Iran-linked Bitcoin activity fell about 80%, then rebounded during the blackout

By the end of Iran's prolonged February-to-May 2026 internet shutdown, Bitcoin transaction activity in Chainalysis's selected everyday-use series had recovered to over 75% of its baseline after an initial fall of around 80%, the blockchain analytics company reported Oct. 26.

The rebound developed while the blackout was still in place. Some Iran-attributed activity was reaching the network during severe restrictions, while the number of people with dependable access to their funds remains unmeasured.

The findings come from Chainalysis's new Middle East and North Africa analysis, covering July 2025 through June 2026. Independent traffic observations from Cloudflare document the prolonged disruption and its partial easing.

A recovery inside the shutdown

The longer shutdown began Feb. 28. Cloudflare observed traffic from Iran fall to well under 1% of previous levels, while Chainalysis reports that Bitcoin transaction activity initially fell around 80%.

The two series then followed different courses. Chainalysis says Bitcoin activity gradually climbed during the restriction period, reaching over 75% of its baseline by the blackout's end. After restrictions began easing in late May, activity rose to nearly twice baseline.

Cloudflare's account of the May reconnection, published May 27, records the subsequent network change. It observed a marked rise in traffic and DNS queries beginning around 11 a.m. UTC on May 26, 87 days after the second shutdown began, and described a partial restoration.

At its May 26 peak, traffic reached only 40% of the maximum Cloudflare had observed earlier in 2026. IPv6 traffic remained effectively zero.

January provides a shorter comparison. Chainalysis reports nearly 90% fewer Bitcoin transactions in the first week of that blackout than in its baseline period, followed by activity exceeding baseline when restrictions lifted. Cloudflare dates the first shutdown to Jan. 8, with brief traffic returns on Jan. 21 and Jan. 25 before fuller recovery began Jan. 27.

The percentages have different denominators. Cloudflare measures traffic across its network and DNS activity; Chainalysis reports Bitcoin transaction activity against its own baseline. Dividing them would not produce a measure of Bitcoin's relative resilience or the share of Iranians who could connect.

A transaction count cannot reveal whether access broadened across households or became concentrated among a smaller group that could transact repeatedly. The Iran analysis does not specify exact baseline dates, unique-holder counts or repeat-wallet concentration. Its approximate percentage comparisons remain Chainalysis's reported estimates.

Country attribution adds a further limit. Chainalysis's 2026 methodology locates personal wallets through behavioral indicators, including interaction with an exchange serving a single country. That differs from its allocation of service activity using website traffic. Transfers whose country provenance cannot be confidently assigned are excluded from its general country estimates.

An Iran-linked wallet therefore does not directly establish where its operator was when a transaction reached the network.

Selective connectivity can coexist with a severe national blackout. In a Jan. 21 analysis of the earlier shutdown, network monitoring company Kentik observed residual traffic and temporary access for Iranian universities. That January evidence illustrates the distinction between national suppression and complete disconnection.

Chainalysis suggests Starlink or other means as possible explanations for adaptation. Its Iran activity account supplies no transaction-level evidence tying recovery to a particular bypass route.

From keeping keys to using funds

For a holder, several separate steps sit between possessing Bitcoin and using it during a shutdown.

Private keys can remain stored offline. Signing a transaction can also happen offline. The Bitcoin Developer Guide separates key distribution, signing and networked broadcasting. A signing device need not connect directly to the internet, but the resulting transaction still needs a path to the network.

The guide's description of transaction relay explains how peers pass valid transactions onward.

Receiving presents another distinction. In the guide's ordinary payment sequence, a sender can pay an address supplied earlier without the recipient being online at that moment. The recipient still needs network information to observe and verify the payment, and a subsequent spend requires authorization and delivery of a new transaction.

Chainalysis separately reports that cross-border stablecoin inflows initially fell nearly 50% during the conflict, then surpassed their own baseline after the April 7 ceasefire while the second blackout continued. That inbound-flow measure covers a different asset and metric from the Bitcoin transaction series.

CryptoSlate's January analysis of Bitcoin access during Iran's blackout framed practical usefulness around connectivity and functioning exchange and payment infrastructure. The October retrospective adds the observed collapse-and-recovery pattern.

The new evidence shows that severe restrictions coexisted with substantial Iran-linked Bitcoin activity as the prolonged blackout wore on.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.