Sidebar · Context
The Two Faces of June 2
One OFAC designation, two very different infrastructure responses, easy to conflate and important to keep apart.
2026-06-02 · OFAC designations
Laundering side
WSJ · TRM Labs
What
The real CoinEx as an on-chain conduit for Iranian illicit cash.
Evidence
Blockchain flows: $3.84B Iran to CoinEx since 2019.
Actor
A complicit exchange moving the money.
After 06-02
Flows fell to under $150K; Iranian-IP blocks.
Phishing side
This report · CrimsonVector
What
Fake login sites harvesting credentials and seed phrases.
Evidence
CT certificates, DNS, a kit fingerprint.
Actor
An anonymous operator preying on the users.
After 06-02
Onset on 06-02; a ~640-domain, ~60-exchange platform.
Bottom
line
TRM follows the money out; we map the predators that moved in.
The coinex-iran[.]com / coinex-arabic[.]com domains in our indicators are phishing lookalikes, not CoinEx.