UK crypto exchange becomes Iran's "financial shield"? $1 billion crypto money laundering case shocks the world

Blockchain intelligence company TRM Labs’ latest report reveals that two UK-registered cryptocurrency exchanges, Zedcex and Zedxion, processed transactions related to Iran’s Islamic Revolutionary Guard Corps (IRGC) amounting to as much as approximately $1 billion between 2021 and 2025, with illegal funds once accounting for up to 87% of their total trading volume.

The investigation shows that these exchanges built a covert financial pipeline to evade international sanctions through complex shell company structures, virtual office addresses, and integration with Turkish payment gateways, even directly funding US-sanctioned terrorist organizations. This case highlights how sanctioned entities within certain countries are increasingly dominating the crypto crime landscape, with illegal activities soaring by 694% year-over-year in 2025 to $154 billion, 84% of which was conducted via stablecoins (mainly USDT). This undoubtedly sounds a severe alarm for global regulators and crypto industry compliance.

$1 Billion Secret Pipeline: How UK-Registered Exchanges Became Iran’s “Financial Shield”

A complex financial network spanning the UK, Middle East, and Turkey has gradually come into focus under blockchain intelligence tracking. According to TRM Labs’ in-depth report released on January 9, two seemingly ordinary UK-registered crypto exchanges—Zedcex and Zedxion—have played key roles as overseas financing hubs for Iran’s IRGC over several years. The report estimates that about $1 billion of the total transactions processed by these platforms can ultimately be traced back to the sanctioned Iranian military organization, with illegal activity peaking at 87% in 2024. This case involves not only large sums but also sophisticated company disguises and connections to the global financial system, making it one of the most representative state-level crypto sanctions evasion operations in recent years.

A deep dive into the backgrounds of these exchanges uncovers a carefully crafted corporate facade. Although Zedcex and Zedxion were registered in the UK in 2021 and 2022 respectively, investigations show they essentially operate as a single entity. They share directors, use the same virtual office address, and demonstrate high operational coordination, indicating a unified command structure. Crucially, company records directly link Zedcex to Babak Morteza Zanjani, an Iranian sanctioned financier who, as early as 2013, was sanctioned by the US and EU for laundering billions of dollars in oil revenues on behalf of Iranian regime entities, including the IRGC. Despite being sentenced to death in Iran for seizing state assets, he was later reduced to a lesser sentence after repayment in 2024, and subsequently reactivated through a cross-sector group, DotOne Holding Group, involved in crypto, forex, and logistics, maintaining a tenuous relationship with regime-linked economic projects.

The scale and trends of fund flows reveal the pipeline’s active periods. Data shows that addresses associated with IRGC on Zedcex saw transaction volumes jump from $23.7 million (60% of total activity) in 2023 to $619.1 million (87%) in 2024. This surge likely correlates with increased international sanctions pressure and tightening of traditional financial channels. By 2025, although the total remained high at $410.4 million, the proportion of non-IRGC funds increased, reducing IRGC-related activity to 48%. Such volatility may reflect law enforcement investigations, platform risk adjustments, or shifts in Iran’s fund allocation strategies. Regardless, the flow of up to $10 billion through these seemingly “dormant” UK accounts exposes significant loopholes in global corporate registration and financial regulation when confronting such crypto entities.

Nested Companies and Turkish Payment Gateways: Dissecting the “Hybrid Finance” Model for Sanctions Evasion

The sustained operation and scale of this scheme hinge on a hybrid financial model that combines traditional shell companies, blockchain anonymous payments, and fiat currency gateways. This model does not merely exploit crypto’s anonymity but systematically integrates weak points across multiple jurisdictions to create a complete value transfer chain from sanctioned entities to real-world goods and services. Its core logic can be broken down into three layers: front-end company disguises, stablecoin bridging, and fiat settlement, each designed to increase traceability difficulty and evade regulation.

At the front end, Zedcex and Zedxion leverage the flexibility (and loopholes) of UK company registration laws. They use nominal directors and virtual office addresses, handling billions on-chain while submitting “dormant account” filings to authorities. This “hidden in plain sight” strategy allowed them to avoid detection by UK corporate registries and financial regulators for a long time. Ironically, after Zanjani withdrew from Zedxion in 2022, Zedcex was immediately registered under the same control structure and address, effectively continuing operations in a “phoenix” manner—an explicit demonstration of deliberate and skilled evasion.

In the middle layer, stablecoins—especially USDT issued on the TRON blockchain—serve as the primary conduit. The report notes that nearly all transfers occur via USDT on TRON, offering multiple advantages: high liquidity and global acceptance, low transaction fees and fast speeds on TRON, and minimal price volatility, making it suitable for large-value transfers. Funds flow among IRGC addresses, offshore intermediaries, and Iranian domestic exchanges (like Nobitex, Wallex, Aban Tether), forming a closed yet efficient internal cycle. TRM’s analysis even directly links Zedcex wallets to IRGC-designated addresses per the Israeli authorities’ administrative seizure order ASO-43/25 issued in September 2025, with many addresses later blacklisted and frozen by Tether.

