TRM: $3.8B routed via CoinEx by 60 Iran-linked sanctioned entities

Blockchain analytics firm TRM Labs says crypto exchange CoinEx has been used as a major gateway for Iranian-sanctions evasion, citing evidence that wallets linked to Iranian entities processed more than $3.84 billion through CoinEx since 2019.

In a report published Wednesday, TRM Labs estimates that roughly 60 Iranian-linked platforms were connected to the flows, with $2.7 billion of that total moving between CoinEx and Nobitex—described as Iran’s largest domestic exchange—at an average pace of about $1 million per day since 2018. The analysis also argues that CoinEx’s growing role in Nobitex’s external counterpart network is difficult to explain as “independent market behaviour.”

Key takeaways

• TRM Labs attributes over $3.84 billion in traced activity to wallets linked to sanctioned Iranian entities that have moved through CoinEx since 2019.
• The firm links $2.7 billion of that volume to CoinEx–Nobitex transfers, averaging about $1 million per day since 2018.
• TRM Labs says CoinEx handles nearly 8% of illicit transaction volume among exchanges it reviewed, far above a 0.3% benchmark it cites for other compliant exchanges.
• The analytics firm argues CoinEx’s relationship with major Iranian counterparties appears coordinated rather than organic, including Nobitex routing patterns.
• CoinEx denies any commercial relationship with sanctioned parties and disputes TRM’s interpretation of blockchain onchain flows.

TRM Labs ties CoinEx to Iran-related sanctions exposure

TRM Labs’ report frames CoinEx as one of the principal routes for moving value between Iranian crypto players and the broader market in ways that may undermine US sanctions. The firm says it identified wallets with links to sanctioned Iranian entities and then tracked how funds moved through CoinEx over a multi-year period.

The analysis highlights the scale of CoinEx’s exposure to Iranian platforms: TRM Labs estimates that around 60 Iranian platforms were connected to the traced funds. It further focuses on the relationship between CoinEx and Nobitex, stating that $2.7 billion flowed between the two since 2018.

TRM Labs also argues that the distribution of counterpart relationships is inconsistent with what it would expect from normal, independent trading behaviour. By 2024, it says CoinEx had become Nobitex’s largest external counterpart—nearly nine times the next-largest exchange partner—suggesting a relationship that may be more structural than incidental.

Why the timing matters for sanctions enforcement

The report arrives shortly after the US Treasury moved to widen its Iran-related crypto sanctions posture. Cointelegraph reported that about three weeks earlier, the US Treasury sanctioned four Iranian crypto exchanges as part of its “Economic Fury” campaign.

Those steps followed statements from the Treasury’s leadership indicating the government has seized and tracked significant crypto holdings tied to Iranian activity during the war period. According to Cointelegraph coverage, Treasury Secretary Scott Bessent said Treasury had seized $1 billion in crypto from Iranian exchanges and wallets since the start of the conflict.

TRM Labs’ findings fit this broader enforcement narrative, underscoring a recurring compliance challenge for exchanges and intermediaries: even when a trading venue is not directly designated, it can still be used to route value through counterparties that sit on or near sanctions lists.

CoinEx response: onchain flows don’t prove knowledge

In a post published Thursday on X, CoinEx denied having any commercial relationship with the Iranian government or Iranian domestic exchanges, and said it has never provided funding channels to sanctioned parties. The exchange also challenged TRM Labs’ reading of blockchain data.

CoinEx’s position, as described in the article, is that onchain fund flows alone do not demonstrate that a platform knows about or participates in illicit activity. That dispute goes to a key point in compliance debates: whether tracing the movement of funds is sufficient to infer operational involvement, or whether additional evidence is required to establish knowledge or intent.

Nobitex routing patterns and CoinEx’s reported share of illicit volume

TRM Labs says many of Iran’s largest domestic exchanges route a meaningful fraction of their trading activity through CoinEx. The firm estimates that major Iranian exchanges typically pass about 5% to 10% of their trading volume through CoinEx, which TRM Labs characterizes as evidence of a coordinated arrangement rather than organic adoption.

In the same analysis, TRM Labs reports that CoinEx’s share of illicit transaction volume is nearly 8%. It contrasts that figure with a 0.3% threshold found at other compliant exchanges, implying CoinEx has a much higher concentration of traced illicit activity than peers.

The report also includes details involving CoinEx-affiliated infrastructure. TRM Labs says a CoinEx-affiliated mining pool, ViaBTC, accounted for another $154 million in traced exposure to Nobitex through mining payouts, and also supplied emergency liquidity to Nobitex after Predatory Sparrow’s reported $90 million hack in June 2025. Cointelegraph says it contacted ViaBTC for comment but had not received a response at the time of publication.

Nobitex, meanwhile, has been the focus of broader reporting and industry forensics. Cointelegraph notes that Chainalysis previously described Nobitex as central to a “digital dollar pipeline” and estimated it handled about 50% of Iran’s crypto trading volume. Earlier coverage also said Nobitex was linked to a powerful family with ties to Iran’s Supreme Leader, while Cointelegraph reported that US authorities sanctioned front companies—Zedcex and Zedxion—connected to the Iranian Revolutionary Guard Corps (IRGC).

What to watch next

TRM Labs’ report reinforces the likelihood that sanctions scrutiny will continue to focus not only on named Iranian venues, but also on the trading rails—exchanges, counterparties, and related infrastructure—that can move funds between sanctioned actors and global liquidity. The next signal to monitor is whether exchanges such as CoinEx face new compliance actions or whether additional reporting from analytics firms narrows the gap between “traced flows” and demonstrable knowledge.