TL;DR:
- A complete of $3.84 billion in cryptocurrencies was traceably verified between CoinEx and entities beneath worldwide sanctions.
- The Nobitex platform consolidated itself as CoinEx‘s primary exterior counterparty, accounting for $2.7 billion of the overall quantity.
- Almost $67 million from the Central Financial institution of Iran was transferred to CoinEx addresses between June 2025 and June 2026.
The blockchain intelligence agency TRM Labs has detected an enormous worldwide illicit financing channel. By a publication, the group revealed that the cryptocurrency alternate CoinEx moved greater than $3.84 billion in digital asset flows linked to sanctioned Iranian platforms and entities. Preliminary investigations point out that the criminality spanned greater than seven years, connecting the corporate with greater than 60 crypto-asset platforms within the Persian nation.
TRM Labs traced greater than USD 3.84 billion in blockchain-verified flows between CoinEx and sanctioned Iranian entities over seven years — spanning 50+ platforms, with publicity to Nobitex, the IRGC, Palestinian Islamic Jihad, and Hezbollah.
CoinEx was Nobitex’s single largest… pic.twitter.com/Madjj13V9z
— TRM Labs (@trmlabs) June 26, 2026
The strategic position of Nobitex and worldwide liquidity
TRM Labs reported that the Nobitex alternate discovered its primary exterior monetary lifeline in CoinEx. The investigation specifies that roughly $2.7 billion moved between each companies since November 2018. This represents an working common of 1 million {dollars} each day throughout roughly 6.2 million particular person transfers on the blockchain.
In accordance with the institutional evaluation, by the tip of 2024, CoinEx surpassed Nobitex’s second-largest worldwide counterparty in quantity by almost 9 occasions. Data present that the annual quantity of mutual transactions reached $714 million in 2024, rising to $763 million in the course of the yr 2025. With these figures, CoinEx got here to manage 16.3% of all of Nobitex’s transactional motion.
The report highlights a crucial directional imbalance: Nobitex despatched about $360 million greater than it acquired from CoinEx. TRM Labs analysts state that this sample signifies a scientific outflow of capital from Iran to entry world market liquidity.
Routing networks and the Central Financial institution of Iran scheme
Researchers recognized three uncommon statistical behaviors that rule out unbiased market exercise. First, each main native platform in Iran consistently diverts between 5% and 15% of its total quantity to CoinEx. Likewise, the client onboarding timeline describes a sequential and coordinated company sample. The companies Nobitex and Excoino began their operations in 2018; Wallex, Ramzinex, and Sarmayex joined in 2019; whereas Bit Pin, Bit24, Aban Tether, and Ompfinex coupled between 2020 and 2021.
Added to this organized construction is using decentralized finance (DeFi) protocols for laundering state property. TRM Labs monitoring confirms that the Central Financial institution of Iran despatched $67 million to CoinEx deposit accounts between June 2025 and June 2026. Official documentation particulars that this cash was processed by way of a multi-chain scheme that employed the USDT stablecoin on the TRON community, Ethereum bridges, Gnosis Secure contracts, and Aave protocol tokens.
Implications for mining, financing of armed teams, and new sanctions
The CoinEx ecosystem exhibits direct ramifications with Bitcoin mining infrastructures and teams categorised as terrorists. ViaBTC, the mining pool affiliated with CoinEx, processed $154 million in 4.47 million transfers with wallets linked to Nobitex. The technical report exposes that, following a cyberattack suffered by Nobitex in 2025, a complete of 117 inactive mining wallets awoke to inject $2.7 million right into a scorching pockets of the corporate, validating ViaBTC’s participation within the course of.
By way of high-risk illicit financing, TRM Labs positioned $6 million directed to wallets linked to the Islamic Revolutionary Guard Corps (IRGC), together with $374,000 related to Palestinian Islamic Jihad and operational hyperlinks with Hezbollah. The intelligence agency highlights that the speed of illicit transactions inside CoinEx is shut to eight%, a extremely elevated indicator in comparison with the 0.3% averaged by exchanges that adjust to world rules.
Following sanctions imposed by OFAC in opposition to Nobitex, BitPin, Wallex, and Ramzinex on June 2, 2026, CoinEx proceeded to rotate its scorching wallets. As of June 4, 2026, seen on-chain flows dropped beneath $150,000. Nevertheless, TRM Labs projections warn that these entities maintain inner accounts at CoinEx that aren’t mirrored on the blockchain, enabling ongoing personal operations.
