TRM Labs traced $3.84B through CoinEx to sanctioned Iranian entities. The exchange says it will block new Iranian users. Here is what the data shows about the pipeline.
A blockchain forensics report from TRM Labs has traced over $3.84 billion in digital asset flows through CoinEx, the Seychelles-registered exchange founded by former Tencent engineer Haipo Yang, to Iranian entities under US sanctions. The Wall Street Journal first reported the findings.
The investigation links CoinEx to more than 60 Iranian crypto platforms, including Nobitex, Wallex, Ramzinex, and BitPin. Each of those exchanges routed between 5% and 10% of their aggregate volume through CoinEx. TRM analysts said that uniformity points to systematic coordination, not organic market selection.
CoinEx disputes the allegations. Yang said the exchange would stop accepting new Iranian registrations and phase out existing accounts, deploying IP-based blocking for Iranian addresses. The exchange maintains it did not knowingly process transactions for sanctioned organizations.
How the pipeline worked
Before Binance faced US regulatory action over Iranian customer servicing around 2022, it was the dominant international platform for Nobitex, Iran's largest exchange. CoinEx filled that gap by 2024. Throughout 2025, over $763 million moved between CoinEx and Nobitex alone – roughly nine times the volume of Nobitex's next-largest foreign exchange partner.
Since 2018, about $2.7 billion flowed between the two platforms across roughly 6.2 million transactions, averaging $1 million per day. Nobitex sent about $360 million more to CoinEx than it received, a net outflow pattern suggesting Iranian holders were accessing international liquidity and markets.
TRM also found about $67 million connected to Iran's Central Bank entered CoinEx between June 2025 and June 2026. Those funds moved through an obfuscation network using Tron and Ethereum, decentralized finance apps, and cross-chain bridges before hitting CoinEx wallets. The operation ran under the National Iranian Exchange's supervision through a program internally called "National–Tether." Intelligence suggests CoinEx supplied transaction fee funding that facilitated parts of that laundering infrastructure.
Earlier this year, investigators linked some of those Central Bank wallets to $1.5 billion in stolen assets from the Bybit exchange breach attributed to North Korean state-sponsored hackers.
Direct sanctions links
Blockchain evidence connects CoinEx to wallets controlled by the Islamic Revolutionary Guard Corps ($6 million in exposure), Palestinian Islamic Jihad ($374,000), and Hezbollah-affiliated addresses.
The US Treasury's Office of Foreign Assets Control sanctioned four Iranian exchanges on June 2, 2026: Nobitex, BitPin, Wallex, and Ramzinex. Those platforms handled roughly 78% of Iran's estimated $9.9 billion crypto trading volume in 2025.
After the designations, CoinEx rotated its hot wallet infrastructure. Transaction volumes between CoinEx and Iranian platforms collapsed to under $150,000.
What the transaction data shows
Pre-sanctions, average transaction sizes between CoinEx and Nobitex ran around $435. After geopolitical tensions escalated between the US, Iran, and Israel in late February 2026, average sizes jumped to $2,110. Larger consolidated transfers made up a growing share of activity.
TRM's analysis also identified CoinEx transactions with Wallex, Ramzinex, BitPin, and dozens of smaller Iranian operators. The uniformity across platforms – each routing 5-10% of volume through CoinEx – is the kind of pattern that forensic analysts flag as evidence of a coordinated arrangement rather than independent choices by individual traders.
What changes now
CoinEx's stated policy shift – halting new Iranian registrations and phasing out existing accounts – is the exchange's public response. Whether the IP blocking and wallet rotation hold up under scrutiny depends on how thoroughly CoinEx audits its remaining user base and whether sanctioned entities find workarounds.
The OFAC designations on the four Iranian exchanges create a separate compliance burden for any platform that continues to interact with them. For traders and institutions using CoinEx, the question is whether the exchange's compliance infrastructure can keep pace with the forensic tools that identified this flow in the first place.
TRM Labs' report is the kind of evidence that regulators and law enforcement use to build cases. The $3.84 billion figure is not a rounding error. It is a number that will follow CoinEx through every compliance audit, banking relationship, and licensing application from here forward.
For context on how stablecoin settlement and exchange infrastructure interact with sanctions risk, see Stablecore launches $25B credit union stablecoin pilot.
Prepared with AlphaScala research tooling and grounded in primary market data: live prices, fundamentals, SEC filings, hedge-fund holdings, and insider activity. Each story is checked against AlphaScala publishing rules before release. Educational coverage, not personalized advice.