Key Highlights
- Iran’s IRGC quietly routed nearly $1B in crypto through two UK-registered exchanges, using digital assets to bypass global sanctions.
- Zedcex and Zedxion functioned as a single hub, with IRGC-linked flows reaching 87% of all activity at their peak in 2024.
- Corporate records connect the exchanges to Babak Zanjani, a sanctioned financier tied to earlier IRGC oil-laundering networks.
- Most transfers used USDT on TRON, moving between IRGC wallets, offshore nodes, and Iranian exchanges like Nobitex.
Iran’s Islamic Revolutionary Guard Corps (IRGC) quietly transferred nearly $1 billion in cryptocurrency through two exchanges incorporated in the United Kingdom on a rather discreet basis.
This activity, recorded by TRM Labs, illustrates how those associated with the regime are turning to digital assets in an effort to circumvent sanctions preventing their inclusion in the global economy.
Exchanges as a single IRGC hub
According to TRM Labs, the two exchanges, Zedcex and Zedxion, presented themselves publicly as standard crypto trading platforms. In reality, these two exchanges functioned together as one, and their architecture allowed large volumes of funds to move efficiently and discreetly.
During the period studied, roughly 56% of the combined transaction volume of these platforms was traced back to IRGC-controlled entities, peaking in 2024 at 87%. The IRGC has been designated as a foreign terrorist organization by multiple countries including the U.S., Australia, and Canada.
The transfers were conducted using mostly USDT stablecoins on the TRON blockchain. This was based on the high liquidity, low costs of transactions, and general acceptance by cryptocurrency brokers. The conditions ensured smooth and rapid transfers across the globe, as the transfers would not easily cause regulatory compliance, and the process was convenient for the operation of the IRGC.
Babak Zanjani: The main figure behind the network
One of the key players in the deal is Babak Morteza Zanjani, who has previously been sanctioned by the U.S. and European bodies for laundering billions of dollars of oil money for the IRGC.
According to filings from the companies involved, Zedcex and Zedxion shared the same directors, common virtual office addresses, and company records. This shows the platforms were intended to be a way of maintaining a continuous business process without any actual ownership.
TRM Labs notes that this is part of a long-standing, state-aligned financial network rather than opportunistic crypto misuse. Zanjani has re-emerged publicly through holdings spanning cryptocurrency, foreign exchange, and other sectors. He has also pushed the benefits of utilizing blockchain technology as part of Iran’s financial infrastructure.
How funds moved across borders
On-chain investigations show that Zedcex-linked wallets moved nearly all IRGC-associated funds in USDT on the TRON blockchain. Transfers flowed between IRGC-controlled addresses, offshore intermediaries, and domestic Iranian crypto exchanges, including Nobitex, Wallex, and Aban Tether.
Some activity involving a token pegged to the dollar named USDZ. This token was advertised in Telegram channels speaking Persian as the primary trading platform.
Parts of the trading infrastructure were maintained through ChainUp, a white-label service provider based in Singapore. This setup allowed the platforms to scale quickly while keeping wallet and operational layers separate.
Zedcex also had tie-ups with Zedpay, a Turkey-based payment processor. This integration helped the conversion of cryptocurrency into actual payments, and hence, the operational influence of funds connected with the regime expanded. This is evidence that the offshore infrastructure of cryptocurrency can easily link with the local payment systems.
Direct financing of sanctioned actors
TRM Labs traced over $10 million in USDT from Zedcex-linked wallets to Sa’id Ahmad Muhammad al‑Jamal, a Yemeni financier linked to the Houthis, another group sanctioned by the U.S.
It was usually possible to skip mixers, brokers, or aggregating wallets, indicating that in most of these cases, the Zedcex infrastructure acted as an active financial rail rather than a passive platform.
TRM Labs notes that this case differs from conventional crypto crime, which often involves theft, hacks, or opportunistic laundering. Here, the IRGC could move money at scale while avoiding compliance red flags.
The findings highlight a broader challenge for regulators: it’s no longer just about tracking individual transactions. Authorities must understand who controls crypto platforms, how governance is structured, and how sanctioned actors can embed themselves within financial systems while appearing legitimate.
Also Read: Polymarket Trader Cashes In on Israel–Iran Strike Bets
