Iran Moved $3.84B Through CoinEx. The Exchange Wasn't Sanctioned.

TRM Labs traced the flows to 60+ sanctioned entities. OFAC's June 2 action took out 78% of Iran's domestic crypto volume and left CoinEx untouched.

Key takeaways

• TRM Labs traced $3.84 billion in flows from approximately 60 sanctioned Iranian entities through CoinEx since 2019, with $2.7 billion routed specifically between CoinEx and Nobitex at roughly $1 million per day.
• By 2024, CoinEx was Nobitex's largest foreign counterpart, a position TRM Labs says reflects a pattern inconsistent with organic market adoption. CoinEx-affiliated mining pool ViaBTC added another $154 million in traced exposure through mining payouts.
• OFAC's June 2 "Economic Fury" sanctions neutralized four Iranian domestic exchanges but left CoinEx off the list. TRM Labs says the international gateway infrastructure enabling Iran's crypto ecosystem remains largely intact.

Blockchain analytics firm TRM Labs published a report on Wednesday, June 25, tracing $3.84 billion in flows from wallets linked to roughly 60 sanctioned Iranian entities through crypto exchange CoinEx since 2019. The Wall Street Journal first reported the findings the same day. CoinEx, incorporated in Seychelles and operating without US FinCEN registration, had by 2024 become Iran's primary international crypto exit ramp, a characterization TRM Labs says the data does not support as organic market behaviour.

The numbers are not subtle. Of the $3.84 billion total, $2.7 billion flowed specifically between CoinEx and Nobitex, Iran's largest domestic exchange, at an average of approximately $1 million per day. At its peak, that corridor hit $763 million in a single year. CoinEx's share of illicit transaction volume sits at roughly 8%, against the roughly 0.3% threshold found at compliant exchanges, a gap of more than 26x.

How the Gap Opened

The trajectory follows a familiar pattern. When Binance tightened compliance under US pressure, Iran's crypto volume didn't evaporate. It migrated to the next-weakest custodian. CoinEx stepped into that vacancy.

Most major Iranian domestic exchanges route 5% to 15% of their trading volume through CoinEx, a concentration TRM Labs says reflects a pattern inconsistent with organic adoption. The exchange's founder, Haipo Yang, acknowledged the exchange was widely used by Iranian users but denied any relationship with the Iranian government. Yang said CoinEx is blocking new signups from Iranian IP addresses.

CoinEx posted a denial on X stating it has never established any commercial relationships with Iranian exchanges or entities linked to the Iranian government. The exchange's position: on-chain fund flows do not demonstrate a platform's knowledge of or participation in illicit activity.

The exposure runs deeper than the exchange itself. CoinEx-affiliated mining pool ViaBTC is tied to $154 million in additional traced flows to Nobitex through mining payouts. ViaBTC also supplied emergency liquidity to Nobitex following Predatory Sparrow's approximately $90 million hack of the Iranian exchange in June 2025. TRM also traced roughly $67 million processed by CoinEx from the Central Bank of Iran through a multi-chain scheme between June 2025 and June 2026, with that trail connecting to funds from the approximately $1.5 billion Bybit hack attributed to North Korea in February 2025. Nobitex itself was linked in May 2026 to members of a family connected by marriage to Supreme Leader Ali Khamenei.

The Enforcement Gap

Three weeks before TRM published its report, OFAC designated four Iranian crypto exchanges as part of the "Economic Fury" campaign: Nobitex, Bitpin, Wallex, and Ramzinex. Per the Treasury press release, the action targeted Iran's domestic crypto infrastructure. Treasury Secretary Scott Bessent stated the Treasury had seized approximately $1 billion in Iranian crypto since the start of the war. The June 2 press release also warned explicitly about crypto being used for Strait of Hormuz toll payments to Iran.

CoinEx was not on the list.

TRM's global head of policy, Ari Redbord, put it directly: "OFAC's June 2 designations took out 78% of Iran's domestic crypto volume in a single action, but the international infrastructure that enabled that ecosystem remains largely intact. Enforcement and policy now need to grapple with the international gateways, not just the domestic exchanges."

The 23-day gap between the June 2 sanctions and the TRM report raises an obvious question. The analytical work underlying this report was not assembled overnight. Whether CoinEx was deliberately left off the June 2 list as leverage, is under active negotiation, or was simply deprioritized is not answered in the public record.

