TRM says Iran-linked wallets moved over $3.84 billion through CoinEx since 2019

Wallets tied to sanctioned Iranian entities have moved over $3.84 billion through CoinEx since 2019, according to TRM Labs. For PSPs and exchanges, the useful bit is not the headline number itself but the pattern: repeated flows between a large domestic Iranian venue and an external counterparty can look less like retail churn and more like a sanctions-evasion rail.

1. TRM Labs said about 60 Iranian platforms were tied to the funds, with $2.7 billion flowing between CoinEx and Nobitex, Iran’s largest domestic cryptocurrency exchange, at an average rate of about $1 million per day since 2018.
2. By 2024, CoinEx was Nobitex’s largest external counterpart, nearly nine times larger than the next-largest exchange. TRM Labs said that pattern was “inconsistent with independent market behaviour.”
3. TRM Labs also said most of the major Iranian domestic exchanges route about 5% to 10% of their trading volume through CoinEx, which it described as a “coordinated arrangement rather than organic adoption.” The report put CoinEx’s share of illicit transaction volume at nearly 8%, above the 0.3% threshold found at other compliant exchanges.
4. CoinEx denied having any commercial relationship with the Iranian government or domestic Iranian exchanges and said it has never provided funding channels to sanctioned parties. The exchange also disputed TRM Labs’ reading of blockchain data, saying onchain fund flows do not prove knowledge of or participation in illicit activity.
5. The report came three weeks after the US Treasury sanctioned four Iranian crypto exchanges as part of its “Economic Fury” campaign. Days before those sanctions, Treasury Secretary Scott Bessent said the Treasury had seized $1 billion in crypto from Iranian exchanges and wallets since the start of the war.

TRM Labs also said CoinEx-affiliated mining pool ViaBTC accounted for another $154 million in traced exposure to Nobitex through mining payouts and supplied emergency liquidity to Nobitex after Predatory Sparrow’s $90 million hack in June 2025. In practice, that is the sort of infrastructure overlap compliance teams care about: exchange, mining pool, and liquidity support all showing up in the same sanctions conversation.