TRM Labs released a blockchain analysis claiming it mapped $3.84 billion in cryptocurrency flows from CoinEx to a network of over 60 platforms operating in Iran, a country under comprehensive U.S. sanctions. The finding surfaces a gap between what a major exchange's transaction monitoring can catch and what sophisticated users might route through it.
CoinEx responded by denying knowledge of the flows. The exchange said in a statement it maintains compliance programs and uses transaction screening tools, though it did not specify which vendors or what detection thresholds it employs. The exchange added that it "cooperates" with law enforcement when contacted.
The $3.84 billion figure represents transactions TRM Labs identified crossing between CoinEx wallets and addresses it attributed to sanctioned Iranian entities. TRM Labs did not immediately detail the time period over which these flows occurred, the specific addresses it flagged, or the methodology it used to link wallets to Iranian platforms. Such details matter: blockchain addresses can be mislabeled, and attribution requires assumptions about wallet ownership.
U.S. sanctions on Iran crypto activity fall under the Treasury Department's Office of Foreign Assets Control (OFAC). Exchanges that knowingly facilitate transactions involving sanctioned entities face civil penalties, criminal liability, and license suspension. The bar is intent: an exchange must know or have reason to know it is moving funds to a blocked party. Negligence alone does not trigger OFAC violations, though regulators increasingly view inadequate monitoring as constructive knowledge.
CoinEx is licensed in Hong Kong and has operated without a U.S. money transmitter license, which limits direct OFAC jurisdiction but does not eliminate it if the platform processes U.S. transactions or banks through U.S. corridors. The exchange has not disclosed whether it received a subpoena from U.S. authorities regarding the TRM Labs findings.
The report underscores a structural problem: even exchanges that deploy basic compliance screening can miss flows routed through layered addresses or obfuscation techniques. TRM Labs' forensic work is based on on-chain pattern matching and public blockchain data, not on the transaction screening data CoinEx itself would see in real time. If CoinEx's monitoring system flagged these flows and the exchange chose not to block them, that would constitute knowing facilitation. If its system did not flag them, that raises questions about its screening parameters.
No regulator has yet announced an investigation into CoinEx over the TRM Labs claim. Until OFAC or another authority acts, CoinEx's denial and claim of compliance procedures remain uncontested in any formal proceeding.