Blockchain Analytics Firm Identifies Major Sanctions Evasion Channel for Iran
A blockchain analytics firm has identified a significant channel through which sanctioned Iranian entities have moved billions of dollars into global cryptocurrency markets, with a particular focus on the exchange CoinEx. TRM Labs reported that since 2019, approximately $3.84 billion has flowed from wallets linked to over 60 sanctioned Iranian entities through CoinEx, positioning the exchange as a primary external gateway for Iranian capital.
Extensive Flows Between CoinEx and Iranian Exchange
A substantial portion of this total, $2.7 billion, moved specifically between CoinEx and Nobitex, Iran’s largest domestic cryptocurrency exchange. This activity, averaging around $1 million daily since 2018, represents the largest identified cryptocurrency sanctions evasion pipeline tied to Iran to date.
Report Follows Recent US Treasury Actions
The TRM Labs report emerged three weeks after the U.S. Treasury Department sanctioned four Iranian crypto exchanges as part of its “Economic Fury” campaign. Treasury Secretary Scott Bessent also confirmed the seizure of $1 billion in cryptocurrency from Iranian exchanges and wallets since the start of the ongoing conflict. CoinEx itself is not currently among the sanctioned entities, a discrepancy that highlights the gap between observed blockchain data and enforcement actions.
Compliance Gap Raises Concerns
TRM Labs documented a significant compliance gap, noting that CoinEx’s share of illicit transaction volume stands at nearly 8%, far exceeding the 0.3% threshold observed at compliant exchanges. This ratio, approximately 27 to one, forms the quantitative basis for TRM’s conclusion that the relationship between CoinEx and Nobitex suggests a “coordinated arrangement rather than organic adoption.”
Concentration of Volume Points to Arrangement
Further details reinforce this interpretation. By 2024, CoinEx had become Nobitex’s largest external counterparty by volume, nearly nine times larger than the next biggest exchange. TRM Labs described this concentration as “inconsistent with independent market behavior.” Additionally, between 5% and 10% of the trading volume for major Iranian domestic exchanges is routed through CoinEx, a uniformity that would be statistically improbable if each exchange were making independent routing decisions.
Mining Pool Involvement Adds Another Layer
The involvement of CoinEx-affiliated mining pool ViaBTC adds another dimension. TRM Labs traced $154 million in exposure from ViaBTC to Nobitex through mining payouts. More notably, ViaBTC provided emergency liquidity to Nobitex following a $90 million hack in June 2025, an event that left Nobitex facing operational challenges. The intervention of an affiliated mining pool as a liquidity backstop for a sanctioned exchange suggests a pattern beyond mere coincidence.
Pipeline Architecture and State Ties
The pipeline’s architecture is described as straightforward: sanctioned Iranian entities, including those linked to the Islamic Revolutionary Guard Corps (IRGC) and Iran’s domestic financial system, transferred funds to Nobitex. Nobitex, which handled approximately 50% of Iran’s crypto trading volume according to a June 2 Chainalysis report, then routed capital outward through CoinEx. This provided access to global liquidity and the ability to convert funds into dollar-equivalent stablecoins, circumventing Iranian sanctions enforcement.
This flow has been active on the CoinEx-Nobitex corridor since at least 2018, and for the broader universe of sanctioned entities tracked by TRM Labs, since 2019. Nobitex’s own political exposure intensified the stakes; in May 2026, the exchange was reportedly linked to individuals connected to Supreme Leader Ali Khamenei, suggesting the pipeline served interests at the highest levels of the Iranian state.
CoinEx Replaces Binance Amidst Enforcement Pressure
The displacement of other exchanges from Nobitex’s external routing is also significant. CoinEx surpassed Binance as Nobitex’s largest foreign counterparty by 2024, following increased U.S. enforcement pressure on Binance. This transition illustrates a dynamic where pressure on one exchange does not eliminate demand but rather reassigns it to other venues.
CoinEx Denies Allegations
In response to the TRM Labs report, CoinEx issued a denial on X, stating it has no commercial relationship with the Iranian government or domestic Iranian exchanges and has never provided funding channels to sanctioned parties. The exchange also contested TRM Labs’ interpretive framework, arguing that “onchain fund flows do not demonstrate a platform’s knowledge of or participation in illicit activity.”
Transaction Flows vs. Contractual Relationships
The denial focuses on contractual relationships, while the TRM Labs report documents transaction flows. These are distinct evidentiary categories, and the distinction is crucial. U.S. Office of Foreign Assets Control (OFAC) sanctions exposure does not require proof of a formal commercial agreement but rather demonstrated facilitation of transactions involving sanctioned parties.
Whether CoinEx was aware of the identities behind the wallets moving $3.84 billion through its platform is a compliance question. However, the existence of these flows at a rate 27 times higher than compliant exchanges precedes that question.
Leave a Reply