CoinEx and ViaBTC ties raise new questions about sanctions evasion

Key Takeaways

• Blockchain analysis identified more than $3.84 billion in transfers between the global crypto exchange CoinEx and sanctioned Iranian entities over a period of more than seven years. The activity involved over 60 Iranian crypto platforms.
• Roughly $2.7 billion of that total flowed between CoinEx and Nobitex, Iran’s largest domestic crypto exchange. Since 2018, the two platforms processed an average of about $1 million in transfers per day.
• By 2024, CoinEx had become Nobitex’s largest external counterparty. Transaction volume with CoinEx was nearly nine times greater than with the next-largest known exchange, an unusual pattern for an independent market.
• Major Iranian crypto exchanges routed approximately 5% to 10% of their total transaction volume through CoinEx. The consistency of this range across multiple platforms suggests a coordinated pattern rather than organic market behavior.
• Nearly 8% of CoinEx’s total transaction volume has been classified as suspicious or illicit. By comparison, exchanges generally considered compliant typically report figures closer to 0.3%.
• CoinEx-affiliated mining pool ViaBTC contributed an additional $154 million in interaction with Nobitex through miner payouts. Following the 2025 Predatory Sparrow cyberattack, ViaBTC also reportedly provided emergency liquidity to Nobitex.
• Investigators also identified direct blockchain links between CoinEx and sanctioned organizations, including approximately $6 million connected to Iran’s Islamic Revolutionary Guard Corps (IRGC), around $374,000 linked to Palestinian Islamic Jihad (PIJ), and transactions involving addresses associated with Hezbollah.

New Evidence of an International Sanctions Evasion Network

After the U.S. Treasury’s Office of Foreign Assets Control (OFAC) imposed sanctions on Ramzinex, BitPin, Wallex, and Nobitex on June 2, 2026, transaction volumes between CoinEx and Iranian exchanges fell to below $150,000. However, it remains unclear whether a new infrastructure has already been established to continue these activities while avoiding detection.

Earlier this month, OFAC sanctioned the four Iranian exchanges under Executive Orders 13224 and 13902, marking the third enforcement action targeting Iran’s crypto infrastructure within the past five months. In January, the U.S. also sanctioned UK-registered firms Zedcex and Zedxion, alleging they served as front companies for the Islamic Revolutionary Guard Corps (IRGC).

From Syria to Nigeria: how ISIS uses cryptocurrency, and where Bitcoin Xchange comes in

The blockchain has helped uncover the ties between cryptocurrency fundraising campaigns, exchangers in Syria, and intermediaries in several countries around the world. A telltale pattern has emerged in which the same addresses were used across multiple donation drives at once

Читать дальше

The four exchanges sanctioned in June processed approximately $7.7 billion in crypto volume during 2025, representing roughly 78% of Iran’s estimated $9.9 billion annual crypto market. Despite increasing regulatory pressure, crypto activity linked to Iran continues to hover around $10 billion per year.

Blockchain investigators traced more than $3.84 billion in confirmed on-chain transfers between CoinEx and sanctioned Iranian entities over the past seven years.

Background: CoinEx, ViaBTC, and Nobitex

CoinEx is a global cryptocurrency exchange founded in 2017 by entrepreneur Haipo Yang. The company is incorporated in the Seychelles, has historical ties to Hong Kong, and has processed more than $79.1 billion in trading volume. It also operates through legal entities in Estonia, Lithuania, and the United Kingdom.

The exchange has faced regulatory scrutiny in multiple jurisdictions. CoinEx is no longer registered with the U.S. Financial Crimes Enforcement Network (FinCEN) or Lithuania’s financial intelligence authority. It has also been sued by the New York Attorney General, fined by Quebec’s financial regulator, investigated by Germany’s BaFin, and blocked by Thailand’s Securities and Exchange Commission in May 2025.

CoinEx’s parent company, ViaBTC Technology Limited, also operates ViaBTC, one of the world’s largest Bitcoin mining pools. As discussed later in this report, ViaBTC’s payout infrastructure has direct ties to Iran’s domestic crypto ecosystem.

