K

KeyAudit

· ·exchange-hack·regulatory·infrastructure·private-key-leak

TRM Tracks $3.84B in Crypto Flows Between CoinEx and Sanctioned Iranian Entities Over 7 Years

TRM Labs has traced over $3.84 billion in blockchain-verified flows between global cryptocurrency exchange CoinEx and sanctioned Iranian entities over more than seven years, involving over 60 Iranian platforms. The most significant connection is with Nobitex, Iran's largest domestic exchange, with $2.7 billion moved between them since 2018—an average of $1 million per day. By 2024, CoinEx was Nobitex's single largest external counterparty, nearly nine times larger than the next named exchange. Every major Iranian domestic exchange routes approximately 5–10% of its total volume through CoinEx, indicating a coordinated arrangement rather than organic adoption. CoinEx's affiliated mining pool, ViaBTC, adds $154 million in exposure to Nobitex through mining payouts. CoinEx also has direct on-chain exposure to the IRGC ($6 million), Palestinian Islamic Jihad ($374,000), and Hezbollah. In June 2026, OFAC sanctioned four Iranian exchanges (Nobitex, BitPin, Wallex, Ramzinex), after which volumes between CoinEx and these exchanges dropped below $150,000, though new evasion infrastructure may have been established. Additionally, $67 million from the Central Bank of Iran flowed into CoinEx addresses as part of a structured multi-chain laundering scheme between June 2025 and June 2026.

Key facts

  • $3.84B in blockchain-verified flows between CoinEx and 60+ Iranian platforms over 7+ years.
  • $2.7B moved between CoinEx and Nobitex since 2018, averaging $1M/day.
  • CoinEx was Nobitex's largest external counterparty by 9x in 2024.
  • CoinEx's ViaBTC mining pool sent $154M to Nobitex-linked wallets.
  • Central Bank of Iran sent $67M to CoinEx via multi-chain laundering scheme.

← Back to list