How Two UK-registered Companies Moved Over a Billion in Stablecoins for the IRGC

This blog features a case study from TRM’s upcoming 2026 Crypto Crime Report. Be sure to check back in the coming weeks to get your complete copy.

Key takeaways

• Zedcex and Zedxion are UK-based front companies that have facilitated operational financing for Iran’s Islamic Revolutionary Guard Corps (IRGC). Together, the exchanges have processed approximately USD 1 billion in funds linked to the IRGC, accounting for roughly 56% of their total transaction volume, with that share peaking at 87% in 2024.

• A key figure in this network is Babak Zanjani, a longtime Iranian sanctions-evasion financier previously sanctioned for laundering billions in oil revenue on behalf of regime entities, including the IRGC. His direct connection to the corporate trail behind Zedcex underscores that this activity is not opportunistic crypto abuse, but the continuation of a well-established state-aligned financial network adapting to new rails.

• Crypto appears to be playing an increasingly important role in the total IRGC-linked financing activity.

• Zedcex and Zedxion appear to function as a single exchange, despite registering as separate entities in the UK, illustrating how lightly-regulated corporate structures can be used to obscure control of crypto infrastructure.

• Dually attributed Zedcex and IRGC wallets directly transferred funds to an OFAC-designated Houthi terrorist financier, underscoring the link between this exchange and Iranian regime proxies.

{{horizontal-line}}

Two cryptocurrency exchanges incorporated in the United Kingdom quietly processed billions of dollars in stablecoin transactions while functioning as financial infrastructure for Iran’s Islamic Revolutionary Guard Corps (IRGC), according to on-chain and corporate analysis conducted by TRM Labs. 

The IRGC is an elite arm of Iran’s military and security establishment, designated by the United States, Canada, Australia, and others as a foreign terrorist organization. The IRGC plays a central role in Iran’s intelligence operations, regional proxy activities, and sanctions evasion efforts through a vast network of state-linked commercial entities.

The two identified cryptocurrency exchanges, Zedcex and Zedxion, publicly present themselves as conventional crypto trading platforms. In practice, they operate as a single enterprise embedded within a broader Iranian sanctions evasion ecosystem, moving value across borders, currencies, and jurisdictions on behalf of one of the world’s most heavily sanctioned military organizations. 

Given that Zedcex and Zedxion operate as a single enterprise, for purposes of this report, we are going to refer to them both, when appropriate, as “Zedcex.”

The below chart shows annual value flows within Zedcex, distinguishing activity involving IRGC-linked addresses from activity associated with other Zedcex addresses, alongside the share of total activity attributable to IRGC-linked entities. 

In 2023, approximately USD 23.7 million flowed through IRGC-linked Zedcex addresses, representing about 60% of total activity. That share rose sharply in 2024, when IRGC-linked flows surged to roughly USD 619.1 million, accounting for an estimated 87% of all transactions. In 2025, IRGC-linked flows declined to approximately USD 410.4 million, while activity through non-IRGC-linked Zedcex addresses increased, reducing the IRGC share to about 48%.

Two UK companies, one actual exchange

Zedcex and Zedxion are incorporated in the UK and on paper resemble lightly-regulated offshore crypto ventures. Their UK corporate filings show nominal, straw-person directors, the use of virtual office addresses, and repeated declarations of dormancy—patterns that stand in sharp contrast to the large scale of activity observed on-chain.

Zedxion Exchange Ltd was incorporated in May 2021. In October of that year, an individual named Babak Morteza was appointed as director and person with significant control. The US and EU had previously sanctioned Babak Morteza Zanjani in 2013 for funnelling money to an IRGC company; those sanctions were later lifted as part of the now-defunct Joint Comprehensive Plan of Action (JCPOA) nuclear deal. 

Zedcex Exchange Ltd was incorporated in mid-2022, just days after Zanjani’s formal exit from Zedxion. From its inception, Zedcex listed the same successor director as Zedxion and was registered at the same virtual office address used by Zedxion. Zedcex similarly has repeatedly filed dormant accounts and routine confirmation statements through June 2025, reporting no active trading operations in the UK.

