CoinEx Under the Microscope: TRM Labs Uncovers a $3.8 Billion Iranian Crypto Flow Network
Analytical company TRM Labs has presented the results of a large-scale investigation that sheds light on mechanisms for circumventing international sanctions using cryptocurrencies. According to the data obtained, the CoinEx exchange has become a key node for withdrawing funds from the Iranian crypto ecosystem: over the past seven years, more than $3.84 billion has been processed through it. This is not about chaotic transactions, but about coordinated activity involving over 60 Iranian platforms.
Nobitex as the Main Counterparty
The bulk of the volume — $2.7 billion — comes from CoinEx's interaction with Iran's largest local exchange, Nobitex. Over recent years, the daily transfer volume between them was about $1 million. By 2024, CoinEx had become the dominant external counterparty for Nobitex, leaving the nearest competitor behind by almost nine times. Each major Iranian exchange directs between 5% and 10% of its total turnover through CoinEx, which, according to analysts, indicates a coordinated agreement rather than a natural market choice.
The share of illegal transaction volume on CoinEx reaches nearly 8%, significantly exceeding the standard threshold of 0.3% typical for exchanges that comply with regulatory requirements. CoinEx-affiliated mining pool ViaBTC added another $154 million in "traced links" to Nobitex through mining payouts. Moreover, ViaBTC provided Nobitex with emergency liquidity after the cyberattack by the Predatory Sparrow group in 2025, which, according to TRM Labs, demonstrates the critical dependence of the Iranian crypto economy on CoinEx's infrastructure.
Direct Links to Sanctioned Entities
Analysts also identified direct on-chain links between CoinEx and organizations under sanctions. These include the Islamic Revolutionary Guard Corps ($6 million), Palestinian Islamic Jihad ($374,000), and Hezbollah. After OFAC imposed sanctions on June 2, 2026, against the exchanges Ramzinex, BitPin, Wallex, and Nobitex, transfer volumes between CoinEx and Iranian platforms sharply dropped below $150,000.
Scheme Involving the Central Bank of Iran
Of particular note is the mechanism involving the Central Bank of Iran. TRM Labs established that about $67 million from CBI was sent to CoinEx addresses as part of a structured money laundering scheme across multiple blockchains between June 2025 and June 2026. The Central Bank managed the infrastructure through the National Iranian Exchange (NIE) under a scheme internally called "National Tether."
The mechanism followed a uniform pattern: NIE wallets received large USDT deposits on the TRON network — often exceeding $5 million — broke them into structured parts, and routed them through cross-chain bridges to Ethereum. There, the funds entered Gnosis Safe multi-signature contracts and were converted into Aave protocol tokens to complicate freezing. The assets were then broken up again and transferred through bridges, after which the sequence was repeated. At the end of the chain, the funds were consolidated and directed to withdrawal points on centralized exchanges, ultimately ending up on CoinEx.
My professional commentary: This case is a vivid example of how centralized exchanges can become "gray gateways" for sanctioned jurisdictions. The scale and structured nature of the scheme indicate a high level of coordination, while the use of DeFi protocols to complicate tracking points to the evolution of money laundering methods. Without access to CoinEx's liquidity and infrastructure, Iranian platforms and regime-linked entities would lose one of their main pathways to global cryptocurrency markets. This investigation calls into question the effectiveness of compliance procedures even at major exchanges.