CoinEx Faces Scrutiny Over $3.84 Billion in Iran-Linked Crypto Flows

TRM Labs Report Highlights Major Flows

According to blockchain intelligence from TRM Labs, wallets linked to around 60 sanctioned Iranian entities have moved more than $3.84 billion through the cryptocurrency exchange CoinEx since 2019. Of this amount, approximately $2.7 billion flowed between CoinEx and Nobitex, Iran's largest domestic crypto platform, at an average of about $1 million per day since 2018.

TRM Labs noted that CoinEx became Nobitex's largest external trading partner by 2024, with volumes nearly nine times higher than the next largest counterpart. The firm described this pattern as inconsistent with typical independent market behavior, suggesting a more structured relationship. Major Iranian exchanges reportedly routed 5% to 10% of their trading volume through CoinEx, pointing to what TRM called a coordinated arrangement.

Links to Sanctioned Entities and Broader Concerns

The report also identified CoinEx's exposure to entities tied to the Islamic Revolutionary Guard Corps (IRGC) and other sanctioned groups. TRM Labs traced around $67 million in funds linked to Iran's Central Bank through CoinEx as part of multi-chain activities. Additional connections were noted to terrorist-linked organizations and sanctioned Russian entities.

Investigators linked some flows to assets from the Bybit hack, which authorities attributed to North Korean actors. Funds reportedly moved through complex wallet networks and DeFi protocols before reaching CoinEx. This comes amid U.S. Treasury actions, including the "Economic Fury" campaign that sanctioned several Iranian exchanges like Nobitex, and seizures of nearly $1 billion in related crypto assets.

CoinEx's Response and Compliance Measures

CoinEx has firmly denied the allegations of serving as a gateway for sanctioned activities. The exchange stated it has never established commercial relationships with Iranian government entities, domestic exchanges, or sanctioned parties. It emphasized that its domain has been blocked in Iran since 2021 and that it maintains no operations there.

In its official statement, CoinEx argued that on-chain fund flows do not prove platform knowledge or participation in illicit activity. The exchange noted variations in interpretations by different analytics firms and disputed how aggregate two-way flows were presented. It confirmed helping Bybit freeze assets after the hack and committed to an internal review of the mentioned transactions.

Regulatory and Industry Implications

The developments occur as global regulators increase focus on crypto's role in sanctions evasion. U.S. authorities have frozen significant sums, including $344 million in USDT linked to IRGC. The case underscores challenges in distinguishing organic user activity from coordinated efforts, as well as the limitations of on-chain attribution.