TRM Labs says CoinEx has been a major external route for Iran-linked crypto flows, with billions moving through the exchange and between CoinEx and Nobitex, Iran’s largest domestic exchange.
- $3.84 billion traced from wallets linked to more than 60 sanctioned Iranian entities through CoinEx since 2019
- $2.7 billion moved between CoinEx and Nobitex since November 2018
- TRM says the pattern looks coordinated, not like ordinary market behavior
- CoinEx denies that on-chain flows prove knowledge or participation
- The U.S. Treasury has already moved against Iranian crypto infrastructure, tightening the pressure
The core issue is simple enough: blockchain data is public, but proving intent is not. TRM Labs says the transaction patterns around CoinEx and Nobitex are so persistent and concentrated that they look less like random user activity and more like a sanctions-evasion pipeline. CoinEx says on-chain flows alone do not prove wrongdoing. Both things can be true at once.
TRM says it traced more than $3.84 billion in flows from wallets linked to sanctioned Iranian entities through CoinEx since 2019. The firm also says more than $2.7 billion has moved between CoinEx and Nobitex since November 2018, averaging roughly $1 million per day.
That matters because these are not the sort of figures you get from a few sloppy users and a compliance team that had a bad week. TRM’s view is that CoinEx has functioned as the primary external conduit for Iran-linked capital moving into global crypto markets, echoing what TRM’s earlier analysis argued. That is TRM’s interpretation, not a courtroom finding, but it is a serious one.
In plain English, a blockchain analytics firm can follow public wallet activity, cluster addresses, and map repeat counterparty behavior across exchanges. It cannot see inside someone’s head. But when the same exchange keeps showing up as the main outside route for sanctioned activity, the “nothing to see here” defense starts to sound thin.
TRM describes the CoinEx-Nobitex relationship as a “coordinated arrangement rather than organic adoption” and says the concentration of flow is “inconsistent with independent market behaviour.” That does not prove CoinEx knowingly helped sanctioned entities. It does, however, raise a very ugly compliance question: how does one exchange end up so deeply intertwined with a restricted domestic market for so long without someone noticing, or caring?
CoinEx pushed back on X with a familiar line:
“onchain fund flows do not demonstrate a platform’s knowledge of or participation in illicit activity.”
That is legally defensible as far as it goes. On-chain data can show movement, not intent. But a platform can still face sanctions exposure if authorities believe it facilitated prohibited transactions, even without a neat little memo that says, “yes, let’s process the bad stuff.” Regulators do not need a confession. They need enough evidence to show a pattern, a failure, or reckless blindness.
Why CoinEx and Nobitex matter
Nobitex is not some obscure local exchange with a tiny user base. According to a June 2 Chainalysis report, it handled about 50% of Iran’s crypto trading volume. Treasury’s later action said Nobitex processed more than 50% of all Iranian digital asset inflows in 2025. The wording is not identical, but the message is the same: Nobitex sits at the center of Iran’s crypto economy.
TRM says CoinEx became Nobitex’s largest external counterparty by 2024, nearly nine times larger than the next-biggest exchange. The firm also says major Iranian domestic exchanges route about 5% to 15% of their volume through CoinEx. Exact percentages matter less than the pattern. This was not a side door. It was a main one.
TRM also traced $154 million in ViaBTC exposure to Nobitex through mining payouts. ViaBTC is linked to CoinEx through the broader Viabtc Technology ecosystem, so the relationship here is wider than one exchange and one counterpart. TRM says ViaBTC later provided emergency liquidity to Nobitex after the June 18, 2025 Predatory Sparrow hack, which Treasury described as a $90 million breach.
Liquidity backstops are not trivial. They can help an exchange keep operating after a major hit. Or, to put it less politely, they can keep a damaged platform limping along long enough for everyone to ask uncomfortable questions about why it needed rescuing in the first place.
The enforcement picture is getting hotter
The U.S. Treasury already sanctioned four Iranian crypto exchanges on June 2, 2026, including Nobitex, as part of its Economic Fury campaign. Treasury Secretary Scott Bessent said the U.S. had seized $1 billion in crypto from Iranian exchanges and wallets since the start of the war.
CoinEx was not among the sanctioned entities.
That is the awkward part. TRM’s findings point to a huge, long-running flow network involving a major offshore exchange. Treasury’s action confirms that Washington sees Iranian crypto infrastructure as a sanctions and regime-finance problem. But the formal hammer has landed on Nobitex and other domestic exchanges, not on CoinEx, at least not yet.
