CoinEx and Iran's $3.84B Crypto Flows: What TRM Labs Found

On June 25, blockchain analytics firm TRM Labs published a report claiming that Iran-linked wallets moved more than $3.84 billion through the crypto exchange CoinEx since 2019. The report landed just weeks after the US Treasury sanctioned four of Iran's largest crypto exchanges — Nobitex, Wallex, Bitpin and Ramzinex — in early June. CoinEx denies the allegations.

How TRM Labs says the scheme worked

According to TRM Labs, CoinEx had direct transactional ties to more than 60 Iranian crypto platforms, with local Iranian exchanges routing 5–10% of their volume through it — a pattern the firm says points to a coordinated arrangement rather than organic user activity. CoinEx alone processed roughly $2.7 billion in transfers with Nobitex, Iran's largest exchange. A separate, more targeted scheme was also traced: between June 2025 and June 2026, $67 million flowed from Iran's Central Bank into CoinEx addresses through a mechanism Iranian operators internally called "National–Tether," run through the National Iranian Exchange (NIE). Transfers exceeding $5 million in USDT on TRON were split into smaller increments, bridged to Ethereum, converted into Aave protocol tokens through Gnosis Safe multisig wallets, run through a second round of bridging, and only then cashed out via CoinEx.

TRM Labs put it directly in an official statement: "Since 2019, Iran-linked wallets have moved over USD 3.84 billion in transactions through crypto exchange CoinEx, according to TRM Labs research cited in a new @WSJ investigation. By 2024, CoinEx had replaced Binance as the largest foreign counterparty to Iran's Nobitex exchange."

What CoinEx says

CoinEx rejected the findings, saying it has "never established any commercial relationship with Iranian government-related entities, Iranian domestic exchanges" and provided no "active assistance to Iranian government agencies, Revolutionary Guard-related entities, or other sanctioned parties." The exchange also noted its domain has been blocked inside Iran since 2021.

"Blockchain transactions are open, cross-platform, and traceable by nature. The fact that funds have passed through a platform onchain does not mean that the platform was aware of, supported, or participated in the related fund activity," CoinEx said.

Why the timing matters

Context matters here: TRM Labs found that CoinEx's direct counterparties included wallets linked to the Islamic Revolutionary Guard Corps (roughly $6 million) and to Palestinian Islamic Jihad (about $374,000) — meaning this isn't just about routing around sanctions, but potentially financing entities designated as terrorist organizations. CoinEx itself, registered in the Seychelles, was not among the entities the US Treasury sanctioned, unlike Nobitex, Wallex, Bitpin and Ramzinex, which were hit weeks earlier.

Takeaway

The gap between the two sides isn't really about the facts — it's about how to read them. CoinEx is narrowly correct that blockchains are open and that funds passing through a platform don't by themselves prove knowledge. But TRM Labs' level of detail — structured transfers traced specifically to Iran's Central Bank, a multi-step, multi-chain route through Aave and Gnosis Safe, and 5–10% of local exchange volume running through one partner — describes built infrastructure, not random traffic. For CoinEx, that creates a real risk of becoming the US Treasury's next sanctions target. For the industry, it shows that evidence in crypto sanctions-evasion investigations is getting a lot more granular than simple aggregate transfer totals.