Iran-linked Bitcoin activity fell 80% during internet blackout

Bitcoin transaction activity linked to Iran fell about 80% after the country’s prolonged internet shutdown began on Feb. 28, 2026, then recovered to more than 75% of its baseline before the blackout ended, according to Chainalysis.

The recovery occurred while severe internet restrictions remained in place. Activity gradually increased during the shutdown and reached nearly twice its baseline after restrictions began easing in late May.

The findings were included in Chainalysis’ Middle East and North Africa analysis for July 2025 through June 2026. The company’s figures compare Bitcoin activity with its own baseline. They do not show how many people in Iran had reliable access to their funds.

Cloudflare recorded a parallel disruption in Iranian internet traffic. Traffic fell to less than 1% of previous levels after the shutdown began. Around 11 a.m. UTC on May 26, 87 days after the shutdown started, traffic and DNS queries began to increase, indicating a partial restoration.

Traffic reached about 40% of Cloudflare’s highest level recorded earlier in 2026 during the May 26 peak. IPv6 traffic remained close to zero. The available data does not establish that internet access had fully returned nationwide.

Iran’s January blackout produced a shorter version of the pattern. Chainalysis found that Bitcoin transactions fell by almost 90% during the first week compared with its baseline. Activity later exceeded the baseline after restrictions were lifted. Cloudflare recorded the first shutdown on Jan. 8, temporary traffic recoveries on Jan. 21 and Jan. 25, and a broader recovery beginning Jan. 27.

The Cloudflare and Chainalysis percentages cannot be directly compared. Cloudflare measures traffic and DNS activity across its network, while Chainalysis measures Bitcoin transactions in a selected series. The figures do not show Bitcoin’s share of internet activity or the proportion of Iranian residents who could connect.

Transaction data cannot establish whether access expanded to more households or became concentrated among a smaller group that transacted repeatedly. Chainalysis did not provide exact baseline dates, unique wallet-holder figures or data on repeat transactions in its Iran analysis.

Chainalysis identifies some personal wallets through behavioral indicators, including interactions with an exchange serving one country. An Iran-linked wallet does not prove that its operator was physically in Iran when a transaction reached the Bitcoin network.

The data do not identify how users bypassed the restrictions. Chainalysis cited Starlink and other possible connectivity methods. Network monitoring during the January shutdown also found residual access and temporary connectivity at some Iranian universities.

Holding Bitcoin and using it during an internet shutdown involve separate steps. A private key can remain offline, and a transaction can be signed without an internet connection. The signed transaction still needs a route to the Bitcoin network, where other computers relay it.

A sender can pay an address without the recipient being online at that moment. The recipient later needs network access to confirm the payment, and spending the funds requires creating and broadcasting another transaction.

Chainalysis separately reported that cross-border stablecoin inflows to Iran initially fell by nearly 50% during the conflict. The inflows later exceeded their baseline after the April 7 ceasefire, while the second internet shutdown was continuing. Those figures cover a different asset and activity from the Bitcoin transaction data.