CoinEx and Iran: Analysts Uncover $3.8 Billion Money Laundering Scheme Through Crypto Exchange
Analytical company TRM Labs has released a report revealing large-scale financial flows between the cryptocurrency exchange CoinEx and sanctioned Iranian entities. Over seven years, from 2018 to 2025, the transaction volume exceeded $3.84 billion. The scheme involved more than 60 Iranian platforms, indicating a coordinated nature of operations rather than spontaneous market demand.
Key Players and Volumes
The bulk of the volume — $2.7 billion — comes from CoinEx's interaction with Nobitex, Iran's largest local cryptocurrency exchange. At the peak of activity in 2024, CoinEx became Nobitex's main external counterparty, outpacing its nearest competitor by nearly nine times. On average, the daily transfer volume between these platforms was about $1 million.
Notably, the share of illegal transactions on CoinEx reaches almost 8% — 26 times higher than the average market threshold of 0.3% typical for exchanges that comply with regulatory requirements. CoinEx-associated mining pool ViaBTC added another $154 million in mining payouts directed to Nobitex addresses. After the cyberattack by the Predatory Sparrow group in 2025, ViaBTC provided emergency liquidity to Nobitex, confirming the systemic nature of their relationship.
Links to Sanctioned Entities
The TRM Labs report also revealed direct on-chain links between CoinEx and organizations under U.S. sanctions. These include the Islamic Revolutionary Guard Corps ($6 million), Palestinian Islamic Jihad ($374,000), and Hezbollah. After OFAC sanctions were imposed on June 2, 2026, against Ramzinex, BitPin, Wallex, and Nobitex, volumes between CoinEx and Iranian exchanges sharply dropped below $150,000, indirectly confirming the dependence of flows on sanctions pressure.
Scheme Involving the Central Bank of Iran
The most sophisticated part of the scheme involves the Central Bank of Iran. Analysts determined that about $67 million was transferred to CoinEx addresses as part of a structured money laundering operation that ran from June 2025 to June 2026. The Central Bank managed the process through the National Iranian Exchange (NIE) under a scheme internally named "National Tether."
The mechanism worked on a single template: NIE wallets received large USDT deposits on the TRON network — often amounts exceeding $5 million. The funds were then split, passed through cross-chain bridges to Ethereum, entered Gnosis Safe multi-signature contracts, and were converted into Aave protocol tokens to complicate freezing. After repeated splitting and transfers through bridges, the assets were consolidated and directed for withdrawal through centralized exchanges, ultimately ending up on CoinEx.
The scale, duration, and structured nature of CoinEx's ties with Iran's sanctioned crypto ecosystem indicate coordination rather than coincidence. Without access to this exchange's liquidity and infrastructure, Iranian platforms and regime-linked entities would lose one of their main channels to global cryptocurrency markets.
My analysis: This report is not just statistics but a demonstration of how centralized exchanges can become key nodes in circumventing international sanctions. CoinEx, whether knowingly or through oversight, has become a critical bridge for the Iranian economy. For the market, this is a signal: regulators will tighten control over KYC/AML, and exchanges that ignore compliance face not only fines but also the complete loss of licenses.