CoinEx as a Gateway for Iran: TRM Labs Reveals a $3.8 Billion Money Laundering Scheme
Analytical platform TRM Labs conducted a large-scale investigation and found that the cryptocurrency exchange CoinEx has become a key node for transactions between sanctioned Iranian entities and the global market. The total volume of identified flows over seven years exceeded $3.84 billion. The scheme involves more than 60 Iranian platforms, indicating a systematic and coordinated nature of the activity, rather than spontaneous use of the exchange.
The central focus of the investigation was the link between CoinEx and the largest Iranian cryptocurrency exchange, Nobitex. They accounted for $2.7 billion of the total volume — an average of about $1 million per day starting from 2018. By 2024, CoinEx had become the dominant external counterparty for Nobitex, surpassing its nearest competitor by nearly nine times.
Each major Iranian exchange directs between 5% and 10% of its volume through CoinEx. In my assessment, this indicates the existence of coordinated agreements rather than market-driven choices. The share of illegal transaction volume on CoinEx is nearly 8% — critically above the 0.3% threshold typical for exchanges that comply with regulatory requirements.
CoinEx-affiliated mining pool ViaBTC added another $154 million in "traced connections" to Nobitex through mining payouts. Moreover, after the cyberattack by the Predatory Sparrow group in 2025, ViaBTC provided emergency liquidity to Nobitex. This clearly demonstrates that the CoinEx ecosystem has become critically important for the survival of Iran's cryptocurrency economy.
Direct Links to Sanctioned Entities
Analysts also recorded direct on-chain connections between CoinEx and organizations under sanctions: the Islamic Revolutionary Guard Corps ($6 million), the Palestinian Islamic Jihad ($374,000), and Hezbollah. After OFAC sanctions were imposed on June 2, 2026, against Ramzinex, BitPin, Wallex, and Nobitex, volumes between CoinEx and Iranian exchanges fell below $150,000.
Scheme Involving the Central Bank of Iran
Of particular note is the scheme involving the Central Bank of Iran. Approximately $67 million in funds from the Central Bank were sent to CoinEx addresses as part of a structured money laundering scheme across multiple blockchains between June 2025 and June 2026. The Central Bank managed the infrastructure through the National Iranian Exchange (NIE) under a scheme internally named "National Tether."
The mechanism operated on a uniform template: NIE wallets received large USDT deposits on the TRON network (often exceeding $5 million), split them into structured portions, and routed them through cross-chain bridges to Ethereum. There, the funds entered Gnosis Safe multi-signature contracts and were converted into Aave protocol tokens to complicate freezing. The assets were then split again, transferred through bridges, and at the end of the chain, consolidated and directed to withdrawal points on centralized exchanges, ultimately ending up on CoinEx.
My expert assessment: The scale, duration, and structure of CoinEx's connections with Iran's sanctioned crypto ecosystem indicate coordinated activity rather than isolated violations. Without access to CoinEx's liquidity and infrastructure, Iranian platforms and regime-linked entities would lose one of their main pathways to global cryptocurrency markets. This investigation is a serious signal for the entire industry about the need to strengthen compliance procedures.