Key Takeaways
- • CoinEx processed $3.84 billion in flows linked to sanctioned Iranian entities since 2019, with $2.7 billion routed through Iran's largest domestic exchange, Nobitex, according to blockchain intelligence firm TRM Labs.
- • Every major Iranian cryptocurrency exchange routes 5–15% of transaction volume through CoinEx, suggesting a coordinated arrangement rather than isolated activity, with the platform functioning as Iran's primary gateway to global cryptocurrency markets.
- • Nobitex transferred approximately $360 million more to CoinEx than it received in return, indicating systematic outbound cryptocurrency routing from Iran to access international liquidity and evade sanctions pressure.
- • CoinEx's affiliated mining pool ViaBTC traced over $154 million in mining payouts linked to Nobitex and provided emergency liquidity following a 2025 cyberattack, deepening the operational integration between the entities.
- • Between June 2025 and June 2026, CoinEx processed approximately $67 million in funds from Iran's Central Bank as part of a multi-chain money laundering scheme; the platform also facilitated transactions with terrorist organizations including the Islamic Revolutionary Guard Corps (IRGC) and sanctioned Russian entities.
Summary
Seychelles-based cryptocurrency exchange CoinEx has emerged as a critical financial conduit for sanctioned Iranian entities, processing $3.84 billion in Iran-linked flows since 2019, according to research published by blockchain intelligence firm TRM Labs on June 25, 2026. The scale and structure of these transactions point to CoinEx functioning as a deliberate international cryptocurrency gateway for Iran's heavily sanctioned economy, rather than incidental market activity.
The routing pattern reveals systematic coordination across Iran's domestic crypto ecosystem. Nobitex, Iran's largest digital asset exchange, accounted for the largest share at $2.7 billion in flows through CoinEx. TRM Labs identified a critical imbalance: Nobitex transferred approximately $360 million more to CoinEx than it received in return, indicating that cryptocurrency is being systematically routed outward from Iran in search of international liquidity and global market access. This unidirectional flow pattern is consistent with sanctions evasion strategies employed by a heavily restricted economy seeking offshore liquidity.
The breadth of CoinEx's Iranian exposure extends beyond Nobitex. According to TRM Labs, every major Iranian cryptocurrency exchange maintains direct connections to CoinEx, routing between 5% and 15% of total transaction volume through the platform. This consistent baseline across multiple Iranian exchanges—combined with exposure from smaller and more obscure platforms—suggests either a coordinated arrangement or active market solicitation by CoinEx. TRM Labs characterized this "full top-to-bottom market saturation" as evidence that CoinEx functions as either a designated gateway within Iran's financial architecture or actively solicits the Iranian market across all operational tiers.
CoinEx's operational footprint extends through affiliated entities. ViaBTC, CoinEx's mining pool, traced over $154 million in mining payouts linked to Nobitex and notably supplied emergency liquidity to Nobitex following a significant 2025 cyberattack. Additionally, between June 2025 and June 2026, CoinEx processed approximately $67 million in direct transactions from Iran's Central Bank as part of a multi-chain money laundering scheme. Beyond Iranian activity, CoinEx has facilitated transactions with sanctioned entities including the Islamic Revolutionary Guard Corps (IRGC) and Russian sanctioned organizations, broadening the compliance risk profile significantly.
The routing pattern reveals systematic coordination across Iran's domestic crypto ecosystem. Nobitex, Iran's largest digital asset exchange, accounted for the largest share at $2.7 billion in flows through CoinEx. TRM Labs identified a critical imbalance: Nobitex transferred approximately $360 million more to CoinEx than it received in return, indicating that cryptocurrency is being systematically routed outward from Iran in search of international liquidity and global market access. This unidirectional flow pattern is consistent with sanctions evasion strategies employed by a heavily restricted economy seeking offshore liquidity.
The breadth of CoinEx's Iranian exposure extends beyond Nobitex. According to TRM Labs, every major Iranian cryptocurrency exchange maintains direct connections to CoinEx, routing between 5% and 15% of total transaction volume through the platform. This consistent baseline across multiple Iranian exchanges—combined with exposure from smaller and more obscure platforms—suggests either a coordinated arrangement or active market solicitation by CoinEx. TRM Labs characterized this "full top-to-bottom market saturation" as evidence that CoinEx functions as either a designated gateway within Iran's financial architecture or actively solicits the Iranian market across all operational tiers.
CoinEx's operational footprint extends through affiliated entities. ViaBTC, CoinEx's mining pool, traced over $154 million in mining payouts linked to Nobitex and notably supplied emergency liquidity to Nobitex following a significant 2025 cyberattack. Additionally, between June 2025 and June 2026, CoinEx processed approximately $67 million in direct transactions from Iran's Central Bank as part of a multi-chain money laundering scheme. Beyond Iranian activity, CoinEx has facilitated transactions with sanctioned entities including the Islamic Revolutionary Guard Corps (IRGC) and Russian sanctioned organizations, broadening the compliance risk profile significantly.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.