Iran-linked Bitcoin activity dropped by roughly 80% when the country's internet was cut off in early 2026, yet it recovered to more than three quarters of its normal level before the shutdown ended and nearly doubled once restrictions eased. For anyone allocating capital in sanctioned or capital-controlled economies, the lesson is that crypto demand does not vanish under a blackout. It is postponed, and then it comes back harder.
The numbers come from a Chainalysis report published on 26 October, which tracked a series it uses as a proxy for everyday Bitcoin use. The shutdown began on 28 February and lasted until late May. Over that stretch the series fell steeply at first, clawed its way back past 75% of baseline while the lockdown was still in force, and then roughly doubled after access was partially restored in the final week of May.
Cloudflare's traffic measurements give the other half of the picture. Traffic originating in Iran sank to well under 1% of earlier levels, a near-total cut. A partial restoration began around 11:00 UTC on 26 May and reached about 40% of the 2026 peak. IPv6 traffic stayed effectively at zero, which hints that the reopening was selective rather than a clean return to normal.
An earlier outage in January followed the same arc. Chainalysis counted nearly 90% fewer Bitcoin transactions in that blackout's first week, and then activity rose above baseline when the restrictions lifted. Two shutdowns, one pattern: a sharp collapse, a scramble for workarounds, and a rebound once the pipe reopens.
Cross-border stablecoin inflows into Iran fell by nearly half during the military conflict, then rose above their normal level after the ceasefire on 7 April. Households and businesses that rely on dollar-denominated tokens as a store of value appear to have returned to them quickly once routes reopened.
A transaction count tells you how many payments settled, not how many people could reach their money.
The two data sets are not directly comparable. Cloudflare and Chainalysis measure different things against different baselines, so their percentages cannot be stacked into a single index of disruption. Transaction volume also says nothing about distribution. A recovery could reflect a broad base of households regaining access, or a smaller group of well-connected users moving more value than before.
Attribution is a further limit. Chainalysis assigns activity to Iran using behavioural indicators, so an Iran-linked wallet is not proof that its operator was physically inside the country. Some of the rebound may belong to users who are abroad, or to flows that were simply rerouted.
The report floats satellite connections such as Starlink and other bypass methods as possible explanations for the partial recovery, but it offers no transaction-level proof of any particular route. The technical reason crypto can bend rather than break is worth understanding. Keys can be stored and transactions signed entirely offline. Only the broadcast step needs a network path, and a recipient does not have to be online at the moment a payment arrives. They need connectivity later, to verify the funds and to spend them.
The Iranian case is an extreme stress test, but the mechanics apply wherever governments can throttle connectivity. Offline-capable self-custody turns out to be a practical resilience feature, not a niche preference. Stablecoin corridors rebound fastest when political risk eases, which makes them a useful real-time gauge of sentiment in markets where official data is slow or unreliable.
Researchers should resist reading the rebound as pure strength, though. A spike above baseline after a shutdown can be pent-up demand being cleared, not a new structural trend. The signal worth tracking over the coming quarters is whether activity settles back to a steady level or keeps growing once the backlog is gone.
Keywords: Iran, Bitcoin, internet shutdown, Chainalysis, Cloudflare, stablecoins, emerging markets, capital controls
Source: CryptoSlate