CoinEx processed $3.8 billion in Iran-linked funds, acting as crypto gateway: TRM Labs

Global cryptocurrency exchange CoinEx has processed over $3.84 billion in flows linked to sanctioned Iranian entities since 2019, TRM Labs said.

According to a Wednesday blog post from the blockchain intelligence firm, the Seychelles-based crypto exchange has facilitated transactions tied to more than 60 Iranian entities. The largest share — about $2.7 billion — was linked to Iranian crypto exchange Nobitex.

"Nobitex has sent approximately $360 million more to CoinEx than it has received in return, indicating that cryptocurrency is systematically routed outward from Iran through CoinEx in search of international liquidity and global markets — crucial for a heavily sanctioned economy," TRM wrote.

TRM said CoinEx's connection to Nobitex is not an isolated case. According to the firm, every major Iranian exchange routes roughly 5% to 15% of its total transaction volume through CoinEx. This consistent baseline points to a coordinated arrangement, TRM said. Smaller, more obscure platforms also reportedly maintain direct exposure to CoinEx.

"Full top-to-bottom market saturation of this kind suggests CoinEx is either functioning as a designated international cryptocurrency gateway within Iran or is actively soliciting the Iranian market across every tier," TRM said.

CoinEx's affiliated mining pool, ViaBTC, reportedly added another layer of exposure, with TRM tracing more than $154 million in mining payouts linked to Nobitex. ViaBTC also supplied emergency liquidity to Nobitex following a major 2025 cyberattack, according to the report.

Notably, CoinEx processed around $67 million in funds from the Central Bank of Iran as part of a multi-chain laundering scheme between June 2025 and June 2026. Outside of its links with Iranian entities, CoinEx has interacted with terrorist organizations, including the Islamic Revolutionary Guard Corps (IRGC), and sanctioned Russian entities.

The Wall Street Journal also reported earlier that a portion of the stolen funds from Bybit's $1.5 billion hack, attributed to North Korea, had flowed into CoinEx via Iranian wallets.

Sanctions

Established in 2017, CoinEx has faced several regulatory hurdles, including a lawsuit by the New York Attorney General, a German investigation, and a ban in Thailand. Additionally, the platform is no longer registered with the U.S. FinCEN or Lithuania's financial crimes unit, according to TRM Labs.

Earlier this month, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) designated four major Iranian exchanges, including Nobitex, for facilitating sanctions evasion, terrorist financing, and illicit transactions. However, CoinEx was not included in those designations.

"OFAC's June 2 designations took out 78% of Iran's domestic crypto volume in a single action — but the international infrastructure that enabled that ecosystem remains largely intact. Enforcement and policy now need to grapple with the international gateways, not just the domestic exchanges," said Ari Redbord, global head of policy at TRM Labs.

CoinEx responds

On Thursday, CoinEx published a post on X pushing back on the TRM Labs report. The exchange wrote that it has never established any commercial relationships with the Iranian exchanges or entities linked to the Iranian government. It added that it has never provided funding channels or any active assistance to Iranian government agencies, Islamic Revolutionary Guard-related entities, or other sanctioned parties.

CoinEx further stated that it was blacklisted by the Iranian government in 2021 and has never established an operating entity in the country, arguing that there is no "realistic basis" to serve as an official funding channel for Iran.

"We firmly reject any narrative that conflates ordinary user activity with state-level sanctions evasion, and any inference that equates on-chain fund flows with platform knowledge of, support for, or participation in illicit activity," CoinEx wrote in the X post. "We do not provide services to any sanctioned entity or individual, and have never knowingly provided any form of facilitation to any party after it was designated."

The crypto exchange also argued that blockchain data showing funds passing through the exchange does not mean that the platform supported the activity, and that data from a single platform should not be considered as definitive.

Following the June 2 sanctions on Iranian exchanges, CoinEx said it has initiated a comprehensive review and exit process for all Iran-related risk exposure and placed "comprehensive geo-fencing and access restrictions" for Iranian regions. Accounts and assets of any identified sanctioned entity or individual will be restricted or frozen, CoinEx wrote.

Story updated with the latest statement from CoinEx.