Nobitex moves funds to cold wallets after regional strikes

Nobitex flows indicate internal reallocation, not a sustained bank run

Recent on-chain activity at Iran’s largest crypto exchange, Nobitex, was widely described as a bank run. Available assessments indicate internal liquidity rebalancing and short-lived stress behavior rather than a sustained run on deposits.

Observed patterns include consolidation from operational hot wallets into exchange-controlled cold storage, temporary treasury sweeps across networks, and offsetting inflows. Such steps align with standard exchange controls during periods of heightened volatility.

Why this matters for users, compliance, and Iran crypto outflows

For users, distinguishing internal wallet consolidation from customer withdrawals affects perceptions of solvency and the practical ability to access funds during stress.

For compliance teams and counterparties, correct classification influences sanctions screening, Travel Rule workflows, and AML risk scoring when flows interact with overseas virtual asset service providers.

For policymakers assessing Iran-linked crypto outflows, accurate framing reduces the risk of mislabeling routine custody sweeps as capital flight, which could distort enforcement priorities and risk models.

according to TRM Labs, a transfer exceeding USD 35 million moved from a Nobitex hot wallet to a Nobitex-controlled cold wallet shortly after the strikes, a pattern consistent with exchange liquidity management.

The same assessment described roughly USD 3 million in incremental activity that day, including a Polygon hot-to-cold reallocation, indicating that part of the spike reflected internal treasury motions rather than customer withdrawals.

Such on-chain signatures typically appear as consolidations to long-lived, exchange-labeled custody and batched movements timed around operational windows, not one-way flows to unrelated external addresses.

How analysts interpret Nobitex flows: TRM Labs, Elliptic, Chainalysis

Internal hot-to-cold transfers versus user withdrawals

As reported by FinanceFeeds, outflows from Nobitex rose by roughly 700% soon after the strikes; scale alone does not distinguish housekeeping transfers from user-driven withdrawals.

Analysts emphasize that spikes can mix internal sweeps with genuine exits, and disentangling them requires wallet clustering, destination profiling, and timing context. “This could reflect capital flight, but it isn’t conclusive,” said Dr. Tom Robinson, co-founder at Elliptic.

Net versus gross flows and attribution limits

Based on data from Chainalysis, approximately USD 10.3 million in crypto left several Iranian exchanges, including Nobitex, between February 28 and March 2, aligning with recurring post-shock patterns rather than definitive bank runs.

The report noted that destinations included “other wallets,” a category that can represent exchange-owned custody or user self-custody, underscoring attribution limits when labels are incomplete.

FAQ about Nobitex bank run

What on-chain evidence separates hot-to-cold transfers from user withdrawals?

Clustered ownership, exchange-labeled addresses, consolidation into long-lived cold wallets, batching patterns, and timing around maintenance signal internal sweeps; transfers to unrelated VASPs or self-custody typically reflect user withdrawals.

How large were the outflows and where did funds move immediately after the strikes?

Outflows reportedly surged about 700%, with net outflows near $10.3 million; funds moved to overseas exchanges and to Nobitex-controlled cold storage, indicating mixed customer withdrawals and internal reallocation.