TRM: Iran-linked actors routed $3.8B via CoinEx

Blockchain analytics firm TRM Labs says the crypto exchange CoinEx has functioned as a major gateway for funds connected to sanctioned Iranian entities since 2019, with more than $3.84 billion identified as having moved through CoinEx over that period.

In a report published this week, TRM Labs links CoinEx exposure to roughly 60 Iranian platforms and states that $2.7 billion of that traced activity flowed specifically between CoinEx and Nobitex, Iran’s largest domestic exchange, averaging about $1 million per day since 2018.

Key takeaways

• TRM Labs reports that wallets tied to sanctioned Iranian entities routed over $3.84 billion through CoinEx since 2019.
• Of that total, $2.7 billion was traced between CoinEx and Nobitex, averaging roughly $1 million per day since 2018.
• TRM Labs claims CoinEx’s illicit-transaction share is nearly 8%, compared with about 0.3% on other compliant exchanges.
• CoinEx denies any commercial relationship with Iranian government-linked entities and disputes TRM Labs’ interpretation of on-chain flows.
• The findings arrive shortly after US Treasury sanctioned four Iranian crypto exchanges under its “Economic Fury” campaign.

TRM Labs maps CoinEx’s role in Iran-linked flows

TRM Labs’ analysis centers on “identifiable links” between certain cryptocurrency wallets and sanctioned Iranian entities, then tracks how those funds moved through crypto trading infrastructure. The firm describes CoinEx as a primary channel that Iranian platforms used to reach broader, global crypto markets.

The report argues that the pattern of exposure was not consistent with what TRM Labs characterizes as “independent market behaviour.” By 2024, CoinEx was described as Nobitex’s largest external counterpart, nearly nine times the size of the next-largest exchange in TRM Labs’ dataset.

TRM Labs also says that multiple Iranian exchanges appear to rely on CoinEx for a meaningful portion of their activity. According to the report, the top Iranian domestic exchanges typically route around 5% to 10% of their trading volume through CoinEx—an intensity TRM Labs interprets as indicating a “coordinated arrangement” rather than organic usage.

Volume shares and “illicit” thresholds

Beyond total traced value, TRM Labs evaluates CoinEx’s share of illicit transaction volume. The firm states CoinEx’s share is nearly 8%, which it contrasts with a 0.3% threshold found at other exchanges considered compliant. The implication for market participants is straightforward: even when activity on an exchange looks routine, analytics can identify when the counterparties and routes correlate strongly with sanctioned or otherwise restricted actors.

TRM Labs further points to CoinEx-affiliated infrastructure. It says ViaBTC, a mining pool affiliated with CoinEx, showed $154 million in traced exposure to Nobitex through mining payouts, and it provided what TRM Labs characterizes as emergency liquidity to Nobitex after a major reported hack in June 2025.

Regulatory pressure escalates as US sanctions target Iran’s crypto rails

The TRM Labs report lands at a moment when US authorities have intensified enforcement against Iran’s crypto ecosystem. The day’s claims come about three weeks after the US Treasury sanctioned four Iranian crypto exchanges as part of its “Economic Fury” campaign.

Earlier, US Treasury Secretary Scott Bessent said the Treasury had seized $1 billion in crypto from Iranian exchanges and wallets since the start of the war. Against that backdrop, TRM Labs’ characterization of CoinEx as a key gateway fits a broader enforcement narrative: sanctions are increasingly aimed not only at domestic platforms, but also at the counterparties and routing mechanisms that help sanctioned entities access global liquidity.

Cointelegraph previously reported that Nobitex was central to Iran’s “digital dollar pipeline,” and Chainalysis reported that the exchange handled about 50% of Iran’s crypto trading volume. The ecosystem has also drawn attention for governance and ownership links; Cointelegraph reported Nobitex was tied to members of a powerful family with connections to Supreme Leader Ali Khamenei, and in January the US sanctioned UK-registered Zedcex and Zedxion as front companies for the IRGC.

CoinEx rejects the conclusions and disputes the meaning of on-chain data

CoinEx responded directly to the TRM Labs findings. In a statement posted Thursday on X, the exchange denied having any commercial relationship with the Iranian government or domestic Iranian exchanges. CoinEx also said it has never provided funding channels to sanctioned parties.

Just as importantly, CoinEx challenged TRM Labs’ interpretation of blockchain evidence. The exchange argued that on-chain fund flows alone do not prove that a platform had knowledge of, or participated in, illicit activity.

This dispute is likely to remain central for compliance teams and regulators evaluating how to translate analytics into enforcement. TRM Labs offers a data-driven account of routing and exposure; CoinEx frames the same on-chain observations as insufficient to establish intent or awareness.

What traders and compliance teams should watch next

As US sanctions continue to expand and blockchain analytics refine attribution techniques, the key question for the market is how exchanges translate “traced exposure” into practical safeguards—especially regarding counterparties, liquidity provision, and routing. Readers should monitor whether additional enforcement actions or compliance measures follow TRM Labs’ claims, and whether CoinEx (and related infrastructure like affiliated pools) changes its risk controls in response.