The custodial chokepoint problem is structural, not incidental. This is the permissionless money argument in its starkest form: every compliance intermediary is a single point of failure that a determined state actor will find and exploit whenever enforcement clears a lane. The compliance-vacuum whack-a-mole continues as long as custodians are the gatekeeping layer.

The ViaBTC exposure is also underreported. Yang runs both CoinEx and ViaBTC, one of the world's largest mining pools. If scrutiny extends to ViaBTC, this becomes a hash-rate story, not just an exchange story. Mining pool sanctions would be a novel and significant enforcement precedent with implications well beyond Iran.

What Comes Next

TRM's report lands with CoinEx still operational and unsanctioned. The falsifiable test here is straightforward: if OFAC designates CoinEx and the roughly $1 million-per-day flow simply migrates to the next-weakest custodian inside of 90 days, the enforcement-through-gatekeepers thesis fails on its own terms. Watch for whether the regulatory response targets the exchange layer again or shifts toward wallet-level controls, where the policy framing hardens and the stakes for self-custody become considerably higher.

Update, July 14, 2026

Treasury Secretary Scott Bessent posted directly to X today that OFAC sanctioned multiple wallets tied to the Central Bank of Iran, resulting in the freeze of over $130 million in digital assets. The action is a discrete enforcement step, separate from the April 24 freeze of $344 million across two Tron addresses that pushed Operation Economic Fury's cumulative seizure total toward $1 billion.

The mechanics are consistent with the enforcement pattern TRM Labs flagged in its report. Treasury is now reaching into the reserve layer, not only the intermediary layer, meaning OFAC is no longer content to designate exchanges and intermediaries while leaving sovereign-level wallets intact. OFAC blacklisted cryptocurrency wallets directly tied to Iran's Central Bank, with connections also highlighted to the IRGC-Qods Force and Hezbollah, triggering an immediate freeze in the prior action; today's freeze follows the same template applied to a fresh set of addresses.

The wider campaign context: before the heightened enforcement kicked in, Iran was moving around $400 to $500 million monthly through cryptocurrency channels. Each successive freeze compresses that runway further. CoinEx and the international gateway infrastructure TRM identified remain outside the designation perimeter, which means the chokepoint the original report described, Iran's ability to move value through offshore custodians, is still operative even as Treasury systematically dismantles the sovereign reserve layer underneath it.

Update, July 16, 2026

The mechanics behind the July 14 freeze are now clearer. The four newly designated wallets had received $165 million in stablecoins in total, with $131 million of that balance immediately frozen by Tether the moment OFAC updated the Central Bank of Iran designation. On-chain analyst Specter traced the links to both the IRGC and Iran's central bank before Bessent's announcement, with his analysis showing most funds had previously been withdrawn from DTC Pay and Bitso before landing in the sanctioned wallets.

Separately, Treasury sanctioned seven individuals linked to a global weapons procurement network for the IRGC, including a Tehran-based drone parts supplier, a Nigerian intermediary, and Russian nationals tied to a Moscow aviation company.

The cumulative picture now stands at roughly $475 million. Tether has frozen almost $475 million from wallet addresses identified by OFAC as belonging to the Central Bank of Iran, rendering nearly half a billion dollars inaccessible to the Iranian regime. What makes this enforcement architecture worth understanding is how it actually works. The freeze does not remove transactions from Tron or rewrite the blockchain. It changes what Tether's token contract will permit. An affected wallet may continue to display millions of dollars in USDT, but the holder cannot move or redeem the tokens while the address remains blocked. Iran built a dollar-denominated crypto stack specifically to route around the traditional banking system, and the dollar-denominated part of that stack has a kill switch the U.S. government can flip.

Bitcoin operates differently. No company controls its protocol, and there is no blacklist function built into the network. Governments can sanction specific Bitcoin addresses or pursue funds held on custodial exchanges through legal channels, but they cannot unilaterally disable Bitcoin transactions the way Tether disabled the USDT in these wallets. That distinction is central to understanding how sanctions enforcement in crypto actually works: authorities are largely targeting centralized chokepoints rather than decentralized assets themselves. The Iran case is not a story about crypto failing as a sanctions workaround. It is a story about stablecoins failing as a sanctions workaround. Those are not the same thing.

Sources

• TRM Labs: How CoinEx Became Iran's Primary Gateway to Global Cryptocurrency Markets
• U.S. Treasury / OFAC: Economic Fury, June 2, 2026 press release
• First reported by The Wall Street Journal (June 25, 2026)