Blockchain analytics company TRM Labs has released a report revealing that wallets linked to sanctioned Iranian entities have moved over $3.84 billion through the cryptocurrency exchange CoinEx since 2019. The findings paint a detailed picture of how digital assets are used to bypass U.S. economic sanctions, with CoinEx emerging as a central node in what analysts describe as a coordinated effort.
Key Findings from the TRM Report
According to the report, about 60 Iranian platforms were tied to the funds. Of the $3.84 billion total, $2.7 billion flowed specifically between CoinEx and Nobitex, Iran's largest domestic cryptocurrency exchange. This flow has occurred at an average rate of approximately $1 million per day since 2018. By 2024, CoinEx had become Nobitex's largest external counterpart—nearly nine times larger than the next biggest exchange. TRM Labs described this pattern as "inconsistent with independent market behavior," suggesting a deliberate arrangement rather than organic adoption.
Most major Iranian domestic exchanges route between 5% and 10% of their trading volume through CoinEx. The exchange's share of illicit transaction volume is nearly 8%, significantly above the 0.3% threshold seen at other compliant exchanges. This figure has drawn particular attention from regulators and compliance professionals.
US Sanctions and the 'Digital Dollar Pipeline'
The report comes three weeks after the U.S. Treasury Department sanctioned four Iranian crypto exchanges as part of its "Economic Fury" campaign. Days before those sanctions were announced, Treasury Secretary Scott Bessent stated that the Treasury had seized $1 billion in cryptocurrency from Iranian exchanges and wallets since the start of the war. The OFAC (Office of Foreign Assets Control) has been increasingly focused on cryptocurrency channels used by Iran to circumvent traditional banking restrictions.
Nobitex was identified as the center of Iran's "digital dollar pipeline," handling roughly 50% of the country's crypto trading volume, according to a June 2 report by blockchain forensics platform Chainalysis. In May, Nobitex was reportedly linked to members of a powerful family with ties to Supreme Leader Ali Khamenei. Such connections underscore the politically sensitive nature of the flows.
CoinEx's Response and Industry Context
In a statement published on X, CoinEx denied having any commercial relationship with the Iranian government or domestic Iranian exchanges. The exchange claimed it has never provided funding channels to sanctioned parties. CoinEx also disputed TRM Labs' interpretation of blockchain data, arguing that onchain fund flows do not demonstrate a platform's knowledge of or participation in illicit activity. "Onchain data alone cannot prove intent or control," a CoinEx spokesperson said.
Despite these denials, the volume and concentration of flows have raised red flags among compliance experts. CoinEx also operates the mining pool ViaBTC, which accounted for an additional $154 million in traced exposure to Nobitex through mining payouts. ViaBTC also supplied emergency liquidity to Nobitex following the Predatory Sparrow hack in June 2025, which saw a $90 million theft from the Iranian exchange.
Broader Sanctions and Enforcement Actions
The U.S. government has pursued multiple avenues to disrupt Iranian cryptocurrency usage. In January 2026, OFAC sanctioned UK-registered Zedcex and Zedxion for being used as front companies for the Iranian Revolutionary Guard Corps (IRGC). These actions are part of a broader effort to choke off financial support for Iranian military and nuclear programs. The Treasury has also increasingly used blockchain analytics to trace transactions, even when exchanges themselves may be unwitting facilitators.
Iran's use of cryptocurrency is not new. The country has long turned to digital assets to bypass international sanctions that restrict its access to the global banking system. Bitcoin mining became a major industry in Iran due to cheap energy subsidies, but the government has also embraced exchanges like Nobitex and others to facilitate cross-border trade. The TRM report adds to a growing body of evidence that exchanges with weak compliance frameworks are being exploited by sanctioned entities.
Implications for the Crypto Industry
The findings highlight a persistent challenge for the cryptocurrency ecosystem: balancing decentralization and permissionless innovation with the need to comply with international sanctions. While most major exchanges adhere to KYC/AML requirements and cooperate with law enforcement, some smaller or less regulated platforms become hubs for illicit flows. CoinEx's case is particularly striking because of the sheer volume—$3.8 billion over six years—and the clear pattern of coordination.
Industry observers note that the 8% illicit transaction share is an order of magnitude higher than what is typically seen at compliant exchanges. For comparison, a study by Chainalysis in 2024 found that illicit activity accounted for less than 1% of total crypto transaction volume globally. CoinEx's outlier status is likely to attract further regulatory scrutiny, especially from U.S. authorities who have demonstrated willingness to pursue extraterritorial enforcement.
The report also raises questions about the effectiveness of self-regulation and the role of blockchain analytics companies in policing the ecosystem. TRM Labs, along with competitors like Chainalysis and Elliptic, provide data that governments use for sanctions enforcement. However, exchanges that operate outside major regulatory jurisdictions can still facilitate flows that are difficult to stop without global coordination.
Future Outlook
As the U.S. intensifies its 'Economic Fury' campaign, more Iranian-linked wallets and exchanges are likely to be sanctioned. Companies like CoinEx that have been named in such reports may face increased due diligence from counterparties and banking partners. The incident also serves as a cautionary tale for other exchanges: even if a platform does not actively facilitate sanctions evasion, its presence on the radar of analytics firms can lead to reputational and operational damage.
For Iran, the digital dollar pipeline remains a critical lifeline, but each new report and enforcement action narrows the available channels. The convergence of blockchain analytics, government sanctions, and global financial regulation means that even technologically sophisticated evasion methods are increasingly detectable.
Source: Cointelegraph News