CoinEx Exchange as Iran's Main Gateway: TRM Labs Reveals Scale of $3.8 Billion Scheme
Analysts at the blockchain platform TRM Labs have uncovered a large-scale financial network linking the cryptocurrency exchange CoinEx to sanctioned Iranian entities. Over seven years, more than $3.84 billion passed through this ecosystem. This is not about chaotic transactions, but a well-coordinated system involving over 60 Iranian platforms.
Nobitex — Key Counterparty
The bulk of the operations — $2.7 billion — came from CoinEx's interaction with Iran's largest local exchange, Nobitex. Since 2018, the average daily transfer volume between them was about $1 million. By 2024, CoinEx had become the dominant external counterparty for Nobitex, outpacing its nearest competitor by nearly nine times.
Characteristically, the share of "illicit" transaction volume on CoinEx reaches nearly 8% — critically higher than the standard threshold of 0.3% for exchanges complying with regulatory requirements. CoinEx-affiliated mining pool ViaBTC added another $154 million in "traced links" through mining payouts to this picture. Notably, ViaBTC provided Nobitex with emergency liquidity after a cyberattack by the Predatory Sparrow group in 2025, confirming that the CoinEx ecosystem has become critically important for the survival of Iran's crypto economy.
Direct Links to Sanctioned Entities
Beyond local exchanges, TRM Labs recorded direct flows from CoinEx to organizations under OFAC sanctions. These include the Islamic Revolutionary Guard Corps ($6 million), Palestinian Islamic Jihad ($374,000), and Hezbollah. After OFAC sanctions were imposed on June 2, 2026, against Ramzinex, BitPin, Wallex, and Nobitex, volumes between CoinEx and Iranian exchanges sharply dropped below $150,000.
The Scheme with the Central Bank of Iran: "National Tether"
Of particular note is the money laundering mechanism involving the Central Bank of Iran (CBI). Approximately $67 million was sent to CoinEx addresses as part of a structured scheme operating from June 2025 to June 2026. According to analysts, the CBI managed the infrastructure through the National Iranian Exchange (NIE) under a model internally dubbed "National Tether."
The mechanism operated on a uniform template. NIE wallets received large USDT deposits on the TRON network — often for amounts exceeding $5 million. The funds were broken down into structured parts and transferred via cross-chain bridges to Ethereum. There, they entered Gnosis Safe multi-signature contracts and were converted into Aave protocol tokens to complicate freezing. The assets were then fragmented again and transferred through bridges — the chain repeated until the funds were consolidated and directed for withdrawal through centralized exchanges, ultimately ending up on CoinEx.
Analyst's Conclusion
The scale, duration, and structural complexity of CoinEx's ties to the sanctioned Iranian crypto ecosystem leave no doubt: this was coordinated activity, not a random choice of platform by market participants. Without access to CoinEx's liquidity and infrastructure, Iranian platforms and regime-linked entities would have lost one of their main pathways to global cryptocurrency markets. This case is a stark example of how a lack of proper compliance on a centralized exchange can turn it into a systemically important element of an entire state's shadow financial system.