June 24, 2026

How CoinEx Became Iran's Primary Gateway to Global Cryptocurrency Markets

TRM Team

How CoinEx Became Iran's Primary Gateway to Global Cryptocurrency Markets

Key takeaways

TRM Labs traced over USD 3.84 billion in flows between CoinEx — a global cryptocurrency exchange — and sanctioned Iranian entities, spanning more than seven years and more than 60 Iranian platforms.
USD 2.7 billion of this activity flows between CoinEx and Nobitex, Iran's largest domestic cryptocurrency exchange, at an average rate of approximately USD 1 million per day since 2018.
By 2024, CoinEx was Nobitex's single largest external counterparty — by nearly nine times over the next largest named exchange — a pattern inconsistent with independent market behavior.
Every major Iranian domestic exchange routes approximately 5–10% of its total volume through CoinEx, indicating a coordinated arrangement rather than organic adoption.
CoinEx's share of illicit transaction volume is nearly 8% — far above the 0.3% threshold typical of compliant exchanges.
CoinEx's affiliated mining pool, ViaBTC, adds a further USD 154 million in traced exposure to Nobitex through mining payouts, and supplied emergency liquidity to Nobitex following Predatory Sparrow’s 2025 cyberattack.
CoinEx has direct on-chain exposure to the IRGC (USD 6 million), Palestinian Islamic Jihad (USD 374,000), and Hezbollah.
Following the June 2, 2026, OFAC sanctions against Ramzinex, BitPin, Wallex, and Nobitex, volumes between CoinEx and Iranian exchanges dropped to below USD 150,000, though it is not possible at the time of writing to determine if new infrastructure was established to evade detection.

Earlier this month, OFAC designated four Iranian domestic cryptocurrency exchanges — Nobitex, BitPin, Wallex, and Ramzinex — under E.O. 13224 and E.O. 13902, the third distinct enforcement action targeting Iran's crypto infrastructure in five months. In January, OFAC sanctioned UK-registered Zedcex and Zedxion for their use as front companies for the Iranian Revolutionary Guard Corps (IRGC). The four exchanges designated this month together accounted for roughly USD 7.7 billion, or 78%, of Iran's USD 9.9 billion in attributed 2025 crypto volume. Iran's attributed crypto volumes have held at roughly USD 10 billion annually despite sustained enforcement pressure.

TRM Labs has traced more than USD 3.84 billion in blockchain-verified flows between CoinEx and sanctioned Iranian entities over more than seven years.

Background: CoinEx, ViaBTC, and Nobitex

CoinEx is a global cryptocurrency exchange founded in 2017 by Haipo Yang and registered in the Seychelles with roots in Hong Kong. Over its lifetime, the exchange has processed over USD 79.1 billion in total trading volume and operates through legal entities in Estonia, Lithuania, and the UK, in addition to Hong Kong.

CoinEx has accumulated a series of regulatory penalties. It is no longer registered with US FinCEN or Lithuania's financial crimes unit, has been sued by the New York Attorney General, fined by Quebec's financial regulator, investigated by Germany's BaFin, and blocked by Thailand's Securities and Exchange Commission in May 2025.

CoinEx's parent company, Viabtc Technology Limited, also operates ViaBTC, a large global cryptocurrency mining pool. In mining pools, many individual miners contribute computing power to a shared network and receive proportional payouts from block rewards. As detailed above, ViaBTC's payout infrastructure is directly connected to Iran's domestic cryptocurrency ecosystem.

CoinEx is the single largest counterparty to sanctioned Iranian exchange Nobitex

Transaction flows between global cryptocurrency exchange CoinEx, mining pool ViaBTC, and Iranian crypto platforms have amounted to more than USD 3.84 billion in activity over the past seven years, according to TRM data.

CoinEx is owned by Viabtc Technology Limited, which also operates ViaBTC, a large global cryptocurrency mining pool.