On the back end, to connect crypto with the real economy, the network integrates Zedpay, a Turkish mobile payment processor. By establishing relationships with Turkish financial entities—such as Vepara, which was suspended for money laundering concerns, and the state-owned Islamic bank Vakif Katilim, scrutinized for facilitating Iran-related financial activities—Zedpay provides fiat settlement and real-world payment capabilities for sanctioned actors. This integration transforms a simple crypto trading platform into a comprehensive financial infrastructure supporting daily operations, procurement, and even payroll for sanctioned entities. Turkey’s strategic geographic and regulatory position has long made it a key node for such gray financial activities, and this case reaffirms that.

Key Data and Operational Model of Zedcex and IRGC-Related Transactions

Total transaction volume: approximately $1 billion related to IRGC.

Illegal flow proportion: illegal funds account for about 56% of total transactions on average, peaking at 87% in 2024.

Annual fund flows:

• 2023: IRGC-related transactions totaled $23.7 million, representing 60% of platform activity.
• 2024: IRGC-related transactions surged to $619.1 million, accounting for 87%.
• 2025: IRGC-related transactions were $410.4 million, with the proportion dropping to 48% due to increased non-IRGC flows.

Core tech stack: nearly all transfers use USDT (Tether) on the TRON blockchain.

Direct terror financing evidence: over $10 million USDT transferred directly from Zedcex/IRGC dual-controlled wallets to addresses linked to terrorists supporting the Houthis in Yemen, sanctioned by the US.

Fiat gateway: connected via Turkish payment processor Zedpay, linking to Turkish financial systems for fiat settlement.

When $1 Billion Flows On-Chain: Triple Impact on USDT, Regulation, and Crypto Industry Reputation

The Zedcex case is not isolated; it is just the tip of a larger undercurrent. According to Chainalysis, in 2025, illicit crypto addresses received at least $154 billion, a 162% increase from $59 billion in 2024. The core driver of this staggering growth is sanctioned entities’ activities, which expanded by 694% in one year. These cold facts reveal an unavoidable reality: state actors—especially regimes excluded from traditional financial systems like SWIFT—are systematically integrating crypto infrastructure into their national financial strategies to sustain economic operations and geopolitical actions. Cryptocurrencies, particularly stablecoins, have evolved from tech geek toys into critical financial tools in geopolitical games.

This trend poses serious reputation and compliance challenges for stablecoins, especially the market leader USDT. The report states that stablecoins account for 84% of all illegal transactions, aligning with their widespread use in legitimate markets but also making them a focus of regulation. USDT, with its high efficiency and penetration on TRON, repeatedly appears in such cases. Although Tether actively cooperates with law enforcement and has frozen dozens of addresses linked to IRGC mentioned in the report, the “post-facto freeze” approach cannot fundamentally solve the problem. Once up to $1 billion has been transferred and potentially converted into assets, freezing addresses becomes more symbolic than effective. This has sparked calls within and outside the industry for “know your customer” and “anti-money laundering” obligations to be front-loaded—how to maintain blockchain openness while exerting more effective control at the source of funds.

For the global crypto industry, such cases immediately increase regulatory pressure. They provide compelling ammunition for regulators to push for stricter legislation. Cases like Iran exploring digital currency sales for missiles and drones, Russia launching the ruble-backed A7A5 token handling over $93.3 billion in a year, further intensify Western regulatory concerns. Future regulation may focus on: 1) strengthening unified global oversight of crypto service providers (exchanges, wallet providers, payment processors) to close registration loopholes; 2) requiring public blockchains and stablecoin issuers to undertake more on-chain monitoring and proactive reporting; 3) implementing comprehensive “Travel Rule” compliance to enable tracking of beneficial ownership for large cross-jurisdiction transfers. The industry will inevitably enter an era of “strict compliance,” possibly sacrificing some decentralization ideals and user privacy, but necessary for integration into mainstream finance.

The Tech Spiral of Sanctions and Countermeasures: The Future Battlefield of Crypto Compliance

The exposure of the Zedcex case marks a new technological dimension in the global game of sanctions and counter-sanctions. It is no longer just bankers and investigators battling on paper; it has evolved into a high-intensity confrontation among blockchain analysts, smart contract developers, RegTech firms, and state-sponsored hackers—fighting over code and networks. One side uses crypto’s global, pseudo-anonymous, and settlement finality features to build financial shields; the other develops increasingly sophisticated on-chain analysis tools, address clustering algorithms, and real-time monitoring systems to penetrate these shields. This “cat-and-mouse” game is forming an escalating technological spiral.

