Iran-linked wallets moved $3.84B through CoinEx

Blockchain analytics firm TRM Labs reported that wallets with identifiable links to sanctioned Iranian entities routed $3.84 billion through the cryptocurrency exchange CoinEx since 2019. Of that total, $2.7 billion moved between CoinEx and Iran’s domestic exchange Nobitex.

TRM found the flows between CoinEx and Nobitex averaged roughly $1 million per day from 2018 through the reporting period. By 2024, CoinEx was Nobitex’s largest external counterpart, with nearly nine times the volume of the next-largest exchange. TRM described that pattern as “inconsistent with independent market behaviour.”

The firm identified about 60 Iranian platforms connected to the traced funds. TRM reported that most major Iranian domestic exchanges routed about 5% to 10% of their trading volume through CoinEx and described that level as “coordinated arrangement rather than organic adoption.” The firm also estimated CoinEx’s share of traced illicit transaction volume at nearly 8%, compared with roughly 0.3% at exchanges it characterized as compliant.

CoinEx denied having any commercial relationship with the Iranian government or domestic Iranian exchanges and disputed TRM’s interpretation of on-chain data. In a statement posted on X, the exchange wrote, “onchain fund flows do not demonstrate a platform’s knowledge of or participation in illicit activity,” and reiterated it had no funding relationship with sanctioned parties.

TRM’s report included exposure linked to CoinEx-affiliated services. The mining pool ViaBTC accounted for about $154 million in traced exposure to Nobitex through mining payouts, and TRM reported that ViaBTC provided emergency liquidity to Nobitex after a $90 million hack in June 2025 known as Predatory Sparrow.

The report arrives as U.S. authorities increase enforcement targeting Iran’s crypto networks. The U.S. Treasury last month sanctioned four Iranian crypto exchanges under its “Economic Fury” campaign. Treasury Secretary Scott Bessent reported that officials had seized about $1 billion in crypto from Iranian exchanges and wallets since the start of the war, and other freezes of Iran-linked crypto assets have occurred in recent actions.

A separate blockchain forensics review previously found Nobitex handled roughly half of Iran’s crypto trading volume. Recent reporting has linked Nobitex to members of a family with ties to Iran’s Supreme Leader. The Office of Foreign Assets Control earlier this year sanctioned two U.K.-registered firms it said operated as front companies for the Islamic Revolutionary Guard Corps.

TRM used blockchain tracing techniques to map on-chain flows and link addresses to known platforms and entities. The firm’s findings add to a series of forensic reports and enforcement actions used by authorities to track and freeze crypto assets tied to sanctioned Iranian actors.