TRM Labs traced the flows to 60+ sanctioned entities. OFAC's June 2 action took out 78% of Iran's domestic crypto volume and left CoinEx untouched.
Key takeaways
Blockchain analytics firm TRM Labs published a report on Wednesday, June 25, tracing $3.84 billion in flows from wallets linked to roughly 60 sanctioned Iranian entities through crypto exchange CoinEx since 2019. The Wall Street Journal first reported the findings the same day. CoinEx, incorporated in Seychelles and operating without US FinCEN registration, had by 2024 become Iran's primary international crypto exit ramp, a characterization TRM Labs says the data does not support as organic market behaviour.
The numbers are not subtle. Of the $3.84 billion total, $2.7 billion flowed specifically between CoinEx and Nobitex, Iran's largest domestic exchange, at an average of approximately $1 million per day. At its peak, that corridor hit $763 million in a single year. CoinEx's share of illicit transaction volume sits at roughly 8%, against the roughly 0.3% threshold found at compliant exchanges, a gap of more than 26x.
The trajectory follows a familiar pattern. When Binance tightened compliance under US pressure, Iran's crypto volume didn't evaporate. It migrated to the next-weakest custodian. CoinEx stepped into that vacancy.
Most major Iranian domestic exchanges route 5% to 15% of their trading volume through CoinEx, a concentration TRM Labs says reflects a pattern inconsistent with organic adoption. The exchange's founder, Haipo Yang, acknowledged the exchange was widely used by Iranian users but denied any relationship with the Iranian government. Yang said CoinEx is blocking new signups from Iranian IP addresses.
CoinEx posted a denial on X stating it has never established any commercial relationships with Iranian exchanges or entities linked to the Iranian government. The exchange's position: on-chain fund flows do not demonstrate a platform's knowledge of or participation in illicit activity.
The exposure runs deeper than the exchange itself. CoinEx-affiliated mining pool ViaBTC is tied to $154 million in additional traced flows to Nobitex through mining payouts. ViaBTC also supplied emergency liquidity to Nobitex following Predatory Sparrow's approximately $90 million hack of the Iranian exchange in June 2025. TRM also traced roughly $67 million processed by CoinEx from the Central Bank of Iran through a multi-chain scheme between June 2025 and June 2026, with that trail connecting to funds from the approximately $1.5 billion Bybit hack attributed to North Korea in February 2025. Nobitex itself was linked in May 2026 to members of a family connected by marriage to Supreme Leader Ali Khamenei.
Three weeks before TRM published its report, OFAC designated four Iranian crypto exchanges as part of the "Economic Fury" campaign: Nobitex, Bitpin, Wallex, and Ramzinex. Per the Treasury press release, the action targeted Iran's domestic crypto infrastructure. Treasury Secretary Scott Bessent stated the Treasury had seized approximately $1 billion in Iranian crypto since the start of the war. The June 2 press release also warned explicitly about crypto being used for Strait of Hormuz toll payments to Iran.
CoinEx was not on the list.
TRM's global head of policy, Ari Redbord, put it directly: "OFAC's June 2 designations took out 78% of Iran's domestic crypto volume in a single action, but the international infrastructure that enabled that ecosystem remains largely intact. Enforcement and policy now need to grapple with the international gateways, not just the domestic exchanges."
The 23-day gap between the June 2 sanctions and the TRM report raises an obvious question. The analytical work underlying this report was not assembled overnight. Whether CoinEx was deliberately left off the June 2 list as leverage, is under active negotiation, or was simply deprioritized is not answered in the public record.
The custodial chokepoint problem is structural, not incidental. This is the permissionless money argument in its starkest form: every compliance intermediary is a single point of failure that a determined state actor will find and exploit whenever enforcement clears a lane. The compliance-vacuum whack-a-mole continues as long as custodians are the gatekeeping layer.
The ViaBTC exposure is also underreported. Yang runs both CoinEx and ViaBTC, one of the world's largest mining pools. If scrutiny extends to ViaBTC, this becomes a hash-rate story, not just an exchange story. Mining pool sanctions would be a novel and significant enforcement precedent with implications well beyond Iran.
TRM's report lands with CoinEx still operational and unsanctioned. The falsifiable test here is straightforward: if OFAC designates CoinEx and the roughly $1 million-per-day flow simply migrates to the next-weakest custodian inside of 90 days, the enforcement-through-gatekeepers thesis fails on its own terms. Watch for whether the regulatory response targets the exchange layer again or shifts toward wallet-level controls, where the policy framing hardens and the stakes for self-custody become considerably higher.
The public record does not answer this. OFAC's June 2 "Economic Fury" action targeted Iran's domestic exchange infrastructure. CoinEx is incorporated in Seychelles, operates internationally, and has no current US FinCEN registration. Whether its omission from the June 2 list reflects active negotiation, deliberate sequencing, or deprioritization is unknown. TRM Labs' report was published 23 days after those sanctions, which suggests the analytical work predates the public disclosure by a significant margin.
ViaBTC is a major global cryptocurrency mining pool founded and operated by CoinEx's founder, Haipo Yang. TRM traced $154 million in ViaBTC-to-Nobitex flows via mining payouts. ViaBTC also supplied liquidity to Nobitex after the Predatory Sparrow hack in June 2025. If US enforcement pressure reaches ViaBTC, it would represent the first significant attempt to sanction a major mining pool, a category that has not previously faced direct OFAC action. The hash-rate implications of that would extend well beyond the Iran sanctions context.
The regulatory reflex will be to conflate custodial exchange exploitation with self-custodied Bitcoin. Those are not the same thing. What TRM documented is a failure of custodial intermediaries, which are precisely the single points of control that compliance frameworks rely on. A permissionless, self-custodied Bitcoin settlement layer has no compliance officer to capture, no KYC database to subpoena, and no liquidity valve to shut. The argument that self-custody caused this problem runs directly counter to the evidence. Watch for the FATF and legislative framing to shift from "KYC the exchanges" toward "KYC the wallets" as this story develops.
