CoinEx as Iran's Main Gateway: TRM Labs Analysis Reveals $3.8 Billion in Sanctioned Flows
Blockchain analysts at TRM Labs have uncovered a massive network of transactions between the CoinEx exchange and sanctioned Iranian entities. The total volume of flows over the past seven years has exceeded $3.84 billion. The scheme involves more than 60 Iranian platforms, indicating a coordinated nature of operations rather than natural market demand.
The key link in this chain was the connection between CoinEx and Iran's largest local exchange, Nobitex. They accounted for $2.7 billion in transactions, equivalent to approximately $1 million per day starting from 2018. By 2024, CoinEx had become Nobitex's largest external counterparty, outpacing its nearest competitor by nearly nine times. This is not a coincidence but the result of a deliberate infrastructure buildout.
Scale and Mechanisms
Each major Iranian exchange channels between 5% and 10% of its total volume through CoinEx. According to TRM Labs' estimate, the share of illegal transactions on CoinEx is about 8% — 26 times higher than the 0.3% threshold typical for exchanges that comply with regulatory requirements. CoinEx-affiliated mining pool ViaBTC adds another $154 million in "traced connections" to Nobitex through mining payouts.
Notably, ViaBTC provided emergency liquidity to Nobitex after a cyberattack by the Predatory Sparrow group in 2025. This clearly demonstrates how critical the CoinEx ecosystem has become for the survival of Iran's cryptocurrency economy.
Sanctioned Connections and Reaction
CoinEx's direct on-chain links also lead to entities under U.S. sanctions. These include the Islamic Revolutionary Guard Corps ($6 million), Palestinian Islamic Jihad ($374,000), and Hezbollah. After OFAC imposed sanctions on June 2, 2026, against Ramzinex, BitPin, Wallex, and Nobitex, volumes between CoinEx and Iranian exchanges dropped below $150,000.
Scheme Involving the Central Bank of Iran
Of particular note is the money laundering mechanism involving the Central Bank of Iran. Approximately $67 million was sent to CoinEx addresses as part of a structured scheme internally called "National Tether." Transactions passed through a multi-layered chain: large USDT deposits on the TRON network were broken up, routed through cross-chain bridges to Ethereum, converted into Aave protocol tokens, then broken up again and transferred. Ultimately, the funds were consolidated and sent to CoinEx.
Expert comment from Cryptalist: This case is a vivid example of how unscrupulous exchanges become systemically important elements of shadow financial infrastructure. While regulators focus on major players, such "gray zones" continue to thrive. Investors should remember: liquidity without compliance is not an advantage, but a red flag.