Iran Bitcoin Activity Rebounds to 75% of Baseline Despite Internet Blackout, Chainalysis Reports
Bitcoin transaction activity linked to Iran recovered to more than 75% of its baseline by the end of the country's prolonged internet blackout from February to May 2026, despite an initial decline of approximately 80%, according to blockchain analytics firm Chainalysis. The findings, published on October 26, indicate that substantial Iran-attributed Bitcoin activity continued as nationwide internet restrictions remained in place.
The recovery occurred during a shutdown that severely disrupted internet connectivity across Iran. However, the available data does not establish how many people retained reliable access to their cryptocurrency holdings or whether the rebound reflected broader participation or activity concentrated among a smaller group of users.
The findings appear in Chainalysis's latest Middle East and North Africa analysis, which covers July 2025 through June 2026. Separate network measurements from Cloudflare document the scale of the internet disruption and the partial restoration of connectivity in late May.
Iran Bitcoin Activity Recovered During the Internet Shutdown
The prolonged blackout began on February 28, 2026. Cloudflare observed Iranian internet traffic fall to well below 1% of its previous levels, while Chainalysis measured an initial decline of around 80% in Bitcoin transaction activity.
Bitcoin activity subsequently increased even as restrictions continued. Chainalysis reported that transactions had recovered to more than 75% of baseline levels by the end of the blackout. After restrictions began easing in late May, activity climbed to nearly twice its baseline.
Cloudflare's May 27 report documented a partial restoration of internet connectivity. Traffic and DNS queries began rising noticeably at around 11 a.m. UTC on May 26, approximately 87 days after the second shutdown began.
Despite the increase, connectivity remained substantially below earlier levels. Traffic at its May 26 peak reached only 40% of the maximum Cloudflare had observed earlier in 2026, while IPv6 traffic remained effectively at zero.
January Blackout Provides a Comparison
Iran's January internet shutdown showed a similar disruption in cryptocurrency activity. Chainalysis reported nearly 90% fewer Bitcoin transactions during the first week of that blackout compared with its baseline period. Activity subsequently rose above baseline after restrictions were lifted.
Cloudflare identified January 8 as the beginning of the first shutdown. Brief returns of internet traffic occurred on January 21 and January 25, before a more complete recovery began on January 27.
The measurements from the two companies describe different aspects of the disruption. Cloudflare tracks traffic across its network and DNS activity, while Chainalysis measures Bitcoin transactions against its own baseline. Comparing the percentages directly would not establish Bitcoin's relative resilience or show what proportion of Iran's population could access the network.
Transaction Data Does Not Reveal How Many People Had Access
The increase in transaction activity does not necessarily mean that access to Bitcoin became more widespread during the blackout. Transaction counts alone cannot determine whether more households regained access or whether a smaller number of users conducted repeated transactions.
Chainalysis's Iran analysis does not provide exact baseline dates, unique-holder counts or measurements of repeat-wallet concentration. The reported percentages are approximate estimates, and the available figures do not identify how many individuals could reliably access or spend their funds.
Country attribution also presents limitations. Chainalysis's 2026 methodology uses behavioral indicators to associate personal wallets with countries, including interactions with exchanges serving a single country. This differs from its approach to assigning service activity based on website traffic. Transactions whose country of origin cannot be confidently established are excluded from its general country estimates.
Consequently, an Iran-linked wallet does not necessarily establish that its operator was physically in Iran when a transaction reached the Bitcoin network.
Bitcoin Ownership Does Not Guarantee Transaction Access
Using Bitcoin during an internet shutdown involves several distinct steps, including holding private keys, signing transactions and broadcasting them to the network. These functions do not all require the same level of connectivity.
The Bitcoin Developer Guide explains that private keys can be stored offline and transactions can be signed without a device connecting directly to the internet. However, a signed transaction still needs a way to reach the network before it can be relayed to other participants.
Receiving Bitcoin also differs from spending it. A sender can transfer funds to an address provided earlier without the recipient being online at that moment. The recipient still needs access to network information to observe and verify the payment, while a subsequent transaction requires authorization and a means of delivering the new transaction to the network.
In a January 21 analysis of the earlier shutdown, network monitoring company Kentik observed residual internet traffic and temporary connectivity for Iranian universities. That finding illustrates how some access can persist even when a country's broader internet connectivity is severely restricted.
Chainalysis identified Starlink or other connectivity methods as possible explanations for users adapting to the restrictions. However, its reported Bitcoin activity data does not link the recovery to any specific circumvention technology or connection method.
Stablecoin Flows Followed a Different Pattern
Chainalysis also reported changes in cross-border stablecoin flows during the conflict. Inbound stablecoin flows initially declined by nearly 50%, then rose above their own baseline after the April 7 ceasefire, even as the second internet blackout continued.
That measure covers stablecoins and cross-border inflows, rather than Bitcoin transaction counts. The two indicators therefore describe different forms of cryptocurrency activity and should not be treated as interchangeable measures of access.
CryptoSlate's January analysis of Bitcoin access during Iran's blackout also emphasized the importance of connectivity and functioning exchange and payment infrastructure. Chainalysis's October findings add a longer view of how Bitcoin transaction activity fell sharply before recovering during the extended shutdown.
Overall, the data show that substantial Iran-linked Bitcoin activity persisted and recovered during severe internet restrictions. They do not establish how many people could access their funds, how transactions reached the network or which connectivity methods enabled the observed activity.
Writer: Ethan Collins
Crypto Journalist
Ethan Collins reports on developments across the cryptocurrency and blockchain sector. His work covers market movements, protocol updates, regulatory changes, and emerging trends in digital assets.
He focuses on presenting complex topics in a clear and accessible manner for a broad readership.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.