$1B Sanctions-Evasion Network Exposed: UK Crypto Exchanges Linked to Iran’s IRGC

Two cryptocurrency exchanges incorporated in the United Kingdom quietly processed billions of dollars in stablecoin transfers while serving as financial infrastructure for Iran’s Islamic Revolutionary Guard Corps (IRGC), according to a new case study from TRM Labs’ forthcoming 2026 Crypto Crime Report.

The findings reveal how two separate UK corporate entities—Zedcex and Zedxion—operated in practice as a single exchange embedded within Iran’s vast sanctions-evasion machinery. TRM Labs’ on-chain and corporate analysis concludes that the platforms became a major conduit for IRGC-linked value transfer, handling an estimated USD 1 billion in associated flows.

A Single Exchange Across Two Shell Companies

Although Zedcex and Zedxion are registered as two separate companies in the UK, TRM’s analysis says they “appear to function as a single exchange, despite registering as separate entities in the UK, illustrating how lightly-regulated corporate structures can be used to obscure control of crypto infrastructure.”

Both companies used straw-person directors, virtual office addresses, and filed repeated declarations of dormancy—despite the billions flowing through their wallets.

The corporate trail leads directly to Babak Morteza Zanjani, a sanctioned financier with a long history of enabling Iran’s sanctions evasion. TRM highlights that “a key figure in this network is Babak Zanjani, a longtime Iranian sanctions-evasion financier previously sanctioned for laundering billions in oil revenue on behalf of regime entities, including the IRGC.”

Zanjani briefly served as director and person with significant control at Zedxion. His exit was immediately followed by the creation of Zedcex under the same successor director and the same address, a sequencing TRM says “suggests continuity of operations rather than a clean separation.”

Dominance of IRGC-Linked Flows

TRM’s analysis shows that IRGC-linked activity made up the majority of Zedcex’s operational flow:

• In 2023, IRGC-linked wallets moved USD 23.7 million, about 60% of all activity.
• In 2024, IRGC-linked transfers surged to USD 619.1 million, representing 87% of Zedcex transactions.
• In 2025, IRGC-linked flows declined to USD 410.4 million, or 48% of total volume.

Annual value flows within Zedcex (Source: TRM Labs)

Overall, “Zedcex moved approximately USD 1 billion in funds associated with IRGC accounting for roughly 56% of their total transaction volume, with that share peaking at 87% in 2024,” TRM Labs said in its report.

The funds moved primarily in USDT on the TRON network, which TRM says offers “deep liquidity, low transaction costs, and widespread acceptance,” making it well suited to sanctions-pressured settlement.

Direct Links to Terror Financing

One of the most significant findings involves direct funding of a sanctioned terrorist financier. TRM reports: “Dually attributed Zedcex and IRGC wallets directly transferred funds to an OFAC-designated Houthi terrorist financier, underscoring the link between this exchange and Iranian regime proxies.”

That financier is Sa’id Ahmad Muhammad al-Jamal, sanctioned by the U.S. Treasury for providing material support to the IRGC and for operating a revenue-generating smuggling network for Yemen’s Houthis. TRM found that in late 2024, “over USD 10 million in USDT was transferred directly from a wallet dually attributable to Zedcex and the IRGC to addresses controlled by al-Jamal.”

Notably, these transfers did not pass through mixers or brokers. “The absence of intermediary routing is notable,” TRM writes. “The transfers did not pass through brokers, mixers, or aggregation wallets, establishing Zedcex-linked infrastructure as an active funding rail, not an incidental touchpoint.”

Offshore Crypto as Parallel Financial Infrastructure

TRM argues that Zedcex exemplifies a new era of sanctions evasion—one not based on hacks or short-term laundering, but on the construction of durable, exchange-level infrastructure aligned with a sanctioned state actor.

“Zedcex is not a typical crypto crime story,” the report concludes. “There was no exploit, no theft, and no scramble to launder funds after a breach. Instead, it illustrates a more mature risk: a sanctioned military organization operating exchange-branded crypto infrastructure offshore, embedded directly in global stablecoin markets, moving value persistently and at scale.”

For regulators and policymakers, TRM warns that the core challenge ahead will not be tracing illicit transactions after the fact but identifying who truly controls the platforms themselves—before their operations become normalized.