 (traffic falling to near-zero), alongside indicators such as a ~98.5% drop in IPv6 routing announcements observed by Cloudflare earlier that day. Based on prior patterns of Iran-linked operations (e.g., APT42), the post-blackout period is assessed as higher risk for rapid phishing, credential theft, and account takeovers targeting officials, journalists, and dissidents—driven more by “regime security” requirements (identification, monitoring, intimidation) than by novel technical exploitation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
The AlphaHunt post also cites Google reporting that Iranian government-backed actors used Gemini to assist with reconnaissance, translation and localization, and phishing-content creation.
The AlphaHunt post cites prior public reporting that APT42 used WhatsApp-focused social engineering, impersonating tech support brands to target officials and public figures. This is presented as part of Iran-linked operators' established credential-theft playbook.
The disruption continued from January 8 through January 13, 2026, with only brief periods of restored connectivity, indicating sustained state control over communications.
On January 8, 2026, Iran's national internet traffic reportedly dropped to effectively zero around 18:45 UTC, marking the start of a near-total shutdown during mass protests.
In the period immediately preceding the January 2026 blackout, Iranians reportedly moved more Bitcoin from exchanges to personal wallets, behavior Chainalysis interprets as a flight to safety amid unrest and economic pressure.
Chainalysis reports that inflows to publicly designated IRGC-linked wallets increased to more than $3 billion in 2025, up from over $2 billion in 2024.
According to Chainalysis, IRGC-linked activity represented more than 50% of Iran's total crypto values received in Q4 2025, showing the group's dominant on-chain position.
Chainalysis says Iran's cryptocurrency ecosystem exceeded $7.78 billion in 2025 and grew faster than the previous year, underscoring the sector's expanding role in the country's economy.
The same June 2025 period also saw a breach of Iranian state television, adding to evidence that cyber operations intensified alongside the conflict.
During the June 2025 conflict period, cyberattacks targeted Iranian crypto exchange Nobitex and Bank Sepah, reflecting a broader escalation in cyber activity tied to geopolitical tensions.
Chainalysis reports that inflows to publicly designated IRGC-linked wallets in Iran totaled more than $2 billion in 2024, establishing a baseline for the group's growing role in the country's crypto ecosystem.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Following coordinated **US-Israeli airstrikes** on Iran, reporting described a rapid escalation in state information controls, including a near-total **internet blackout** that cut the country off from external communications. Journalists and civil society actors were described as disproportionately impacted, facing a choice between attempting to circumvent restrictions—at personal risk—or losing the ability to report and document events; the blackout was framed as consistent with Iran’s prior crisis playbook of throttling or severing connectivity during unrest and security crackdowns. On-chain analysis also reported a sharp spike in **cryptoasset outflows from major Iranian exchanges** in the immediate aftermath of the strikes, totaling roughly **$10.3M** over a multi-day window. The activity was assessed as consistent with prior patterns in which Iranian crypto movements surge around geopolitical shocks and domestic instability, with potential drivers including citizen self-custody withdrawals, exchange infrastructure changes, or state-linked activity; attribution was described as premature pending follow-on tracing of onward fund flows.
Jun 29, 2026
Iran remained under a **near-total government-imposed internet blackout** for more than 10 days, with Cloudflare Radar showing HTTP traffic falling by roughly **98%** from pre-shutdown levels to below **1% of normal** beginning around 07:00 UTC on February 28. Reporting indicates the disruption affected all major regions and the country’s largest networks simultaneously, including **MCCI (`AS197207`)**, **IranCell (`AS44244`)**, and **TCI (`AS58224`)**, supporting assessments that the outage was a centrally coordinated national shutdown rather than a cyberattack or physical infrastructure failure. At the same time, Iranian state and IRGC-linked messaging signaled an escalation of the wider conflict toward **economic targets**, warning that banks and commercial infrastructure tied to the U.S. and Israel could be considered legitimate targets after an alleged strike on a bank in Tehran. Iranian outlets reportedly named major technology firms including **Nvidia, Microsoft, Google, Oracle, IBM, and Palantir** in connection with facilities in Israel and the broader Middle East, while warning civilians to avoid areas near banks. Together, the reporting points to a broader campaign in which Iran is both restricting domestic connectivity and publicly threatening regional economic and technology infrastructure as the conflict expands.
Jun 29, 2026
Iran experienced a **near-total nationwide internet blackout**, with independent monitoring indicating national connectivity fell to roughly **4% of normal levels** amid **US and Israeli strikes**. **NetBlocks** reported the sharp drop in connectivity, and **Cloudflare** telemetry similarly showed Iran’s internet traffic falling to effectively **zero**, consistent with a broad disconnection from the global internet. Reporting characterized the disruption as resembling prior wartime connectivity restrictions and suggested it may reflect deliberate state measures to control information flows and reduce exposure to external cyber activity during a crisis. Separate reporting tied the blackout to a **large-scale cyberattack** occurring in parallel with kinetic operations (described as part of Operation *“Roar of the Lion”*), alleging impacts to **critical infrastructure**, official news sites, and security communications. In contrast, analysis of Iran’s earlier 2026 communications shutdown described a **government-led, multi-layer takedown** that went beyond typical censorship—disrupting not only international connectivity but also domestic services (including the National Information Network), with broad outages across mobile networks, SMS, landlines, and reported blocking of **Starlink**—highlighting Iran’s evolving “two-tier” network design and its use for internal control during unrest.
Jun 29, 2026