By midweek, the phone calls got short and serious. A few trading desks quietly refreshed their exchange exposure sheets. No drama. Just a quick recheck of where funds sat and who those platforms might be touching.
The spark was a long, detailed post from TRM Labs pointing to billions in flows that allegedly moved between CoinEx and Iran-linked entities over the last several years. Then everyone remembered OFAC’s fresh designations of four Iran-based crypto exchanges earlier this month.
CoinEx pushed back in public, said it is reviewing accounts, tightening controls, and off-boarding risk. The market didn’t wait around to debate intent. It did what it always does in moments like this. It repriced counterparty risk.
Editor's note: A couple desks told me they trimmed exposure to anything with even a theoretical Iran touch while they waited for legal to weigh in. On-chain watchers flagged address rotations within days. None of it felt panicked. Just a fast repricing of counterparty risk, the kind you only notice if you’re watching depth and settlement windows hour by hour. — Elliot Veynor
The compliance story is back at center stage because two timelines collided. First, OFAC named four Iran-based exchanges in early June. Then TRM Labs published a forensic writeup linking CoinEx activity to Iran exposure across multiple years. That one-two put exchanges, market makers, and token teams on alert again.
When sanctions enforcement tightens, actual risk isn’t just about who is sanctioned. It’s also about who touches who, and how often, even indirectly.
Who’s affected right now? Centralized exchanges reviewing counterparties. OTC desks that route through multiple venues. Projects that rely on those venues for liquidity and listings. And of course, regular users who just want to know if their exchange risk changed overnight.
How CoinEx became a sanctions flashpoint
TRM Labs alleges that CoinEx acted as a major channel for Iran-linked crypto activity for years. Their investigators mapped flows across chains and counterparties, and the numbers grabbed headlines. According to TRM, blockchain-verified transfers between CoinEx and sanctioned or Iran-linked entities totaled around 3.84 billion dollars from 2019 through 2026. That’s a big number, even spread over years. TRM Labs (blog)
Concentration around an Iran domestic hub
TRM attributes roughly 2.7 billion dollars of that activity to back-and-forth transfers with Nobitex, which it identifies as Iran’s largest domestic exchange. The report cites about 6.2 million individual transfers, which averages out to about 1 million dollars a day since 2018. As a pattern, that suggests routine infrastructure rather than sporadic incidents. TRM Labs (blog)
A sensitive data point
The most sensitive claim in the report is that funds originating from the Central Bank of Iran made their way into CoinEx addresses in a multi-chain laundering setup, to the tune of roughly 67 million dollars between June 2025 and June 2026. If accurate, that could raise the stakes well beyond casual gray-market flow. TRM Labs (blog)
What TRM Labs says the data shows
Let’s keep it simple. TRM’s writeup claims sustained, repeatable links rather than a few edge cases. It ties addresses that it attributes to Iran-based services to CoinEx wallets over years, and highlights specific periods and counterparties that matter for regulators.
Period / Date Event or flow highlight Source 2019–2026 ~$3.84B in flows between CoinEx and sanctioned or Iran-linked entities TRM Labs 2018–2026 avg. Transfers with Nobitex across ~6.2M tx, ≈$1M/day on average TRM Labs Jun 2025–Jun 2026 ~$67M allegedly originating from the Central Bank of Iran into CoinEx addresses TRM Labs Jun 2, 2026 OFAC designates Nobitex, Wallex, BitPin, Ramzinex U.S. Treasury / OFAC Jun 24–25, 2026 TRM report and press attention put CoinEx in the spotlight TRM Labs Jun 25, 2026 CoinEx response cites reviews, geo-fencing, enhanced KYC/AML, off-boarding The Block
Attribution is not adjudication
It’s worth stating the obvious. On-chain attribution is a research claim, not a court ruling. TRM’s brand and methods carry weight with compliance teams. Still, exchanges will point to their own screening and argue intent, controls, and context matter. Both things can be true at once: the data can raise red flags while the legal process takes time to catch up.
