CoinEx Handled $3.84bn in Flows to Iran's Sanctioned Crypto Exchanges Over Seven Years, TRM Labs Finds

TRM Labs, which published its analysis on 24 Jun, says the scale, duration and statistical distribution of the flows across more than 60 Iranian platforms point to a coordinated arrangement rather than organic market behaviour. The report lands three weeks after the US Treasury's Office of Foreign Assets Control (OFAC) sanctioned four of Iran's largest domestic exchanges, and follows two earlier enforcement actions targeting Iran's crypto infrastructure since January.

CoinEx, founded in 2017 by Haipo Yang and registered in the Seychelles with operational roots in Hong Kong, has processed more than $79.1bn in total trading volume over its lifetime. It operates legal entities in Estonia, Lithuania and the UK.

Nobitex at the centre

The dominant relationship identified by TRM is between CoinEx and Nobitex, Iran's largest domestic cryptocurrency exchange. Since November 2018, more than $2.7bn has moved between the two platforms across roughly 6.2mn individual blockchain transfers – an average of approximately $1mn per day.

Nobitex was sanctioned by OFAC on 2 Jun, alongside BitPin, Wallex and Ramzinex, under executive orders targeting Iran's support for terrorism. The four exchanges together accounted for roughly $7.7bn, or 78%, of Iran's attributed 2025 crypto volume of $9.9bn, according to TRM data.

By 2024, CoinEx had become Nobitex's single largest external counterparty by nearly nine times over the next largest named exchange. Transaction volume between the two grew from approximately $13mn in 2020 to $575mn in 2021, before a period of decline and a subsequent rebound to $714mn in 2024 and $763mn in 2025. By last year, CoinEx accounted for approximately 16.3% of Nobitex's total annual transaction volume.

Nobitex has sent approximately $360mn more to CoinEx than it has received, a pattern TRM says is consistent with the systematic outward routing of cryptocurrency from Iran searching for international liquidity.

Network-wide penetration

Beyond Nobitex, TRM identified direct CoinEx exposure to more than 60 Iranian cryptocurrency entities, including Wallex, Ramzinex, BitPin, Aban Tether, Excoino, Bit24, Ompfinex, Sarmayex and Exir.

Three patterns in the data led TRM to conclude the connectivity is unlikely to reflect independent market behaviour. Every major Iranian exchange routes approximately 5–10% of its total transaction volume through CoinEx – a statistical clustering that, TRM argues, would vary widely in a free market. Iranian exchanges were also onboarded to CoinEx sequentially over several years, from 2018 through 2022 and beyond, a pattern TRM describes as more consistent with a structured client rollout than independent discovery. Finally, small and obscure Iranian platforms – including Tabdeal, Kifpool, Jibitex and Xchange98 – all carry direct CoinEx exposure, suggesting full-market saturation rather than selective engagement.

Central Bank of Iran flows

TRM found approximately $67mn originating from the Central Bank of Iran flowed into CoinEx addresses between June 2025 and June 2026 as part of what it describes as a structured multichain laundering scheme. The central bank administered this infrastructure through the National Iranian Exchange under a framework TRM says was internally described as "National–Tether."

The scheme routed large deposits – often exceeding $5mn – through cross-chain bridges, Ethereum-based smart contracts and decentralized finance (DeFi) protocols designed to complicate asset freezing, before funds reconsolidated and moved toward CoinEx as a final off-ramp. TRM says CoinEx also provided transaction fee funding that enabled the laundering activity itself.

ViaBTC: The mining layer

CoinEx is owned by Viabtc Technology Limited, which also operates ViaBTC, a large global cryptocurrency mining pool, in which many individual miners contribute computing power to a shared network and receive proportional payouts from block rewards. Since 2018, TRM traced more than $154mn across approximately 4.47mn transfers between ViaBTC and Nobitex-linked wallets, with nearly all flows originating from ViaBTC – consistent with mining pool payouts directed into Iranian exchange wallets.

The strategic importance of that relationship became apparent in 2025. Following a cyberattack on Nobitex by the hacking group Predatory Sparrow, TRM identified 117 previously dormant Bitcoin (BTC) mining wallets that activated and transferred approximately $2.7mn to a new Nobitex hot wallet, with ViaBTC confirming the fund flows. TRM says this indicates Nobitex drew on mining reserves held at ViaBTC to restore liquidity after the attack.

ViaBTC carries additional sanctions exposure: TRM traced approximately $56.1mn in transactions to Bitzlato, a money services business sanctioned under US Treasury Section 311 authorities for money laundering, approximately $12.5mn involving Garantex, a Russian exchange sanctioned for facilitating illicit finance, and roughly $20.7mn to Wasabi, a cryptocurrency mixing service with outsized exposure to sanctioned entities.

Terrorism financing exposure

TRM identified approximately $6mn in transactions across 186 transfers to wallets associated with the Islamic Revolutionary Guard Corps (IRGC), designated a foreign terrorist organisation by the US. Direct exposure also includes approximately $374,000 linked to Palestinian Islamic Jihad and interaction with wallets associated with Hezbollah.

Other high-risk exposure flagged by TRM includes approximately $41.5mn linked to Garantex, approximately $51.2mn connected to wallets involved in the September 2023 CoinEx hack, $2.4mn tied to BlackSuit ransomware and roughly $3.4mn associated with the Wasabi mixing service.

CoinEx's share of illicit transaction volume stands at nearly 8%, according to TRM – far above the 0.3% threshold the firm considers typical of compliant exchanges.

Regulatory history

CoinEx has accumulated regulatory penalties across multiple jurisdictions. It is no longer registered with US FinCEN or Lithuania's financial crimes unit, has been sued by the New York Attorney General, fined by Quebec's financial regulator, investigated by Germany's Federal Financial Supervisory Authority (BaFin) and blocked by Thailand's Securities and Exchange Commission as of May 2025. The exchange also supports Monero (XMR), Zcash (ZEC) and Dash (DASH) – privacy-focused cryptocurrencies designed to obscure onchain transaction trails.

Post-sanctions activity

Following OFAC's 2 Jun designations, CoinEx cycled its hot wallets – a move TRM interprets as an attempt to distance its exposure from the newly sanctioned entities. Volumes between CoinEx and Iranian exchanges subsequently dropped to below $150,000, though TRM notes it cannot determine whether new infrastructure has been established to evade detection. Iranian exchanges hold accounts at CoinEx that are not publicly visible onchain and could be transacting privately, TRM adds.

CoinEx did not respond to a request for comment by the time of publication.