The sequencing of these events is notable. Zanjani’s withdrawal from Zedxion, followed immediately by the incorporation of Zedcex under the same control structure and address, suggests continuity of operations rather than a clean separation. Taken together, the overlapping directors, shared address, mirrored filings, and coordinated timing indicate that the two entities were designed to function as a single exchange operation spread across multiple UK legal shells rather than as independent businesses.

Babak Zanjani and the emergence of state-aligned crypto finance

The corporate record tying Zedcex to Babak Morteza Zanjani matters because Zanjani is not a typical entrepreneur – he is one of Iran’s most notorious sanctions evasion financiers, previously sanctioned by the US and EU for laundering billions of dollars in oil revenue on behalf of regime entities, including the IRGC. After being arrested in Iran and sentenced to death for embezzling millions from Iran’s National Oil Company (NIOC), his sentence was commuted in 2024 after he repaid the funds, and by 2025 he had re-emerged publicly with proximity to regime-linked economic projects.

Zanjani has re-entered the scene through DotOne Holding Group, a conglomerate spanning cryptocurrency, foreign exchange, logistics, transportation, aviation, and telecommunications. The breadth of those sectors is notable because it mirrors the infrastructure required to move value under sanctions – not only through crypto rails, but also through trade-linked settlement, cross-border logistics, and commercial intermediaries.

Zanjani has also begun publicly framing blockchain as part of Iran’s financial future. In a statement posted on X on July 9, 2025, he claimed that in 2023 he had advised the governor of the Central Bank of Iran to transition the country’s banking system onto blockchain-based infrastructure, and that DotOne had designed and implemented such a system with approval from Iran’s Supreme National Security Council. 

Viewed alongside Zedxion’s corporate trail and Zedcex’s on-chain activity, this appears consistent with a broader pattern in which regime-linked value transfer is increasingly experimenting with crypto infrastructure. That infrastructure is designed to operate offshore while maintaining functional ties to Iran’s sanctioned economy, offering an alternative to traditional banking channels under pressure.

What the blockchain reveals

TRM on-chain analysis connects Zedcex-attributed wallets directly to wallets designated by Israeli authorities as IRGC property under Administrative Seizure Order ASO-43/25, issued by Israel’s National Bureau for Counter Terror Financing on September 1, 2025. Many of these wallets have also been blocklisted by Tether.

Updated attribution on the TRON blockchain shows IRGC-controlled addresses dually attributable to Zedcex addresses. In fact, Zedcex moved approximately USD 1 billion in funds associated with IRGC accounting for roughly 56% of their total transaction volume, with that share peaking at 87% in 2024.

Transfers were conducted almost entirely in USDT on the TRON blockchain. The wallets functioned as operational exchange infrastructure, routing funds between these designated IRGC-controlled addresses, offshore intermediaries, and domestic Iranian crypto services such as Nobitex, Wallex, and Aban Tether.

The choice of asset and network is telling. USDT on TRON offers deep liquidity, low transaction costs, and widespread acceptance among brokers, making it well suited for high-value settlement under sanctions pressure. In this context, Zedcex functioned less like the retail exchange it purports to be and more like a stablecoin clearing hub embedded in a sanctions evasion network.

Many of these dually-attributed Zedex wallets held a token known as Zedxion (USDZ) – marketed as a dollar-pegged asset. Zedxion promoted this token on Persian-language Telegram channels, where users discussed secondary trading and swaps into more established cryptocurrencies. TRM analysts used USDZ holdings to partially map out the exchanges infrastructure.

Zedcex did not rely exclusively on proprietary infrastructure. TRM observed that parts of their exchange and wallet operations appeared to be nested within ChainUp infrastructure, a Singapore-based crypto infrastructure provider that offers white-label exchange services — including custody, wallet management, and trading back-end systems. This infrastructure allows exchanges to operate quickly by outsourcing core components while retaining separate, bespoke wallet infrastructure for other activities. This hybrid model enabled the exchanges to scale quickly while maintaining enough separation to support distinct activity across different wallet and operational layers.