The CoinEx-Nobitex connection is the single biggest liquidity lifeline for Iran’s cryptocurrency ecosystem. Since November 2018, more than USD 2.7 billion has moved between the two exchanges across approximately 6.2 million individual blockchain transfers — an average of roughly USD 1 million per day.

Nobitex has sent approximately USD 360 million more to CoinEx than it has received in return, indicating that cryptocurrency is systematically routed outward from Iran through CoinEx in search of international liquidity and global markets — crucial for a heavily sanctioned economy.

Transaction volume between the two exchanges grew sharply beginning in 2020, which saw total activity amounting to approximately USD 13 million. By 2021, annual volume had surged to USD 575 million — a roughly 45-fold increase in a single year.

After a temporary decline between 2022–2023, activity rebounded to USD 714 million in 2024 and USD 763 million in 2025, by which time CoinEx accounted for approximately 16.3% of Nobitex's total annual transaction volume. This made CoinEx Nobitex's single largest external counterparty by nearly nine times over the next largest named exchange.

Beyond Nobitex: Coinex is interwoven with Iran's crypto economy

In addition to Nobitex, TRM identified direct CoinEx transaction exposure to more than 60 Iranian cryptocurrency entities, including Wallex, Ramzinex, Bit Pin, Aban Tether, Excoino, Bit24, Ompfinex, Sarmayex, and Exir.

Three patterns in the data suggest this connectivity is unlikely to be independent market behavior.

Volume clustering

Every major Iranian exchange routes approximately 5–15% of its total transaction volume through CoinEx. In a free market, this figure would vary widely — some exchanges routing 1%, others 30%, others none at all. A consistent 5–10% band across dozens of independent platforms would be more in line with a coordinated arrangement.

Onboarding timeline

Excoino and Nobitex began transacting with CoinEx in 2018. Wallex, Ramzinex, Sarmayex, and others followed in 2019. Aban Tether, Bit Pin, Bit24, and Ompfinex appeared in 2020–2021. Smaller operators continued to be added through 2022 and beyond. This sequential pattern more closely resembles a client acquisition rollout rather than dozens of Iranian exchanges independently and simultaneously discovering CoinEx.

Scope of penetration

Small, obscure Iranian platforms — Tabdeal, Kifpool, Sarafi.io, Jibitex, Arzmodern, and Xchange98, among others — all carry direct CoinEx exposure. Full top-to-bottom market saturation of this kind suggests CoinEx is either functioning as a designated international cryptocurrency gateway within Iran or is actively soliciting the Iranian market across every tier.

CoinEx received USD 67 million from the Central Bank of Iran

TRM found that approximately USD 67 million in funds originating from the Central Bank of Iran flowed into CoinEx addresses as part of a structured multi-chain laundering scheme between June 2025 and June 2026, further linking the exchange to the Iranian economy. The CBI administered this infrastructure through the National Iranian Exchange (NIE) under a framework internally described as "National–Tether," using a repeatable laundering playbook designed for operational resilience and resistance to interdiction.

The scheme followed a consistent pattern across multiple blockchains. NIE-operated wallets received large deposits on USDT-on-TRON — often exceeding USD 5 million — split them into structured increments, and routed them through cross-chain bridges to Ethereum, where funds entered Gnosis Safe multisig contracts and were converted into Aave protocol tokens to complicate freezing.

Assets were then fragmented and bridged a second time, and the layering sequence was replicated before funds reconsolidated and moved toward centralized exchange off-ramps. CoinEx appears at the terminal end of this chain. TRM found that CoinEx also provided transaction fee funding used to enable the laundering activity itself.

ViaBTC: The mining layer

ViaBTC, which is registered and headquartered in Hong Kong, operates as the mining infrastructure of this network. Since 2018, TRM traced more than USD 154 million across approximately 4.47 million transfers between ViaBTC and Nobitex-linked wallets, with nearly all transfers originating from ViaBTC and moving toward Nobitex — consistent with mining pool payouts flowing directly into Iranian exchange wallets. These payouts indicate that Nobitex-linked addresses receive mining reward payouts from ViaBTC’s mining pool.

