80% drop, then rebound in Iran-linked Bitcoin activity during blackout

The recovery of Bitcoin transaction activity linked to Iran surpassed 75% of its initial baseline after an approximate 80% drop, according to Chainalysis's October 26 report, which detailed a decline followed by a resurgence in what the firm classifies as everyday usage, though household access remains unquantified. This rebound occurred even while the internet blackout was still active, the blockchain analytics company disclosed on Oct. 26. During the intense restrictions, some activity attributed to Iran was observed reaching the network, yet the precise number of individuals maintaining reliable access to their funds is unknown. These findings stem from Chainalysis's recently published Middle East and North Africa analysis, which spans from July 2025 up to June 2026. Independent data from Cloudflare confirms the extended disruption and its partial alleviation. The extended shutdown commenced on Feb. 28. Cloudflare documented traffic originating from Iran decreasing to less than 1% of prior levels, while Chainalysis indicated that Bitcoin transaction activity initially dropped by around 80%. Subsequently, the two datasets followed divergent trajectories. Chainalysis noted that Bitcoin activity progressively increased throughout the period of restrictions, ultimately reaching over 75% of its baseline by the conclusion of the blackout. Following the easing of restrictions in late May, activity climbed to almost double the baseline level. Cloudflare's account of the reconnection in May, released May 27, recorded the subsequent shift in the network. It noted a significant increase in DNS queries and traffic beginning around 11 a.m. UTC on May 26, which was 87 days after the second shutdown started, describing a partial restoration. At its peak on May 26, traffic only accounted for 40% of the maximum Cloudflare had registered earlier in 2026. IPv6 traffic remained virtually non-existent.

A shorter comparative period is available in January. Chainalysis stated that the first week of that blackout saw nearly 90% fewer Bitcoin transactions compared to its baseline period, followed by activity surpassing the baseline once the restrictions were lifted. Cloudflare dated the initial shutdown to Jan. 8, observing brief traffic returns on Jan. 21 and Jan. 25 before a more complete recovery started on Jan. 27. It is important to note that the percentages utilize different reference points. Cloudflare measures network traffic and DNS activity, whereas Chainalysis reports Bitcoin transaction activity against its own established baseline. Comparing these two metrics would not yield a measure of Bitcoin's relative resilience or the proportion of Iranians able to connect. A transaction count alone cannot reveal if access expanded across various households or if it became concentrated among a smaller group capable of frequent transactions. The Iran analysis does not provide specific baseline dates, counts of unique holders, or details on repeat-wallet concentration; its approximate percentage comparisons are Chainalysis's stated estimates.

Country attribution introduces another limitation. Chainalysis's 2026 methodology identifies personal wallets using behavioral indicators, which includes interaction with an exchange operating within a single nation. This method differs from its allocation of service activity based on website traffic. Transfers whose originating country cannot be confidently assigned are excluded from the general country estimates. Consequently, an Iran-linked wallet does not inherently confirm the location of its operator when a transaction entered the network. Selective connectivity can exist concurrently with a severe national internet outage. In a January 21 analysis concerning the earlier shutdown, the network monitoring firm Kentik detected residual traffic and temporary access for Iranian universities. This January data demonstrates the difference between a national suppression and a total disconnection. Chainalysis suggests that Starlink or other methods might explain this adaptation. Its account of Iran activity offers no transaction-level proof linking the recovery to a specific bypass route. For an individual holding Bitcoin, several distinct steps separate ownership from utilizing the asset during an outage. Private keys can be kept offline. Furthermore, signing a transaction can be accomplished offline. The Bitcoin Developer Guide differentiates between key distribution, signing, and networked broadcasting. While a signing device does not require a direct internet connection, the resulting transaction still necessitates a path to the network. The guide's explanation of transaction relay details how peers forward valid transactions. Receiving involves another distinction. In the guide's standard payment sequence, a sender can remit payment to an address previously provided, even if the recipient is offline at that moment. However, the recipient still requires network information to observe and confirm the payment, and any subsequent spending requires authorization and the delivery of a new transaction.

Chainalysis separately noted that cross-border stablecoin inflows initially declined by almost 50% during the conflict, subsequently surpassing their own baseline after the April 7 ceasefire, all while the second blackout persisted. This inbound-flow metric tracks a different asset and uses a different measurement than the Bitcoin transaction series. CryptoSlate's January analysis regarding Bitcoin access during Iran's blackout centered practical utility on the functionality of exchange and payment infrastructure and connectivity. The October review adds the observed pattern of collapse followed by recovery. The new evidence indicates that substantial Iran-linked Bitcoin activity occurred alongside severe restrictions as the protracted blackout continued. Liam Wright, who is a reporter, podcast producer, and Editor-in-Chief at CryptoSlate and uses the name "Akiba," believes that decentralized technology possesses the capacity to make...