Secondary exposure: how risk spreads
The OFAC designations on June 2 changed the calculus for any entity that touches those platforms, even indirectly. The named exchanges are Nobitex, Wallex, BitPin, and Ramzinex. Once that list went live, compliance teams had to evaluate whether routing through venues that might be interlinked could create exposure. U.S. Treasury / OFAC
Here’s the practical sequence of how exposure can propagate in crypto market plumbing:
- An Iran-based platform gains access to global liquidity by transacting with an offshore exchange.
- Market makers and OTCs trade across both venues, sometimes via bots that rebalance without manual review.
- Funds move through shared counterparties, including custodians or cross-exchange bridges and hot wallets.
- When OFAC updates its lists, any touchpoint can become a problem for U.S.-nexus firms and their banks.
- Risk teams re-score partners and shift flow, even if there’s no immediate enforcement action.
- Liquidity thins on targeted venues, spreads widen, and downstream projects feel the knock-on effects.
What counts as a touch
There are policy nuances here. A single historical transaction is not the same as an ongoing relationship. But sustained, high-frequency flow between a sanctioned or named entity and a global venue raises tougher questions for counterparties. The more automated the routing, the faster that risk can spiral without anyone making a conscious decision in the moment.
CoinEx’s response and what changed
After the TRM report and ensuing coverage, CoinEx publicly denied the characterization that it served as a primary Iran gateway and said it is taking additional measures. Reported steps include geo-fencing, enhanced KYC and AML, broader sanctions screening, and off-boarding Iran-related risk. This was reported by multiple outlets on June 25, 2026. The Block
Short-term operational shifts
Even if you set aside the debate over intent, these sorts of controls can change user experience quickly. New document checks. Stricter IP and device rules. Delayed withdrawals for manual review. For market makers, that usually means re-routing bots and updating allowlists. For retail, it can mean an unexpected request to resubmit KYC or a temporary block on certain regions.
Why the timing matters
The timing sits uncomfortably close to OFAC’s June 2 actions. That creates a tight narrative window that compliance teams and banks will study. Whether or not regulators speak up, private counterparties can and do act fast on perceived risk when headline vectors line up like this.
Implications for users, liquidity, and market structure
You do not need to be a U.S. entity to feel U.S. sanctions risk. Lots of global venues rely on U.S.-dollar rails, U.S.-based service providers, and U.S.-linked liquidity. When OFAC designates named exchanges in a region and a separate report highlights alleged links to a global venue, most serious players quietly trim exposure, at least until the dust settles.
Liquidity fragmentation and pricing
If a chunk of market makers reduce activity on a venue, spreads can widen. Some pairs slip out of fair value more often. That can attract opportunists, but it tends to reduce depth and raise execution costs for everyone else. Pairs with thin books are first to wobble.
Token teams and listing risk
Projects that rely on any single exchange for material volume should take note. If that venue faces a compliance overhang, new listings may slow, marketing plans get dialed down, and cross-listing conversations accelerate. In the worst case, you get quiet delistings by conservative platforms that want to reduce entanglement risk while they wait for clarity.
Custody and banking counterparties
CEXs lean on a network of payment processors, fiat rails, and custodians. If those partners decide a venue sits inside a higher-risk bucket, you might see subtle friction. Longer fiat settlement windows. Tighter withdrawal thresholds. More intrusive source-of-funds questionnaires. It’s not a public sanction. It’s the market de-risking in slow motion.
TRM Labs graphic showing the outflow corridor from Iranian domestic exchanges (e.g., Nobitex) into CoinEx — visualizes timing, scale and routing patterns that underpin TRM’s claim that CoinEx acted as a gateway for Iran-linked crypto flows. — Source: TRM Labs
What to watch next
There are a few obvious signposts worth watching in the coming weeks.