Given that industrial-scale cryptocurrency mining in Iran is subject to strict government oversight, these activities could also indicate access to state-authorized mining infrastructure or partnerships.

The strategic importance of this relationship became clear in 2025. Following the Predatory Sparrow cyberattack on Nobitex, which disrupted the exchange's operations, TRM identified 117 previously dormant Bitcoin mining wallets that activated and transferred approximately USD 2.7 million to a new Nobitex hot wallet, with ViaBTC confirmed in the fund flows. The pattern indicates that Nobitex drew on mining reserves held at ViaBTC to restore liquidity after the hack, suggesting ViaBTC was used here as a recovery mechanism.

ViaBTC's sanctions exposure extends beyond Iran. TRM traced approximately USD 56.1 million in transactions to Bitzlato (an exchange sanctioned under US Treasury Section 311 authorities for money laundering), approximately USD 12.5 million involving Garantex (a Russian exchange sanctioned for facilitating illicit finance), and roughly USD 20.7 million to Wasabi (a cryptocurrency mixing service that, while not sanctioned itself, has outsized exposure to sanctioned entities).

CoinEx high risk exposure: Terror financing, sanctions, and ransomware

In addition to its Iranian exchange exposure, CoinEx has exposure to entities linked to terrorist financing. TRM identified approximately USD 6 million in transactions across 186 transfers to wallets associated with the IRGC, a US-designated foreign terrorist organization. Additional exposure includes approximately USD 374,000 associated with Palestinian Islamic Jihad and direct interaction with wallets linked to Hezbollah.

Other high-risk interactions include approximately USD 41.5 million linked to now-defunct Russian exchange Garantex, approximately USD 51.2 million associated with wallets connected to the September 2023 CoinEx hack, USD 2.4 million tied to BlackSuit ransomware, and roughly USD 3.4 million involving the Wasabi mixing service.

Behavior changes during the US-Iran-Israel conflict

Transaction patterns between Nobitex and CoinEx shifted materially after hostilities between the began in late February 2026. Before, activity was dominated by small, high-frequency transfers — likely including a large share of retail volume — with an average transaction size of approximately USD 435. After that date, the average transaction size rose nearly fivefold, to approximately USD 2,110, and the share of transactions exceeding USD 1,000 increased from 7.4% to 24.6% of total transaction count. These larger transactions are likely liquidity provision, trading, and hedging within CoinEx accounts held by Bit Pin, Nobitex, Ramzinex, and Wallex.

The concentration of value within a smaller number of larger transfers — including 45 transactions above USD 10,000 that together accounted for approximately 37% of total post-February 2026 volume — is consistent with a shift from retail-driven activity to more consolidated, structured capital movement.

The graph below illustrates the outflow corridor from Iranian cryptocurrency exchanges from January 2026 through March 2026, moving through a set of Nobitex intermediary addresses before being deposited into CoinEx. Following the aggregation of funds at CoinEx, these funds were then routed through CoinEx infrastructure and subsequently transferred into global markets or cashed out for fiat via CoinEx.

On June 2, following OFAC sanctions of Bitpin, Nobitex, Ramzinex, and Wallex.ir, CoinEx cycled hot wallets — likely to distance their exposure to newly sanctioned Iranian entities. After June 4, volumes between CoinEx and Iranian entities dropped to below USD 150,000, indicating either an offboarding or nascent infrastructure that has not yet been attributed. It is worth noting that these Iranian exchanges have accounts at CoinEx which are not publicly visible on the blockchain and could be transacting privately despite sanctions.

Conclusion

The scale, duration, and structure of CoinEx's exposure to Iran's sanctioned cryptocurrency ecosystem suggests coordinated activity when considering the more than USD 3.84 billion in blockchain-traced flows across more than seven years, more than 60 Iranian entities, and statistically unusual volume distribution across virtually every tier of the Iranian market.

