TL;DR: Roughly $10.3M in crypto outflows from Iranian exchanges followed the February 28, 2026 US-Israeli airstrikes in the hours after the attack, with funds splitting between self-custody, overseas exchanges, domestic services, and other wallets, making attribution difficult in the immediate aftermath, according to Chainalysis. The episode shows how geopolitical shocks, sanctions pressure, and exchange risk can rapidly reshape on-chain movement and complicate governance, monitoring, and risk classification.
At a glance
What this is: Chainalysis says Iranian exchange outflows surged after the airstrikes, but the destination mix makes it hard to distinguish retail self-custody, exchange reshuffling and state-related movement in real time.
Why it matters: For identity and access practitioners, the case shows how crisis conditions blur ownership, control and intent across wallets, exchanges and intermediaries, which raises the bar for transaction monitoring, classification and governance.
Context
Crypto flows can behave like a pressure valve during geopolitical shocks, especially where sanctions, instability and weak domestic trust push users toward faster exits or self-custody. In this article, the main governance problem is not simply volume, but attribution: once funds leave a centralized venue, control, purpose and beneficiary can become unclear very quickly.
For IAM, PAM and NHI teams, the nearest parallel is not a consumer payments story but a lifecycle and custody problem. Ownership, delegation and offboarding become harder to interpret when an address can represent a person, an exchange-controlled wallet, a nested service or a state-linked actor, which is typical in stressed environments rather than exceptional.
Key questions
Q: How should teams classify wallet movements during geopolitical shocks?
A: Teams should classify them provisionally, not definitively. Crisis-driven transfers can reflect self-custody, exchange liquidity management or sanctioned-entity behaviour, so the first pass should rely on control transfer, clustering and onward movement rather than a single destination label.
Q: Why do exchange outflows become harder to interpret during geopolitical shocks?
A: Because several actors can move at once. Retail users may pull funds into self-custody, exchanges may reshuffle liquidity or obfuscate visibility, and state-linked actors may exploit the same rails. When outages, sanctions pressure, and conflict align, the same on-chain pattern can support multiple explanations, so attribution must stay provisional.
Q: What are the signs that crypto outflow attribution is too early?
A: Attribution is too early when funds have not yet shown meaningful onward movement, when multiple services converge on the same deposit address, or when historical wallet exposure is still incomplete. In those cases, the evidence supports monitoring, not final classification.
Q: What should compliance teams do when domestic exchanges move funds into offshore services?
A: They should treat the movement as a risk signal and test whether it reflects liquidity preservation, obfuscation or sanctioned activity. The right response is to correlate transaction paths with entity history, service ownership and sanctions context before escalating.
Technical breakdown
Why crisis-driven outflows are hard to classify
On-chain transfers are visible, but intent is not. A withdrawal to a new wallet may represent a customer moving to self-custody, an exchange moving liquidity between internal wallets, or an intermediary trying to obscure exposure after a shock. Analysts therefore have to infer control from clustering, historical flows and onward movement, rather than from a single transaction. In sanctioned or politically unstable environments, the same address can sit inside multiple operational stories, which makes early attribution fragile.
Practical implication: classify high-risk flows provisionally and re-evaluate them as more wallet-level evidence accumulates.
How sanctions pressure changes wallet behaviour
Sanctions can alter the economics of on-chain infrastructure management. When access to mainstream venues is constrained, exchanges and counterparties may shift funds into newly created wallets, offshore services or other routing paths to preserve liquidity and reduce visibility. That creates a governance problem because normal monitoring assumes relatively stable account ownership and predictable service boundaries. In practice, the threat model becomes dynamic: control of funds may move faster than labels, sanctions screening and exchange intelligence can keep up.
Practical implication: treat sanctions-driven wallet movement as a governance signal, not just a transaction event.
What self-custody changes for risk ownership
Self-custody removes intermediary control, but it also removes the exchange as the obvious governance checkpoint. Once users hold assets directly, the platform loses visibility into later transfers, custody chains and beneficiary changes. That is structurally similar to NHI lifecycle problems where credentials leave a managed boundary and continue to operate elsewhere. The security challenge is therefore not just detecting movement, but understanding where responsibility for control has shifted and whether any oversight remains.
Practical implication: build monitoring that follows control transfer, not only initial withdrawal.
Threat narrative
Attacker objective: The observable objective is to move value out of visible domestic exchange rails and into harder-to-classify destinations before monitoring or sanctions enforcement can catch up.
- Entry occurred through crisis-triggered market and trust disruption after the February 28 airstrikes, which pushed funds out of Iranian exchanges and into new destinations.
- Credential or custody control then shifted into self-custody wallets, offshore exchanges, bridges and other services, making the original source harder to track.
- The resulting effect was a mixed movement pattern that could support retail flight, exchange liquidity management or state-aligned transfer activity while obscuring attribution.