From crypto to cash

Beyond exchange activity, Zedcex operated within a broader crypto payments ecosystem that connected on-chain flows to traditional financial rails.

Open-source and corporate records indicate that Zedxion was integrated with Zedpay, a mobile payment processor operating out of Turkey. Zedpay maintained relationships with Turkish financial entities, including Vepara, a fintech company whose license was later suspended amid anti-money laundering concerns, and Vakif Katilim, a state-owned Islamic bank that has previously faced scrutiny for facilitating Iran-linked financial activity.

Integration with a Turkey-based payment processor indicates that Zedxion/Zedcex-linked crypto infrastructure extended beyond trading or value storage and was capable of supporting fiat settlement and real-world payments. That linkage materially increased the utility of crypto assets as a liquidity and cross-border settlement tool for actors operating under sanctions constraints.

More broadly, the Turkey connection reflects a recurring sanctions-evasion pattern in which offshore crypto platforms interface with financial intermediaries in neighboring or transit jurisdictions to bridge digital assets into the formal economy, increasing resilience and enforcement complexity.

Woven into Iran’s broader crypto economy

Zedcex-linked activity does not exist in isolation. On-chain tracing shows that funds originating from Zedcex-linked infrastructure later reached several of Iran’s largest domestic cryptocurrency exchanges, integrating IRGC-aligned flows into the broader Iranian crypto economy.

This pattern reflects a recurring feature of Iran-linked finance: offshore crypto infrastructure interacts directly with domestic platforms that serve both ordinary users and high-risk actors operating in a heavily sanctioned environment. Retail crypto usage and regime-aligned finance coexist on the same rails, complicating enforcement and risk segmentation.

Direct funding of a designated terrorist financier

TRM’s on-chain analysis additionally links this network to direct terrorist financing activity, including the transfer of over ten million dollars to Sa’id Ahmad Muhammad al‑Jamal, who has been sanctioned by the US Treasury for providing material support to the IRGC and for operating a smuggling network that generates revenue for the Houthis in Yemen.

In late 2024, on-chain activity shows that over USD 10 million in USDT was transferred directly from a wallet dually attributable to Zedcex and the IRGC to addresses controlled by al-Jamal.

‍

The absence of intermediary routing is notable. The transfers did not pass through brokers, mixers, or aggregation wallets, establishing Zedcex-linked infrastructure as an active funding rail, not an incidental touchpoint.

Conclusion

Zedcex is not a typical crypto crime story. There was no exploit, no theft, and no scramble to launder funds after a breach. Instead, it illustrates a more mature risk: a sanctioned military organization operating exchange-branded crypto infrastructure offshore, embedded directly in global stablecoin markets, moving value persistently and at scale. This is not episodic abuse of crypto rails; it is infrastructure-level control.

What makes this particularly consequential is that the activity does not rely on obvious red flags. The value flows are steady, repeatable, and operationally integrated with fiat settlement and payment pathways. That design allows sanctioned actors to generate liquidity, support downstream networks, and sustain financial activity without the volatility or friction typically associated with illicit finance. In effect, crypto is being used not as a workaround, but as a parallel financial system.

For regulators, exchanges, and policymakers, this case is representative of a shift in risk. The challenge is no longer confined to tracing illicit flows after the fact or responding to discrete criminal events. The risk now lies in who controls the platforms themselves, how governance and ownership are structured, and how easily sanctioned actors can operate behind the appearance of legitimate crypto businesses. That reality raises hard questions about licensing, beneficial ownership, and the limits of traditional compliance models in a world where financial infrastructure can be quietly replicated offshore.

Zedcex shows that the next phase of sanctions enforcement in crypto will be less about chasing individual transactions and more about identifying, disrupting, and preventing the operation of illicit financial infrastructure before it becomes normalized at scale.

{{horizontal-line}}

This blog features a case study from TRM’s upcoming 2026 Crypto Crime Report. Be sure to check back in the coming weeks to get your complete copy.