TRM Labs Traces $3.84B Between CoinEx and Sanctioned Iranian Entities

CoinEx processed $3.84B in blockchain flows tied to sanctioned Iranian entities over seven years, according to TRM Labs.

Blockchain intelligence firm TRM Labs traced over $3.84 billion in verified flows between CoinEx and sanctioned Iranian entities. The activity spanned more than seven years and touched over 60 Iranian cryptocurrency platforms. 

CoinEx’s affiliated mining pool, ViaBTC, also features in the data. 

Exposure runs across Nobitex, the Iranian Revolutionary Guard Corps (IRGC), Palestinian Islamic Jihad, and Hezbollah.

Related reading: 

CoinEx Became Nobitex’s Biggest External Lifeline

TRM Labs found that $2.7 billion of the total traced amount moved between CoinEx and Nobitex alone. That works out to roughly $1 million per day since November 2018, across approximately 6.2 million individual blockchain transfers.

By 2024, CoinEx ranked as Nobitex’s single largest external counterparty. The gap was significant. The next largest named exchange trailed by nearly nine times. 

Annual volume between the two hit $714 million in 2024 and climbed to $763 million in 2025. At that point, CoinEx handled around 16.3% of Nobitex’s total annual transaction volume.

Nobitex sent approximately $360 million more to CoinEx than it received. TRM Labs says this directional imbalance points to crypto being systematically moved out of Iran through CoinEx to access international liquidity.

Iran’s Entire Crypto Market Routes Through CoinEx

TRM Labs identified three patterns suggesting the CoinEx-Iran connection is not independent market behavior. 

First, every major Iranian domestic exchange routes 5 to 15% of its total volume through CoinEx. That consistent band across dozens of separate platforms is statistically unusual for a free market.

Second, the onboarding timeline follows a sequential pattern. Nobitex and Excoino began transacting with CoinEx in 2018. 

Wallex, Ramzinex, and Sarmayex followed in 2019. Bit Pin, Bit24, Aban Tether, and Ompfinex appeared between 2020 and 2021. TRM Labs says this resembles a client acquisition rollout rather than organic discovery.

Third, even small obscure Iranian platforms carry direct CoinEx exposure. Tabdeal, Sarafi.io, Jibitex, and Xchange98 are among those listed. 

TRM Labs also traced $67 million from the Central Bank of Iran into CoinEx addresses between June 2025 and June 2026. They were routed through a multi-chain laundering scheme using USDT-on-TRON, Ethereum bridges, Gnosis Safe contracts, and Aave protocol tokens.

ViaBTC, Terror Financing, and Post-Sanctions Activity

ViaBTC’s role goes beyond mining payouts. TRM Labs traced $154 million across 4.47 million transfers between ViaBTC and Nobitex-linked wallets. 

After Predatory Sparrow’s 2025 cyberattack on Nobitex disrupted operations, 117 previously dormant Bitcoin mining wallets activated and sent roughly $2.7 million to a new Nobitex hot wallet. ViaBTC was confirmed in those fund flows.

On the terror financing side, TRM Labs found $6 million across 186 transfers to IRGC-linked wallets, $374,000 tied to Palestinian Islamic Jihad, and direct interaction with Hezbollah-linked addresses. 

CoinEx’s share of illicit transaction volume sits at nearly 8%, against a 0.3% threshold considered typical for compliant exchanges.

Following OFAC sanctions against Nobitex, BitPin, Wallex, and Ramzinex on June 2, 2026, CoinEx cycled its hot wallets. Volumes between CoinEx and Iranian entities dropped below $150,000 after June 4. 

TRM Labs notes those exchanges hold accounts at CoinEx that are not visible on-chain and could still be transacting privately.

The post TRM Labs Traces $3.84B Between CoinEx and Sanctioned Iranian Entities appeared first on Live Bitcoin News.