Iran’s Islamic Revolutionary Guard Corps (IRGC) has used two cryptocurrency exchanges registered in the United Kingdom to move approximately $1 billion since 2023, according to a new analysis from blockchain intelligence firm TRM Labs.
The two exchanges, Zedcex and Zedxion, appeared to operate as separate companies but functioned as a single enterprise. Between 2023 and 2025, IRGC-linked transactions accounted for 56% of the exchanges’ total volume. The vast majority of these transfers used Tether (USDT) on the Tron blockchain, chosen for its low transaction costs and high liquidity.
How the Operation Grew Over Time
The scale of IRGC activity through these platforms increased dramatically year over year. In 2023, approximately $24 million in IRGC-linked funds moved through the exchanges, representing 60% of their total activity. This surged to $619 million in 2024, when IRGC transactions peaked at 87% of all exchange volume. By 2025, IRGC-linked flows declined to $410 million, accounting for 48% of total transactions.
TRM Labs traced the exchanges’ operations by making small deposits and withdrawals to map their internal infrastructure. Investigators also followed activity tied to 187 wallet addresses that Israeli authorities designated as IRGC-controlled in September 2025.
Source: trmlabs
The funds moved through a network connecting IRGC-controlled wallets, offshore intermediaries, and major Iranian cryptocurrency exchanges including Nobitex, Wallex, and Aban Tether. This integration meant sanctioned military funds flowed into Iran’s broader crypto economy, where ordinary citizens also trade digital assets.
The Man Behind the Exchanges
Corporate records link both exchanges to Babak Zanjani, one of Iran’s most notorious sanctions-evasion financiers. The United States and European Union previously sanctioned Zanjani in 2013 for laundering billions of dollars in oil revenue on behalf of regime entities, including the IRGC.
Zanjani was later arrested in Iran and sentenced to death for embezzling from the National Iranian Oil Company. His sentence was commuted in April 2024 after he repaid approximately $2.1 billion. By December 2024, he had been released from prison.
Zedxion Exchange Ltd was incorporated in May 2021, with Babak Morteza appointed as director in October that year. Zedcex Exchange Ltd was incorporated in mid-2022, just days after Zanjani formally exited Zedxion. Both companies shared identical virtual office addresses and listed the same successor director. Despite processing billions in cryptocurrency, both exchanges filed dormant accounts through June 2025, claiming no active trading operations in the UK.
Since his release, Zanjani has re-emerged through DotOne Holding Group, a conglomerate spanning cryptocurrency, logistics, and telecommunications. In July 2025, he claimed to have advised Iran’s Central Bank to transition the country’s banking system onto blockchain infrastructure.
Direct Links to Terrorist Financing
TRM Labs uncovered direct transfers exceeding $10 million from IRGC wallets to Sa’id Ahmad Muhammad al-Jamal, a Yemeni national whom the U.S. Treasury sanctioned in 2021. Al-Jamal operates a smuggling network that generates revenue for Yemen’s Houthis and provides material support to the IRGC. These transfers occurred without routing through intermediaries or mixers, demonstrating the direct nature of the terrorist financing.
The investigation also revealed that Zedxion integrated with Zedpay, a mobile payment processor operating from Turkey. Zedpay maintained relationships with Turkish financial entities including Vepara, whose license was later suspended amid anti-money laundering concerns, and Vakif Katilim, a state-owned Islamic bank previously scrutinized for facilitating Iran-linked financial activity. This connection extended the exchanges’ capabilities beyond digital trading into fiat settlement and real-world payments.
International Response and Enforcement
Israel’s Ministry of Defense took action in September 2025, ordering the seizure of 187 cryptocurrency wallets allegedly belonging to the IRGC. These wallets had collectively received $1.5 billion in USDT over time, though they currently hold only $1.5 million. TRM Labs connected Zedcex-attributed wallets directly to addresses designated in this Israeli seizure order.
Tether, the company behind USDT, executed its largest-ever freeze of Iranian-linked funds on July 2, 2025. The stablecoin issuer blocklisted 42 addresses, many with exposure to both Iranian exchanges and IRGC-affiliated addresses previously flagged by Israeli authorities. This action removed significant liquidity from Iran’s crypto market at a critical time.
The timing coincided with severe economic pressure on Iran. The Iranian rial hit record lows in late December 2025, reaching 1.42 million per U.S. dollar—a decline of approximately 40% since June 2025. This currency crisis has pushed millions of Iranians toward cryptocurrency as a way to preserve their savings.
Infrastructure Built for Evasion
Unlike typical cryptocurrency abuse by criminals, this operation represents state-aligned actors building persistent financial infrastructure. Parts of the exchange operations were hosted by ChainUp, a Singapore-based company that provides white-label exchange services including custody, wallet management, and trading systems. This infrastructure allowed the exchanges to scale rapidly while maintaining separate wallet infrastructure for different activities.
“This is not opportunistic crypto misuse—it’s a sanctioned military organization operating exchange-branded infrastructure offshore,” said Ari Redbord, Global Head of Policy at TRM Labs. The findings show Iranian-linked actors testing more persistent crypto infrastructure rather than conducting one-off transactions.
Miad Maleki, a former U.S. Treasury official who worked on Iran sanctions efforts, told The Washington Post that “the $1 billion figure over two years demonstrates that digital currencies are becoming a financial channel for Iran’s shadow banking apparatus.”
Both exchanges claim on their websites to comply with anti-money-laundering regulations. Zedcex lists Iran among its prohibited jurisdictions, while Zedxion does not. Neither exchange responded to questions from The Washington Post. The UK Treasury’s Office of Financial Sanctions Implementation also declined to comment.
Iran’s Growing Crypto Dependence
The broader context reveals Iran’s increasing reliance on cryptocurrency for sanctions evasion. Approximately 22% of Iran’s population—about 10 million people—now uses or owns cryptocurrency. Crypto outflows from Iran totaled $4.18 billion in 2024, representing a 70% increase from the previous year. Research from August 2025 shows that 1.4% of Iran’s annual GDP now flows through cryptocurrency channels.
Iran also controls about 4.2% of global Bitcoin mining power, ranking fifth worldwide, though an estimated 95% of mining operations run illegally. The country’s cheap electricity costs between $0.01 and $0.05 per kilowatt-hour make mining attractive despite the risks.
The Financial Times recently reported that Iran is looking to accept crypto payments in its sales of ballistic missiles, warships, and other advanced weapons. This represents a significant escalation in Iran’s efforts to bypass Western sanctions through blockchain technology.
The Digital Front Line
This case demonstrates how cryptocurrency has become central to geopolitical conflicts and sanctions evasion. The sophistication of the operation—using UK corporate structures, white-label infrastructure providers, and Turkish payment processors—shows Iran’s evolution from sporadic crypto use to building durable financial rails that traditional banking cannot reach.
The challenge for regulators and compliance officers is significant. These exchanges presented themselves as conventional trading platforms with anti-money laundering programs. Yet corporate filings showing dormant status and nominal directors stood in sharp contrast to billions in on-chain activity. The gap between paper compliance and operational reality enabled years of sanctions evasion through lightly-regulated offshore structures.
As digital assets become more central to global finance, the ability of sanctioned actors to build parallel financial infrastructure poses growing challenges for international enforcement efforts.