TRM Labs published a blog post recently that summarized the situation with Iranian crypto-asset exchanges as, “Declining Volumes, Rising Tensions, and Shifting Trust” citing declining transaction volumes at Iranian crypto-asset exchanges as signs of progress.

While it is true that volumes at the largest Iranian crypto-asset exchange are declining (the largest exchange was hacked and temporarily shut down in what looks like politically-motivated action ) the Iranian crypto-asset market actually looks to be getting more resilient.

As has been well-documented for many years, Iran is involved in a number of regional conflicts and its economy has come under significant strain from a range of sanctions-related issues.

This case study takes a closer look at the situation in Iran and highlights the danger of drawing conclusions from headlines, depending on anecdote instead of data.

Further, this case study will present data that suggests:

TRM Labs’ analysis on Iran may be missing a few large Iranian crypto-asset service providers.

Smaller crypto-asset service providers are growing rapidly, calling into question the view that crypto-asset use is declining in Iran.

Confirmation bias is a clear and present danger. Fewer arrests doesn’t mean lower levels of crime, but could be masking far more serious problems.

Even without referring to the data, given that circumstances in Iran have not only remain unchanged but worsened, any claim that crypto-asset use has declined must be viewed with some degree of skepticism.

This case study seeks to peel back the rhetoric and understand how the use of crypto-assets to evade sanctions is evolving rather than dissipating.

Problems start from the fact that the BMEX token was not distributed as described by the BitMEX team. Nearly all of BMEX’s circulating supply has been held back and this is not properly reflected in BitMEX’s own BMEX research published contemporaneously with their recent announcement.

Potential issues of misrepresentation aside, it is an interesting choice by the BitMEX team, especially given the exchange’s founders were pardoned just days before the BMEX announcement.

Perhaps somewhat ironically as well, the U.S. Securities and Exchange Commission was in the process of preparing guidance concerning disclosure and transparency requirements with respect to token issues such as those contemplated here.

All of this strongly suggests there is a high likelihood that “hidden” BMEX supply may soon be unleashed on the market, potentially putting downward pressure on price.

According to TRM Labs, between “January and July 2025, total cryptocurrency flows involving Iranian entities fell to USD 3.7 billion, an 11% decrease compared with the same period in 2024.”

TRM Labs’ data give Nobitex, the largest crypto-asset exchange in Iran and the one that was hacked on June 18, 2025, 87.4% market share in Iran for a recent period.

For Iran’s embattled economy and financial system, Nobitex’s 87.4% market share for a financial services business is clearly a “fragile situation” given the systemic importance of this exchange, and therefore a prime target for opponents of the regime.

However, only three crypto-asset exchanges are named by TRM Labs, and while it is true that there was a decline of deposits to Nobitex following its hack, there was actually an increase in deposits of USDT to other Iranian crypto-asset service providers.

Contrary to what TRM Labs’ claim that “confidence in Iran-based virtual asset service providers (VASPs) deteriorated after the USD 90 million hack of Nobitex, the country’s largest exchange, on June 18,” blockchain transaction data actually shows that “confidence” in other VASPs appears to be increasing, given the growth of deposits to other Iranian service providers.

While Nobitex may certainly be the biggest show in town, it’s not the only one.

Aban Tether is Iran’s second-largest crypto-asset exchange and USDT deposit data on the TRON blockchain appears to support TRM Labs’ finding that the service provider is around 4.1% of Iran’s $3.7 billion crypto-asset market.

It is clear apparent that USDT deposits on the TRON blockchain into Aban Tether in 2025 are lower than for 2024.

However, even after the Nobitex hack, there was in fact a 3.75% month-on-month increase in USDT deposits to Aban Tether from June to July 2025, which seems to indicate that even if Iranians were losing confidence in Nobitex, they weren’t necessarily losing faith in crypto, much less Aban Tether.

The goal of this initial exercise is to establish a baseline and demonstrate that we are looking at the same type of data as TRM Labs. The main difference of course is that TRM Labs may be presenting this data differently, and more importantly, might be missing a few key pieces that could lead to misleading conclusions.

Because TRM Labs elected to only focus on data between January and July 2025, it also appears to have neglected certain other Iranian crypto-asset service providers who had significant flows.

