Author
Ahmed Barakat
Author
Share
Blockchain analytics firm TRM Labs traced $3.84 billion in flows from wallets linked to more than 60 sanctioned Iranian entities through CoinEx since 2019, identifying the exchange as the primary external conduit for Iran-linked capital moving into global crypto markets.
Of that total, $2.7 billion flowed specifically between CoinEx and Nobitex, Iran’s largest domestic exchange, at an average rate of approximately $1 million per day since 2018. By any documented measure, this is the largest single-exchange crypto sanctions-evasion pipeline tied to Iran yet identified.
The TRM Labs report landed three weeks after the US Treasury sanctioned four Iranian crypto exchanges as part of its Economic Fury campaign, with Treasury Secretary Scott Bessent separately confirming the seizure of $1 billion in crypto from Iranian exchanges and wallets since the start of the war.
CoinEx is not among the sanctioned entities. That gap, between what the blockchain data shows and what enforcement has acted on, is the structural tension this report forces into the open. The Iran-CoinEx controversy is now squarely on the US Treasury’s radar.
Don’t Miss Out on Our $1,000 USDT Airdrop on ByBit
CoinEx’s 8% Illicit Rate Is 27x the Industry Benchmark
The compliance gap TRM Labs documents is not marginal. CoinEx’s share of illicit transaction volume sits at nearly 8%, against a 0.3% threshold observed at compliant exchanges, a ratio of roughly 27 to one.
That number is not cosmetic; it is the quantitative basis for TRM’s conclusion that the CoinEx-Nobitex relationship reflects a “coordinated arrangement rather than organic adoption.”
The specifics reinforce that reading. By 2024, CoinEx was Nobitex’s largest external counterpart by volume, nearly nine times larger than the next-biggest exchange, a concentration TRM called “inconsistent with independent market behaviour.”
Major Iranian domestic exchanges route between 5% and 10% of their trading volume through CoinEx, a uniformity across platforms that would be statistically improbable if each exchange were making independent routing decisions.
CoinEx-affiliated mining pool ViaBTC adds another layer. TRM Labs traced $154 million in ViaBTC exposure to Nobitex through mining payouts.
More pointedly, ViaBTC supplied emergency liquidity to Nobitex following the Predatory Sparrow hack in June 2025, a $90 million breach that left Nobitex operationally stressed. An affiliated mining pool stepping in as a liquidity backstop for a sanctioned exchange is not a pattern that emerges from coincidence.
Discover: The Best Token Presales
Nobitex Was the On-Ramp, CoinEx Was the Exit
The architecture of the pipeline is straightforward. Sanctioned Iranian entities, including IRGC-linked wallets and entities tied to Iran’s domestic financial system, moved funds into Nobitex, which handled approximately 50% of Iran’s crypto trading volume, per a June 2 Chainalysis report.
Nobitex then routed capital outward through CoinEx, which provided access to global liquidity and the ability to convert into dollar-equivalent stablecoins beyond the reach of Iranian sanctions enforcement.
This flow pattern has been running since at least 2018 on the CoinEx-Nobitex corridor, and since 2019 for the broader universe of sanctioned entities TRM Labs tracked. Nobitex’s own political exposure sharpened the stakes: in May 2026, the exchange was reportedly linked to members of a powerful family with ties to Supreme Leader Ali Khamenei, suggesting the pipeline served interests at the apex of the Iranian state, not just retail traders seeking dollar access.
The displacement of other exchanges from Nobitex’s external routing is also analytically significant. CoinEx overtook Binance as Nobitex’s largest foreign counterparty by 2024, after Binance faced US enforcement pressure. That transition illustrates precisely the rerouting dynamic critics of venue-specific enforcement consistently flag: pressure on one exchange does not eliminate the demand, it reassigns it.
CoinEx Denies Government Ties. The On-Chain Data Is Not a Contract.
CoinEx issued a denial on X following the TRM Labs report, stating it has no commercial relationship with the Iranian government or domestic Iranian exchanges and has never provided funding channels to sanctioned parties.
The exchange also disputed TRM Labs’ interpretive framework directly, arguing that “onchain fund flows do not demonstrate a platform’s knowledge of or participation in illicit activity.”
The denial addresses contractual relationships; the TRM Labs report documents transaction flows. Those are not the same evidentiary category, and the distinction matters.
OFAC sanctions exposure does not require proof of a formal commercial agreement – it requires demonstrated facilitation of transactions involving sanctioned parties.
Whether CoinEx knew the identities behind the wallets routing $3.84 billion through its platform is a compliance question. That the flows existed at 27 times the illicit-volume rate of compliant exchanges is the data point that precedes that question.
Discover: The Best Crypto to Diversify Your Portfolio
