Billions in Crypto Transactions Linked to Sanctioned Iranian Entities via CoinEx
More than $3.84 billion in blockchain transactions have been traced between cryptocurrency exchange CoinEx and sanctioned Iranian entities over a period exceeding seven years, according to a new report.
The findings emerge shortly after the U.S. Treasury’s Office of Foreign Assets Control (OFAC) imposed sanctions on four Iranian exchanges—Nobitex, BitPin, Wallex, and Ramzinex—under Executive Orders 13224 and 13902. These four platforms accounted for approximately $7.7 billion, or 78%, of Iran’s estimated $10 billion in attributed crypto activity in 2025, the report by TRM Labs stated. Despite ongoing enforcement actions, Iran’s annual crypto volumes have remained substantial.
CoinEx, founded in 2017, has processed over $79 billion in trading volume and has faced regulatory scrutiny in multiple countries. TRM Labs’ analysis indicates that CoinEx is the largest external counterparty for Nobitex, Iran’s biggest crypto exchange. Since late 2018, over $2.7 billion has moved between the two platforms through approximately 6.2 million blockchain transfers, averaging about $1 million daily. Nobitex has sent roughly $360 million more to CoinEx than it received, suggesting a consistent flow of funds from Iran to international markets via CoinEx.
Activity between CoinEx and Nobitex surged from around $13 million in 2020 to $575 million in 2021. Following a dip in 2022 and 2023, volumes rebounded to $714 million in 2024 and $763 million in 2025. CoinEx was responsible for over 16% of Nobitex’s annual transaction volume.
TRM Labs also identified direct connections between CoinEx and more than 60 Iranian crypto businesses, including Wallex, Ramzinex, BitPin, Aban Tether, Excoino, Bit24, Ompfinex, Sarmayex, and Exir. The report suggests that a similar proportion of transaction volumes was routed through CoinEx across multiple Iranian exchanges, coupled with the gradual onboarding of platforms over several years. This pattern points to an organized relationship rather than independent market behavior.
The blockchain intelligence firm further discovered that approximately $67 million originating from the Central Bank of Iran reached CoinEx through a complex laundering structure between June 2025 and June 2026. Funds reportedly traversed multiple blockchains, cross-chain bridges, Gnosis Safe contracts, and Aave tokens before arriving at CoinEx. The exchange allegedly provided transaction fees that facilitated these transfers.
ViaBTC, a mining pool operated by CoinEx’s parent company, also showed close ties to Iran. TRM traced over $154 million between ViaBTC and Nobitex-linked wallets, with most transfers flowing from the mining pool to Iranian wallets. Following a cyberattack on Nobitex in 2025, previously inactive mining wallets transferred about $2.7 million to a new Nobitex wallet. ViaBTC also appeared in the transaction chain, indicating that mining reserves may have been used to restore liquidity.
TRM also found CoinEx’s exposure to wallets linked to the IRGC, Palestinian Islamic Jihad, Hezbollah, Garantex, Bitzlato, the CoinEx hack, BlackSuit ransomware, and the Wasabi mixing service. Transaction patterns shifted after the intensification of the U.S.-Iran-Israel conflict in early 2026, with average transfer sizes and the frequency of larger transactions increasing sharply.
Following OFAC’s sanctions on several Iranian exchanges earlier this month, transaction volumes between CoinEx and Iranian entities have significantly decreased. However, the firm cautioned that private exchange accounts could still enable activity outside of public blockchain visibility.
CoinEx has denied any relationship with the Iranian government or sanctioned entities, stating it has never provided them with funding or support. The exchange also asserted that blockchain transactions do not inherently prove involvement in illegal activities.
Leave a Reply