In brief
- A report from TRM Labs has found that two companies registered in the UK have been moving billions of dollars in stablecoins in order to fund Iran’s Islamic Revolutionary Guard Corps.
- The two companies were founded in 2021 and 2022, and operate as a single enterprise, registering the same address and filing very similar financial reports.
- Experts affirm that the activities of the two crypto-exchanges offer an indication of how extensive Iran’s sanctions evasion network is, and of just how much it’s relying on crypto.
Two crypto-exchanges companies registered in the United Kingdom have been transferring billions of dollars in stablecoins on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC), according to a new report from TRM Labs.
Released as part of TRM Labs’ 2026 Crypto Crime Report, the report identifies Zedcex and Zedxion, which marketed themselves as conventional cryptocurrency exchanges.
Yet in practice, TRM Labs found that both companies operated as a single entity, working to move cryptocurrencies internationally as part of Iran’s sanctions evasion network.
Analysts for the blockchain intelligence firm discovered that, in 2023, $23.7 million in crypto was moved via Zedcex and Zedxion wallet addresses linked to the IRGC, amounting to 60% of all activity for both exchanges.
This figure rose by 2,500% to $619.1 million in 2024, accounting for 87% of all Zedcex and Zedxion transactions, while in 2025 it dipped to $410.4 million.
Zedcex and Zedxion
The registration filings for Zedcex and Zedxion indicate that both firms are currently active, although their available financial accounts belie the volume of funds they allegedly process on behalf of the IRGC.
Zedxion also lists a Babak Morteza as its director between October 2021 (when it was incorporated) and August 2022, with a Babak Morteza Zanjani having been sanctioned in 2013 by the U.S. for having moved “billions of dollars” for the Iranian government.
TRM Labs notes that Zedcex was incorporated on August 22, 2022, only a few days after Morteza resigned from his position as director of Zedxion, with both companies sharing the same registered address and also documenting similar assets in their financial statements.
Aside from highlighting Morteza’s role, the report from TRM Labs also explains how Zedcex and Zedxion are part of a wider network that enables Iran to evade sanctions.
Company records show that Zedxion was integrated with Zedpay, a Turkey-based mobile payments provider that had working relationships with Turkish financial firms, including some that had seen their licenses suspended after anti-money laundering violations.
On-chain analytics also revealed that funds flowing from Zedcex-linked rails eventually found their way to some of Iran’s biggest crypto-exchanges, including Nobitex (which was hacked in June) and Wallex.
Similarly, $10 million in funds was traced as reaching Sa’id Ahmad Muhammad al‑Jamal, a sanctioned individual who has previously provided financial support to the IRGC and who has allegedly managed a smuggling network on behalf of the Houthis in Yemen.
“This is not opportunistic crypto misuse—it’s a sanctioned military organization operating exchange-branded infrastructure offshore,” said Ari Redbord, Global Head of Policy at TRM Labs.
Redbord said that Zedcex is a prime example of how crypto can be used as a parallel financial system, one which obscures ownership and licensing in order to enable illicit flows.
“The most significant risk here isn’t a single transaction—it’s who controls the platforms themselves,” he said. “This case highlights why sanctions enforcement in crypto must move upstream to focus on infrastructure, governance, and ownership.”
Iran and crypto
Other blockchain intelligence firms also observe the important role that crypto has been playing for Iran, both in terms of evading sanctions and in terms of funding terrorism.
“We’re tracking significant use of cryptoassets by Iran for sanctions evasion, in particular the USDT stablecoin,” said Tom Robinson, co-founder and chief scientist at UK-based analytics company Elliptic.
Speaking to Decrypt, Robinson noted that Elliptic shares its intelligence on Iranian use of crypto with its clients, in order to ensure “that they aren’t exploited as part of this activity.”
He also noted June’s attack against Nobitex, which Israel-linked hackers targeted “as a key regime tool ‘for financing terrorism and violating sanctions’.”
The country’s Ministry of Defence export center recently began accepting crypto as payment for advanced weapons, with Chainalysis noting that cryptocurrency functions as an “alternative payment rail to facilitate cross border trade” in the face of sanctions.
Iran is currently gripped by protests against the regime that have seen some 650 protestors killed, according to human rights groups, while the country’s internet traffic has dropped to “near zero” amid a nationwide shutdown. On prediction market Myriad, owned by Decrypt‘s parent company Dastan, users place a 60% chance on the regime remaining in place through October.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.