Future battlegrounds will focus on key technological nodes. First, privacy-enhancing tech vs. compliance monitoring: privacy coins like Monero, Zcash, or emerging zero-knowledge Layer 2 solutions offer stronger anonymity. However, regulators are investing heavily in analysis tools capable of cracking or bypassing these protections and may legislate restrictions on privacy coin trading on regulated exchanges. Second, cross-chain bridges and mixers: these tools are heavily used to obfuscate fund flows and may face mandatory identity verification laws, risking global bans if not compliant. Third, oracle and real-world asset integration: as DeFi protocols increasingly incorporate stocks, bonds, and other traditional assets, ensuring these sources are free from sanctioned entities becomes a complex compliance challenge.

For crypto firms, especially exchanges and stablecoin issuers aiming for mainstream adoption, the only way forward is to develop “super-compliance” capabilities beyond traditional KYC/AML. This involves building strong internal on-chain intelligence teams, collaborating deeply with external experts like TRM Labs and Chainalysis, monitoring suspicious activity in real-time, and establishing rapid response channels with law enforcement. Embedding “compliance by design” into protocols—such as enabling upgrades to freeze suspicious assets after legal procedures—may conflict with the “code is law” ethos but could be a pragmatic necessity for survival. Ultimately, the paradox of crypto may be: to transcend traditional centralized finance, it must first learn to operate within the rules set by the latter, proving it can do better and more transparently.

Deep Dive: What is TRM Labs?

In this revelation of a $1 billion sanctions evasion case, TRM Labs plays a central role. It is a leading global blockchain intelligence firm, not an exchange or investment firm, but a provider of compliance and risk monitoring solutions for governments, financial institutions, and crypto companies. In simple terms, TRM Labs is the “digital detective” of the blockchain world, analyzing public on-chain data to identify illicit financial activities such as money laundering, fraud, terrorist financing, and sanctions evasion.

TRM Labs’ operations and technical capabilities: The company has proprietary on-chain analysis platforms capable of monitoring, clustering, and visualizing massive transaction data across dozens of blockchains in real-time. Its key techniques include “address clustering” and “behavioral analysis”—tracking fund flows, analyzing transaction patterns, and linking addresses to entities like exchanges, mixers, and known criminal wallets to map out illicit financial networks. In this Iran case, such capabilities directly linked Zedcex addresses to Israeli-designated IRGC addresses and even to terror-related wallets, forming an irrefutable chain of evidence.

Industry role and partnerships: TRM Labs’ clients include the IRS Criminal Investigation, UK FCA, and other top law enforcement agencies worldwide, as well as major CEXs and fintech firms. Notably, TRM Labs collaborates with Tether to monitor illegal USDT activity on TRON and other chains. This positioning makes it a crucial player: it is both the regulator’s “hawk eye” and a vital tool for the crypto industry’s self-regulation and compliance validation. Its existence and growth symbolize the industry’s transition from chaos to maturity, building essential compliance infrastructure.

Background Overview: The Evolution of Crypto Use by Sanctioned Countries

Understanding why Iran, Russia, and others rely heavily on crypto requires a brief history of sanctioned states’ interactions with crypto technology over the past decade. This history can be divided into three phases: passive engagement, proactive deployment, and systematic integration.

Phase 1: Grassroots and Early Exploration (2017-2019). During this period, crypto use in Iran, Venezuela, and similar countries was mainly driven by civilians. Ordinary citizens and merchants used Bitcoin for cross-border remittances and savings to evade hyperinflation and capital controls. In 2018, Iran announced a national crypto project, but it was more symbolic than effective. The main features were “toolization” and “scattering”: crypto served as an alternative payment and store of value when fiat systems failed.

Phase 2: State Tolerance and Stablecoin Rise (2020-2022). As US sanctions intensified—especially after Iran was cut off from SWIFT—officials began to see crypto’s potential more seriously. Stablecoins like USDT became popular for gray international trade, especially in oil and mineral exports. Venezuela’s oil company demanded USDT payments, and North Korea’s hacking groups increased crypto theft to fund regimes. This phase was characterized by “official tacit approval” and “stablecoin dominance,” with crypto embedded in informal state economies.

Phase 3: Systematic Construction and Regulatory Pushback (2023-present). We are now in this phase. Countries like Russia are developing official digital assets and CBDCs; Iran and Russia are exploring cross-border crypto trade systems; and schemes like the UK-registered exchanges and Turkish payment gateways are building full pipelines. Meanwhile, Western regulators have ramped up sanctions against mixers, mandated freezing of addresses, and partnered with blockchain analysis firms. This is a direct confrontation of “state strategy” versus “global regulation,” with crypto becoming a front line in geopolitical financial warfare. The Zedcex case exemplifies this intense struggle.