1) Further official action or guidance
OFAC could publish additional guidance, FAQs, or identify related facilitators. Sometimes nothing formal arrives, and the signal is the silence. Either way, counterparties will read the tea leaves after the June 2 designations of Nobitex, Wallex, BitPin, and Ramzinex. U.S. Treasury / OFAC
2) Exchange-side policy updates
Keep an eye on changes to terms of service, region blocks, and KYC tiers. If a venue adds explicit prohibitions tied to sanctioned jurisdictions and starts emailing users about policy updates, that’s a live response. Actions matter more than statements.
3) On-chain rerouting and address books
If addresses linked by TRM are deactivated or rotated, on-chain watchers will notice. Shifts in deposit clusters, new hot wallet patterns, and changes in bridge usage can tell you whether a venue is trying to cordon off historical exposure. TRM Labs (blog)
4) Liquidity migration
Watch market depth on key pairs. If spreads and depth recover after a brief wobble, counterparties may be satisfied with remedial steps. If depth keeps thinning while rivals gain, risk is still being repriced.
Risks & What Could Go Wrong
- Banking access squeeze. If fiat partners raise risk scores, fiat rails can slow or break for affected venues.
- Secondary sanctions exposure. Non-U.S. entities with U.S. links might face internal reviews or de-banking if seen as touching named platforms.
- Over-blocking collateral damage. Aggressive geo-fencing and KYC can mistakenly catch legitimate users and freeze funds pending review.
- Liquidity drain on niche pairs. Thin books become more volatile, causing slippage and stop-outs for unsuspecting traders.
- Regulatory pile-on risk. A high-profile report can attract multiple agencies, even if initial claims are later narrowed.
- Data interpretation errors. On-chain attribution can mislabel or over-aggregate addresses, creating false positives.
Compliance risk rarely arrives alone. It brings settlement risk, market risk, and reputational risk in a tight cluster.
If you want a clean, ongoing news feed on this specific thread without the noise, Crypto Daily has been tracking sanctions-linked crypto actions and on-chain forensics in real time. You can find updates and context as the story evolves at Crypto Daily.
Frequently Asked Questions
Is CoinEx sanctioned by the U.S. right now?
As of this writing, CoinEx is not on OFAC’s public sanctions lists. What’s changed is perceived counterparty risk following OFAC’s June 2 designations of four Iran-based exchanges and a TRM Labs report alleging extensive links. That combination pushed exchanges and desks to reassess exposure. U.S. Treasury / OFAC TRM Labs
What is secondary exposure risk in this context?
Secondary exposure is the knock-on risk from transacting with, or routing through, entities that OFAC has named. Even if your platform is not sanctioned, touching those entities can raise legal and banking risks if you or your partners have a U.S. nexus.
What exactly did TRM Labs claim?
TRM Labs reported about $3.84B in blockchain-verified flows between CoinEx and sanctioned or Iran-linked entities from 2019 to 2026, including around $2.7B with Nobitex and roughly $67M allegedly tied to the Central Bank of Iran between June 2025 and June 2026. These are research findings, not court judgments. TRM Labs
How did CoinEx respond?
CoinEx denied the characterization, said it is conducting a review, off-boarding Iran-related risk, and implementing geo-fencing and enhanced KYC/AML and sanctions screening. That response was reported on June 25, 2026. The Block
Should users immediately withdraw funds?
That depends on your own risk tolerance and jurisdiction. Many traders diversify venue risk as a baseline. If you rely on a single exchange for funds you need quickly, consider whether temporary operational changes or liquidity shifts could affect you. No article is financial or legal advice. It’s a prompt to review your setup.
Could other exchanges be drawn in?
Possibly. If on-chain links show sustained routing between named Iran exchanges and other venues, or if counterparties publicly tighten controls, we could see wider de-risking. Often the first sign is subtle policy changes, not press releases.
What signals should traders watch next?
Look for updated terms, region blocks, and KYC prompts. Watch depth and spreads on key pairs. Monitor on-chain address rotations tied to prior clusters. Any shift there suggests remediation or rerouting is underway.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.