Why the gap? Usually it comes down to evidence, jurisdiction, timing, and how much of a paper trail regulators believe they need before they move. Public blockchain data can be loud. Enforcement can still be painfully slow. That mismatch is part of why crypto compliance keeps getting embarrassed in public.
US sanctions Iran's largest crypto exchange over IRGC links showed just how seriously Washington is taking the issue, and CoinEx Named as Iran Largest Crypto Sanctions Exit Route by added more heat around CoinEx’s role in the flow network.
TRM also says CoinEx’s share of illicit transaction volume is nearly 8%, compared with a 0.3% threshold typical of compliant exchanges. That is a huge difference. To be precise, 8% versus 0.3% works out to roughly 27 times higher. The math is ugly, but it should still be handled carefully: this is a comparison against a compliance benchmark, not standalone proof of criminal conduct.
Still, a platform showing that kind of gap against the norm is not exactly collecting gold stars from the sanctions department.
What TRM’s data does, and does not, prove
TRM’s case is strongest on behavior. It says the CoinEx-Nobitex pattern is large, persistent, and unusually concentrated. It also says the relationship expanded over time, beginning around 2018, surging in 2020 and 2021, and then rebounding in 2024 and 2025 after a temporary slowdown.
That kind of repeat pattern is hard to hand-wave away as a one-off compliance miss. Markets fluctuate. A pipeline that keeps re-forming around the same counterparties over several years is something else.
What the data does not do is prove who knew what, when. That distinction matters. It is the difference between “suspicious and highly concerning” and “proven in court.” Crypto journalism gets sloppy when it collapses those two things into one blob of certainty. No need for that here.
TRM also notes that CoinEx has faced regulatory trouble in multiple jurisdictions, including scrutiny in the U.S., Europe, Canada, Germany, Lithuania, and Thailand. That history does not prove sanctions evasion. It does, however, weaken any “we were just a clean, innocent marketplace” routine. If a platform repeatedly runs into compliance trouble, the benefit of the doubt gets thinner.
For the broader intelligence and compliance picture, firms like TRM’s agents and intelligence to fight crime show why blockchain analytics has become central to sanctions enforcement, not just a nerdy side hobby for chain sleuths.
Why the broader market should care
This is not only a CoinEx problem or an Iran problem. It is a live demonstration of how centralized exchanges can become choke points for sanctions, capital controls, and illicit finance. Crypto’s open rails are a feature, not a bug. They help people move value where banks won’t. They also help bad actors move value where banks won’t.
That is not an argument against Bitcoin or decentralized systems. It is an argument against pretending that centralized exchanges can shrug off responsibility while serving as major gateways to restricted markets. Freedom without accountability gets abused fast. Compliance theater won’t save anyone either.
Chainalysis has added more weight to the broader picture, saying Iran’s crypto ecosystem reached over $7.78 billion in 2025 and that addresses associated with the IRGC accounted for over 50% of the total value received by the Iranian crypto ecosystem in Q4 2025. That points to a system that remains deeply entangled with sanctioned and state-linked actors, not a harmless retail market accidentally caught in the crossfire. Chainalysis also detailed the pressure in OFAC Sanctions Major Iranian Cryptocurrency Exchanges for.
And there is a practical takeaway for exchanges everywhere: if your platform keeps touching sanctioned counterparties at scale, “we didn’t know” starts sounding less like a defense and more like a business model.
Key questions and takeaways
-
Did CoinEx knowingly facilitate sanctioned Iranian flows?
TRM’s data strongly suggests a persistent and unusually concentrated relationship, but on-chain tracing alone does not prove intent. CoinEx denies that transaction flows show knowledge or participation. -
Why is Nobitex so important?
Nobitex appears to sit at the center of Iran’s crypto market. Chainalysis and Treasury both describe it as handling more than half of Iran’s crypto inflows or trading activity. -
What makes the CoinEx-Nobitex link stand out?
The size, duration, and repetition of the flows are the red flags. TRM says more than $2.7 billion moved between them since 2018, averaging about $1 million per day. -
Why hasn’t CoinEx been sanctioned?
The most likely reasons are evidentiary threshold, jurisdiction, and enforcement timing. Public blockchain data can be compelling, but sanctions action usually needs a higher bar than “this looks bad.” -
Does this prove crypto is broken?
No. It proves that open financial rails are powerful, and that centralized exchange compliance can be exploited when oversight lags behind the data.
CoinEx may be right about one narrow point: blockchain flows do not, by themselves, prove knowledge. But if billions keep moving through the same route to the same sanctioned market, that distinction starts to look less like a shield and more like legal seasoning. The money trail is already on the table. The compliance world now has to explain why it took so long to care.
