TL;DR:
- A total of $3.84 billion in cryptocurrencies was traceably verified between CoinEx and entities under international sanctions.
- The Nobitex platform consolidated itself as CoinEx‘s main external counterparty, accounting for $2.7 billion of the total volume.
- Nearly $67 million from the Central Bank of Iran was transferred to CoinEx addresses between June 2025 and June 2026.
The blockchain intelligence firm TRM Labs has detected a massive international illicit financing channel. Through a publication, the organization revealed that the cryptocurrency exchange CoinEx moved more than $3.84 billion in digital asset flows linked to sanctioned Iranian platforms and entities. Initial investigations indicate that the illegal activity spanned more than seven years, connecting the company with more than 60 crypto-asset platforms in the Persian country.
TRM Labs traced more than USD 3.84 billion in blockchain-verified flows between CoinEx and sanctioned Iranian entities over seven years — spanning 50+ platforms, with exposure to Nobitex, the IRGC, Palestinian Islamic Jihad, and Hezbollah.
CoinEx was Nobitex's single largest… pic.twitter.com/Madjj13V9z
— TRM Labs (@trmlabs) June 26, 2026
The strategic role of Nobitex and international liquidityÂ
TRM Labs reported that the Nobitex exchange found its main external financial lifeline in CoinEx. The investigation specifies that approximately $2.7 billion moved between both firms since November 2018. This represents an operating average of one million dollars daily across approximately 6.2 million individual transfers on the blockchain.
According to the institutional analysis, by the end of 2024, CoinEx surpassed Nobitex’s second-largest international counterparty in volume by nearly nine times. Records show that the annual volume of mutual transactions reached $714 million in 2024, rising to $763 million during the year 2025. With these figures, CoinEx came to control 16.3% of all of Nobitex’s transactional movement.
The report highlights a critical directional imbalance: Nobitex sent about $360 million more than it received from CoinEx. TRM Labs analysts state that this pattern indicates a systematic outflow of capital from Iran to access global market liquidity.
Routing networks and the Central Bank of Iran schemeÂ
Researchers identified three unusual statistical behaviors that rule out independent market activity. First, every major local platform in Iran constantly diverts between 5% and 15% of its overall volume to CoinEx. Likewise, the customer onboarding timeline describes a sequential and coordinated corporate pattern. The firms Nobitex and Excoino started their operations in 2018; Wallex, Ramzinex, and Sarmayex joined in 2019; while Bit Pin, Bit24, Aban Tether, and Ompfinex coupled between 2020 and 2021.
Added to this organized structure is the use of decentralized finance (DeFi) protocols for laundering state assets. TRM Labs tracking confirms that the Central Bank of Iran sent $67 million to CoinEx deposit accounts between June 2025 and June 2026. Official documentation details that this money was processed through a multi-chain scheme that employed the USDT stablecoin on the TRON network, Ethereum bridges, Gnosis Safe contracts, and Aave protocol tokens.
Implications for mining, financing of armed groups, and new sanctionsÂ
The CoinEx ecosystem shows direct ramifications with Bitcoin mining infrastructures and groups classified as terrorists. ViaBTC, the mining pool affiliated with CoinEx, processed $154 million in 4.47 million transfers with wallets linked to Nobitex. The technical report exposes that, following a cyberattack suffered by Nobitex in 2025, a total of 117 inactive mining wallets awoke to inject $2.7 million into a hot wallet of the company, validating ViaBTC’s participation in the process.
In terms of high-risk illicit financing, TRM Labs located $6 million directed to wallets linked to the Islamic Revolutionary Guard Corps (IRGC), along with $374,000 associated with Palestinian Islamic Jihad and operational links with Hezbollah. The intelligence firm highlights that the rate of illicit transactions within CoinEx is close to 8%, a highly elevated indicator compared to the 0.3% averaged by exchanges that comply with global regulations.
Following sanctions imposed by OFAC against Nobitex, BitPin, Wallex, and Ramzinex on June 2, 2026, CoinEx proceeded to rotate its hot wallets. As of June 4, 2026, visible on-chain flows dropped below $150,000. However, TRM Labs projections warn that these entities hold internal accounts at CoinEx that are not reflected on the blockchain, enabling ongoing private operations.