CoinEx Became the Largest External Partner of Sanctioned Exchange Nobitex

According to the investigation, more than $3.84 billion in on-chain transfers flowed between CoinEx, ViaBTC, and Iranian crypto platforms over the past seven years.

The relationship between CoinEx and Nobitex appears to represent the largest external source of liquidity for Iran’s crypto ecosystem. Since November 2018, the two exchanges have exchanged more than $2.7 billion across approximately 6.2 million blockchain transactions, averaging about $1 million per day.

Inside Nobitex: U.S. slaps sanctions on 4 Iranian crypto exchanges with $7.7 billion in turnover

Four Iranian cryptocurrency exchanges accounted for roughly 78% of all digital asset volume tied to the country in 2025. They have now become the focal point of the largest U.S. sanctions campaign against Iran's cryptocurrency infrastructure.

Читать дальше

Notably, Nobitex sent approximately $360 million more to CoinEx than it received back. This suggests a sustained outflow of digital assets from Iran through CoinEx to gain access to international markets and global liquidity—an important capability for an economy operating under extensive sanctions.

Transaction volume accelerated rapidly beginning in 2020, rising from roughly $13 million that year to approximately $575 million in 2021—an increase of nearly 45 times in just one year.

After a temporary slowdown in 2022–2023, volumes climbed again to $714 million in 2024 and $763 million in 2025. By then, CoinEx accounted for roughly 16.3% of Nobitex’s annual transaction volume, making it by far the exchange’s largest external counterparty—handling nearly nine times the volume of the next-largest known platform.

Beyond Nobitex: CoinEx Is Deeply Integrated Into Iran’s Crypto Economy

Beyond Nobitex, investigators identified direct blockchain connections between CoinEx and more than 60 Iranian crypto companies and exchanges, including Wallex, Ramzinex, BitPin, Aban Tether, Excoino, Bit24, Ompfinex, Sarmayex, and Exir.

Three patterns suggest these relationships are unlikely to be the result of ordinary market dynamics.

How Mexico's Sinaloa cartel launders money through crypto. OFAC exposes the cash-out scheme

Around 97% of Chinese suppliers of chemicals used to make fentanyl accept payment in cryptocurrency. The volume of such transactions continues to grow alongside the global market for synthetic drugs

Читать дальше

Transaction Concentration

Major Iranian exchanges consistently routed approximately 5% to 15% of their total transaction volume through CoinEx.

In an open market, such figures would typically vary significantly—one platform might send 1%, another 30%, while others might not use the same exchange at all. The fact that dozens of independent platforms fall within a narrow 5%–10% range suggests a coordinated network rather than random market behavior.

Timeline of Adoption

Excoino and Nobitex began using CoinEx in 2018. Wallex, Ramzinex, Sarmayex, and several others joined in 2019, while Aban Tether, BitPin, Bit24, and Ompfinex became active between 2020 and 2021. Smaller platforms continued joining the network in 2022 and beyond.

This gradual expansion resembles the systematic growth of a customer network rather than dozens of unrelated exchanges independently selecting the same international platform.

Market Penetration

Even relatively small Iranian exchanges—including Tabdeal, Kifpool, Sarafi.io, Jibitex, Arzmodern, and Xchange98—show direct blockchain links to CoinEx.

Such broad penetration across every segment of Iran’s crypto market suggests that CoinEx either functions as a dedicated international gateway for Iranian crypto activity or has actively expanded its services across the country's digital asset ecosystem.

CoinEx received $67 million in funds linked to the Central Bank of Iran

Authorities traced approximately $67 million allegedly linked to the Central Bank of Iran flowing through CoinEx as part of a sophisticated cross-chain laundering network operating between June 2025 and June 2026, according to GetBlock AML Research.

The funds reportedly originated from the National Iranian Exchange (NIE) through an internal transfer framework referred to as "National–Tether." Investigators say the system relied on repeated cross-chain transfers designed to make transactions more resilient against freezes and external intervention.

