Blockchain intelligence firm TRM Labs has mapped out how $3.84 billion in Iran-linked funds moved through CoinEx since 2019. The Wall Street Journal published the key findings on June 25 — and the picture is uncomfortable for the Seychelles-based exchange.
The largest share, roughly $2.7 billion, traced back to Nobitex, Iran's biggest domestic crypto platform, which the US Treasury sanctioned earlier this month. In a single peak year, the two exchanges moved $763 million between them. TRM Labs found that nearly every significant Iranian crypto platform routed 5-15% of its volume through CoinEx. The firm described this as "full top-to-bottom market saturation" — a pattern consistent with a deliberate, coordinated arrangement, not organic user behavior.
The flows extend beyond exchange-to-exchange traffic. CoinEx handled $67 million from Iran's Central Bank over the past year — a state institution under direct US sanctions. Wallets linked to the Islamic Revolutionary Guard Corps (IRGC) also appear in the transaction graph. Then there's the Bybit thread: a portion of the $1.5 billion stolen in the February 2025 Bybit hack, attributed to North Korea's Lazarus Group, passed through Iranian intermediary wallets before landing at CoinEx.
The exchange pushed back. CoinEx said Iran's own government blacklisted the platform in 2021 and that it deployed geo-fencing and upgraded its compliance program after OFAC designated four Iranian exchanges on June 2. "We firmly reject any narrative that conflates ordinary user activity with state-level sanctions evasion," the company wrote.
CoinEx is not yet on the OFAC list. But "designated international cryptocurrency gateway within Iran" is exactly the kind of language that tends to appear before formal designations. US regulators have spent 2026 systematically closing off Iran's crypto exits — Huione, Nobitex, three others. The next target is now in plain view.