Take for instance this identified Iranian crypto-asset service provider in Figure 3., which on the Ethereum blockchain alone, has received over $777 million worth of USDT deposits since 2022.

The finding is especially significant given that TRON is the favored blockchain for USDT transactions, not Ethereum.

TRM Labs’ analysis of Iranian crypto-asset activities can be summarized quite simply as “Nobitex transactions on the TRON blockchain have decreased.”

While this may be a fair statement, (Nobitex is the most high profile Iranian crypto-asset exchange and operates mainly on the TRON blockchain), it’s important to note that Nobitex was also hacked during the period of time under observation by TRM Labs in its report (January to July 2025).

And while Nobitex may reflect a significant portion of the Iranian crypto-asset industry, determining the growth or decline of an ecosystem by its largest organism can be extremely misleading.

In Figure 4., we observe how USDT deposits on the Ethereum blockchain have actually been increasing in 2025 for Ramzinex, another Iranian crypto-asset exchange, with a noticeable surge in June 2025, after the hack of Nobitex.

While the USDT deposits on the Ethereum blockchain to Ramzinex are not large in absolute terms, the trend clearly shows growth, and Ramzinex is far from the only Iranian crypto-asset exchange to experience that growth.

In Figure 5., we can observe two smaller Iranian crypto-asset service providers experiencing a growth in USDT deposits, again on the Ethereum blockchain, starting from January 2025.

Similar to Ramzinex, while the absolute amounts of USDT being deposited to these emerging Iranian crypto-asset service providers on the Ethereum blockchain are not large, the growth in 2025 is evident.

Nor is the growth in USDT use limited to the Ethereum blockchain. In Figure 6., we see a relatively new Iranian crypto-asset service provider experience strong growth in USDT deposits on the TRON blockchain.

In just 6 months, over $15.7 million USDT has already been deposited to this relatively new Iranian crypto-asset service provider, a significant amount for any new business, let alone a crypto-asset business in Iran.

Some of the more recent flows are even larger than those for existing incumbents. For instance, Aban Tether saw over $960,000 in USDT deposits on the Tron blockchain in August 2025, while this relatively new Iranian crypto-asset service provider enjoyed an inflow of $4.6 million worth of USDT over the same period.

And just as we would expect the Iranians to diversify their crypto-asset service provider use, we should also expect them to spread out their risk by using other crypto-assets besides Tether’s USDT, which can be frozen.

In Figure 7., we analyze the same burgeoning Iranian crypto-asset service provider and observe deposits of ether (ETH), Paxos Gold (PAXG), and Tether (USDT) on the Ethereum blockchain.

Given the hack of Nobitex and freezes of USDT by Tether, it makes absolute sense for Iranians to diversify their token usage, instead of just limiting themselves to USDT.

What’s perhaps peculiar is the Iranian comfort with using PAXG.

PAXG, the gold-backed token issued by Paxos Trust LLC, a US-regulated trust company and an unusual choice for Iranians living under sanctions, but for now it appears to not be causing them any consternation.

In TRM Labs’ defense, volumes in USDT, the stablecoin that keeps getting seized or frozen, on Nobitex, the largest and most high profile crypto-asset exchange in Iran that was recently hacked, are indeed decreasing.

But that’s like watching the first half of The Sixth Sense, walking out of the movie theater, and deciding you knew how it ended. (Spolier Alert: Bruce Willis’ character was dead all along.)

Blockchain analytics isn’t about stating the obvious (especially where it is convenient to do so), it’s about understanding the data and being honest enough to recognize the gaps and deficiencies.

It’s important to recognize that the use of crypto-assets to evade sanctions in places such as Iran, are endeavors mainly undertaken by people who are both competent and determined.

If nothing else, the Iranian crypto-asset exchange sector seems to be getting more resilient with high growth observed across smaller entities.

Because it’s harder to hit many small targets, Iran appears to be taking a leaf out of the blockchain’s own playbook - decentralization.

Objectively this looks like the natural outcome for an ecosystem that is more or less under siege.

So no, this does not look like a system that is contained and shrinking. Life indeed finds a way.

But depending on who you ask, you won’t find what you’re not looking for.