In 2024 UK crypto firm moves $619.1 million on behalf of the Islamic Revolutionary Guard Corps (IRGC)

Two crypto-exchange companies registered in the United Kingdom have been transferring billions of dollars in stablecoins on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC), according to a new report from TRM Labs.

• Released as part of TRM Labs’ 2026 Crypto Crime Report, the report identifies Zedcex and Zedxion, which marketed themselves as conventional cryptocurrency exchanges operated as a single entity, working to move cryptocurrencies internationally as part of Iran’s sanctions evasion network
• https://www.trmlabs.com/resources/blog/2026-crypto-crime-report-key-insights-trm-identifies-record-usd-158-billion-in-illicit-crypto-flows-in-2025-reversing-a-multi-year-decline
• Analysts for the blockchain intelligence firm discovered that, in 2023, $23.7 million in crypto was moved via Zedcex and Zedxion wallet addresses linked to the IRGC, amounting to 60% of all activity for both exchanges.
• This figure rose by 2,500% to $619.1 million in 2024, accounting for 87% of all Zedcex and Zedxion transactions, while in 2025 it dipped to $410.4 million.

Zedcex and Zedxion

• The registration filings for Zedcex and Zedxion indicate that both firms are currently active. However, their available financial accounts do not reflect the volume of funds they allegedly process on behalf of the IRGC.
• Zedxion also lists Babak Morteza as its director between October 2021 (when it was incorporated) and August 2022, with Babak Morteza Zanjani having been sanctioned in 2013 by the U.S. for having moved “billions of dollars” for the Iranian government.
• TRM Labs notes that Zedcex was incorporated on August 22, 2022, only a few days after Morteza resigned from his position as director of Zedxion, with both companies sharing the same registered address and also documenting similar assets in their financial statements.
• Aside from highlighting Morteza’s role, the report from TRM Labs also explains how Zedcex and Zedxion are part of a broader network that enables Iran to evade sanctions.
• Company records show that Zedxion was integrated with Zedpay. This Turkey-based mobile payments provider had working relationships with Turkish financial firms, including some whose licenses had been suspended following anti-money laundering violations.
• On-chain analytics also revealed that funds flowing from Zedcex-linked rails eventually found their way to some of Iran’s biggest crypto-exchanges, including Nobitex (which was hacked in June) and Wallex.
• Similarly, $10 million in funds was traced as reaching Sa’id Ahmad Muhammad al Jamal, a sanctioned individual who has previously provided financial support to the IRGC and who has allegedly managed a smuggling network on behalf of the Houthis in Yemen.

Ari Redbord, Global Head of Policy at TRM Labs said:

• “This is not opportunistic crypto misuse—it’s a sanctioned military organisation operating exchange-branded infrastructure offshore,”
• That Zedcex is a prime example of how crypto can be used as a parallel financial system, one which obscures ownership and licensing to enable illicit flows.
• “The most significant risk here isn’t a single transaction—it’s who controls the platforms themselves,”
•  “This case highlights why sanctions enforcement in crypto must move upstream to focus on infrastructure, governance, and ownership.”

Iran and crypto

• Other blockchain intelligence firms also observe the critical role that crypto has been playing for Iran, both in terms of evading sanctions and in terms of funding terrorism.

Tom Robinson, co-founder and chief scientist at UK-based analytics company Elliptic said:

• “We're tracking significant use of cryptoassets by Iran for sanctions evasion, in particular the USDT stablecoin,”
•  Elliptic shares its intelligence on Iranian use of crypto with its clients, to ensure “that they aren't exploited as part of this activity."
• June’s attack against Nobitex, which Israel-linked hackers targeted “as a key regime tool ‘for financing terrorism and violating sanctions.”
• The country's Ministry of Defence export centre recently began accepting crypto as payment for advanced weapons, with Chainalysis noting that cryptocurrency functions as an "alternative payment rail to facilitate cross-border trade" in the face of sanctions.

Source

https://decrypt.co/354260/two-uk-registered-companies-moved-1b-in-stablecoins-for-iran-report

https://www.trmlabs.com/resources/blog/2026-crypto-crime-report-key-insights-trm-identifies-record-usd-158-billion-in-illicit-crypto-flows-in-2025-reversing-a-multi-year-decline