ViaBTC's role in restoring Nobitex's liquidity following a major cyberattack further demonstrates that the CoinEx ecosystem is also critical to the short-term survival of Iran’s cryptocurrency economy. Without access to CoinEx liquidity and infrastructure, Iranian exchanges and regime-linked actors would lose one of their primary pathways to global cryptocurrency markets.

Frequently asked questions (FAQs)

1. How large is the CoinEx-Nobitex relationship, and what does the data show?

Since November 2018, more than USD 2.7 billion has moved between CoinEx and Nobitex across approximately 6.2 million individual blockchain transfers — roughly USD 1 million per day on average. By 2025, CoinEx was Nobitex’s single largest external counterparty by nearly nine times over the next largest named exchange. Nobitex has sent approximately USD 360 million more to CoinEx than it has received, consistent with systematic outward routing of cryptocurrency in search of international liquidity.

2. What is Nobitex, and what is its sanctions status?

Nobitex is Iran’s largest domestic cryptocurrency exchange, founded in 2017. It has processed over USD 31.1 billion in lifetime trading volume and supports spot trading, peer-to-peer transactions, and Iranian Rial payments. Nobitex is designated under US sanctions.

3. How is CoinEx’s Iran exposure distributed beyond Nobitex?

TRM identified direct CoinEx transaction exposure to more than 60 Iranian cryptocurrency entities, including Wallex, Ramzinex, Bit Pin, Aban Tether, Excoino, Bit24, Ompfinex, Sarmayex, and Exir. Every major Iranian exchange routes approximately 5–10% of its total transaction volume through CoinEx — a statistical clustering across dozens of independent platforms that points toward a coordinated arrangement rather than organic adoption. Iranian exchanges were onboarded to CoinEx sequentially over several years, a pattern more consistent with a structured client rollout than independent discovery.

4. What role does ViaBTC play in this network?

ViaBTC, operated by CoinEx’s parent company Viabtc Technology Limited, functions as the mining infrastructure layer. Since 2018, TRM traced more than USD 154 million across approximately 4.47 million transfers between ViaBTC and Nobitex-linked wallets, with nearly all flows originating from ViaBTC — consistent with mining pool payouts directed into Iranian exchange wallets. Following a 2025 cyberattack on Nobitex, 117 previously dormant Bitcoin mining wallets activated and transferred approximately USD 2.7 million to a new Nobitex hot wallet, with ViaBTC confirmed in the fund flows, indicating ViaBTC was used as a liquidity recovery mechanism.

5. Does CoinEx have exposure to terrorism-linked entities?

Yes. TRM identified approximately USD 5.86 million in transactions across 186 transfers to wallets associated with the Islamic Revolutionary Guard Corps (IRGC), a US-designated foreign terrorist organization. Additional direct exposure includes approximately USD 374,000 linked to Palestinian Islamic Jihad and interaction with wallets associated with Hezbollah.

6. What other high-risk exposure does CoinEx carry?

Beyond Iran and terrorism-linked entities, CoinEx’s blockchain-traced exposure includes approximately USD 41.5 million linked to sanctioned Russian exchange Garantex, approximately USD 51.2 million connected to wallets involved in the September 2023 CoinEx hack, USD 2.4 million tied to BlackSuit ransomware, and roughly USD 3.4 million associated with the Wasabi cryptocurrency mixing service. ViaBTC carries an additional USD 56.1 million in traced exposure to Bitzlato and approximately USD 20.7 million to Wasabi.

7. What regulatory actions has CoinEx faced?

CoinEx is no longer registered with US FinCEN or Lithuania’s financial crimes unit. It has been sued by the New York Attorney General, fined by Quebec’s financial regulator, investigated by Germany’s BaFin, and blocked by Thailand’s Securities and Exchange Commission as of May 2025. The exchange also supports Monero (XMR), Zcash (ZEC), and Dash (DASH) — privacy-focused cryptocurrencies designed to obscure on-chain transaction trails.