NHI Mgmt Group analysis
Geopolitical shock creates a control-transfer problem, not just a transaction spike. When funds move under crisis conditions, the core governance question becomes who controls the asset after the move, not merely how much moved. That is why early labels are unstable and why monitoring programmes need a custody-aware classification model, not a static address list.
Self-custody is an ownership change, but not an accountability endpoint. Once assets leave a centralized exchange, the organisation loses the easiest control point, yet the risk does not disappear. The result is an identity-style problem in financial form: control, delegation and exposure can separate faster than the governance model can follow.
Sanctions pressure produces liquidity management behaviour that can mimic illicit activity. In stressed jurisdictions, exchanges may route funds through new wallets, offshore services or shared deposit addresses simply to preserve operational continuity. That means compliance teams need to distinguish defensive rerouting from concealment, or they will overstate or understate risk in equal measure.
Nested service and shared-wallet patterns are the critical concept here: ownership becomes ambiguous once multiple exchanges converge on the same deposit path. That ambiguity is exactly what makes attribution slow and error-prone. For practitioners, the lesson is to treat wallet clustering and service attribution as a continuous governance process, not a one-off review.
State-linked exposure cannot be inferred from destination alone. Historical upstream and downstream connections matter because a single withdrawal can sit inside a much wider sanctions-evasion or state-finance network. The practitioner takeaway is to combine transaction analysis with entity history before assigning intent.
What this signals
Nested service attribution becomes the decisive issue in crisis-driven crypto monitoring. Once multiple exchanges share a deposit path or a wallet is routed through bridges and offshore services, ownership assumptions degrade quickly. For practitioners, the useful control is continuous entity resolution, not a one-time address label.
Control transfer is the right analytical lens for this pattern. The article shows that what looks like one outflow event can actually be several governance models operating at once: self-custody, exchange liquidity management and state-aligned movement. Compliance teams need triage logic that keeps those models separate until evidence closes the gap.
For practitioners
- Map control transfer points in crypto flows Track where custody changes from exchange-held balances to self-custody, offshore services or bridges, and treat those points as governance handoffs that need separate review.
- Reclassify wallet activity after major shocks Revisit high-volume withdrawals after conflict, sanctions or internet disruption so that initial assumptions about retail flight, exchange management or state activity can be corrected.
- Use historical exposure to refine attribution Combine present-day transfer paths with historical upstream and downstream exposure to identify whether a wallet is plausibly user-controlled, service-controlled or part of a broader sanctioned network.
- Separate liquidity management from concealment hypotheses Build triage rules that distinguish routine exchange rebalancing, new wallet creation and deliberate obfuscation so compliance teams do not collapse different behaviours into one risk label.
Key takeaways
- Geopolitical escalation can trigger large crypto outflows without immediately revealing who controls the funds after the transfer.
- The hardest governance problem is attribution, because the same wallet movement can represent self-custody, exchange management or state-linked activity.
- Practitioners should focus on custody handoffs, historical exposure and onward movement before making final risk judgments.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | The article is about changing risk conditions and uncertain attribution in a sanctions-driven crypto environment. |
| ID.RA-03 — Threat and Vulnerability Assessment | The piece hinges on assessing whether flows reflect self-custody, exchange reshuffling or sanctioned activity. | |
| PR.DS-01 — Data-at-Rest Security | Self-custody and exchange-held assets change where value is controlled and protected across the lifecycle. | |
| Recommendation — Align crypto monitoring thresholds to risk appetite so crisis-driven flows are triaged consistently. Assess wallet movement against contextual threat indicators before assigning a final risk classification. Protect custody records and transactional evidence so ownership changes remain traceable during crisis periods. | ||
| MITRE ATT&CK | TA0010 — Exfiltration | The article describes value moving out of visible domestic rails into harder-to-track destinations. |
| Recommendation — Map outflow patterns to exfiltration techniques and watch for routing through bridges, offshore services and nested accounts. | ||
Key terms
- Self-Custody: Self-custody is an identity and asset model where the user, not a central provider, holds the credentials that control access. It improves control and portability, but it also means lost credentials can become unrecoverable unless backups and emergency paths are designed in advance.
- Wallet clustering: The practice of grouping wallets that likely belong to the same actor based on transaction behaviour, timing, or shared service use. It helps investigators move from isolated addresses to behavioural patterns, which is often necessary to detect fraud, laundering, or coordinated market activity.
- Nested Service: A nested service is an intermediary wallet or account structure that sits behind a visible deposit address. It can hide the real operational controller of funds, which makes attribution harder for compliance teams and can blur the line between user activity and service-level liquidity management.
- On-Chain Attribution: On-chain attribution is the process of linking blockchain activity to a likely actor, entity, or event using transaction patterns, wallet reuse, timing, and downstream movement. It is probabilistic, not absolute, and it becomes stronger when blockchain evidence is combined with off-chain intelligence and operational context.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It gives practitioners a practical basis for handling lifecycle and custody questions across modern identity programmes.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org