The laundering process allegedly began with large USDT transfers on the TRON network—often exceeding $5 million per transaction. The funds were then split into multiple batches, bridged to Ethereum, routed through Gnosis Safe multisig wallets, converted into Aave assets, and repeatedly fragmented before being consolidated again and deposited at centralized exchanges.

CoinEX's connection to the Central Bank of Iran (CBI) addresses. Visualization by TRM Labs

According to the report, CoinEx served as one of the final destinations in this transaction chain. Investigators also claim the exchange provided crypto assets used to pay transaction fees required to keep the laundering infrastructure operating.

ViaBTC's Role

The report also highlights the involvement of ViaBTC, a Hong Kong-based mining pool operated by CoinEx's parent company, Viabtc Technology Limited.

Since 2018, researchers identified more than $154 million across roughly 4.47 million transfers between ViaBTC and wallets linked to Nobitex. Most of these payments flowed from ViaBTC to Nobitex-associated addresses and appear consistent with mining reward distributions.

Tether freezes $344M in USDT linked to Iran’s Central Bank — here’s why

The U.S. has frozen over $344 million in cryptocurrency tied to Iran’s Central Bank. The funds were held in largely inactive wallets that appeared to function as reserve storage.

Читать дальше

Because industrial cryptocurrency mining in Iran operates under strict government oversight, the report suggests these transactions may indicate the use of state-approved mining infrastructure or partnerships with government-linked entities.

Following the Predatory Sparrow cyberattack on Nobitex in 2025, investigators observed 117 previously inactive Bitcoin mining wallets transfer approximately $2.7 million to a new Nobitex hot wallet. Blockchain analysis linked these transfers to ViaBTC, suggesting the mining pool may have helped restore liquidity after the attack.

Beyond Iran, ViaBTC was also found to have processed approximately:

• $56.1 million involving the sanctioned exchange Bitzlato;
• $12.5 million involving the sanctioned Russian exchange Garantex;
• $20.7 million connected to the Wasabi privacy tool.

High-Risk Counterparties

The investigation also identified transactions between CoinEx and several high-risk entities.

Researchers traced approximately:

• $6 million involving wallets associated with Iran's Islamic Revolutionary Guard Corps (IRGC);
• roughly $374,000 linked to Palestinian Islamic Jihad;
• direct interactions with wallets associated with Hezbollah.

Additional high-risk exposure included:

• about $41.5 million involving Garantex;
• approximately $51.2 million connected to wallets used after the 2023 CoinEx hack;
• around $2.4 million tied to the BlackSuit ransomware operation;
• roughly $3.4 million involving Wasabi.

Billions in Iranian cryptocurrency on the global market: sanctions risks and compliance challenges

In 2025, $7.2 billion in transactions passed through the Iranian platform, and earlier reports indicated that the Central Bank of Iran purchased $500 million in USDT. Geopolitical instability is increasing pressure on crypto companies and requires a reassessment of sanctions compliance systems

Читать дальше

Transaction Patterns Shifted During Regional Conflict

The report notes a significant change in transaction behavior following the escalation of tensions between the United States, Iran, and Israel in late February 2026.

Before the conflict, transfers between Nobitex and CoinEx consisted primarily of frequent, small transactions, with an average value of around $435.

After tensions escalated, the average transfer size increased nearly fivefold to approximately $2,110, while the share of transactions exceeding $1,000 rose from 7.4% to 24.6%.

Researchers believe this shift reflects a transition from retail user activity toward larger liquidity management, treasury operations, and institutional fund movements conducted through accounts associated with exchanges including Nobitex, BitPin, Ramzinex, and Wallex.

The report also found that just 45 transfers larger than $10,000 accounted for roughly 37% of the total transaction volume after February 2026, suggesting a more centralized and structured flow of capital.

Asset withdrawal route from Iranian cryptocurrency platforms. Visualization: TRM Labs

According to the investigation, funds typically moved from Iranian exchanges through intermediary Nobitex wallets before reaching CoinEx, where they were consolidated and then routed to international markets or converted into fiat currency.