- Iran-linked wallets moved more than $3.84 billion through CoinEx since 2019, according to blockchain intelligence firm TRM Labs — including funds traced to the $1.5B North Korean Bybit hack that ended up in wallets attributed to Iran’s Central Bank before flowing through CoinEx.
- CoinEx replaced Binance as Nobitex’s (Iran’s largest domestic crypto exchange) largest foreign counterparty in 2024 after Binance tightened sanctions controls; more than $763 million moved between CoinEx and Nobitex last year alone.
- CoinEx wallets also transacted with accounts linked to Iran’s IRGC, an alleged Iranian oil-sales sanctions-evasion network, and Zedcex — a UK-registered exchange connected to an IRGC sanctions strategist.
- CoinEx founder Haipo Yang acknowledged widespread Iranian use but denied a government relationship; the exchange is now blocking new Iranian IP addresses and removing identified Iranian users following Nobitex’s sanctioning by the Trump administration this month.
What Happened?
A WSJ investigation using blockchain data from TRM Labs reveals how CoinEx, an eight-year-old exchange founded by former Tencent engineer Haipo Yang, became the central node in Iran’s crypto sanctions-evasion infrastructure. The exchange, now based in the Seychelles after agreeing to exit the US market following a 2023 New York AG fine, processed over $3.84 billion in transactions linked to Iranian entities since 2019. Most flows ran through Nobitex — Iran’s largest domestic exchange — with CoinEx surpassing Binance as Nobitex’s primary foreign counterparty in 2024. In one traced transaction chain, $67 million derived from North Korean hackers’ $1.5B Bybit theft was routed through Iran’s Central Bank wallets, through bridging services and DeFi swaps across multiple blockchains, and ultimately into CoinEx accounts.
Why It Matters?
The CoinEx story illustrates the structural problem with crypto-based sanctions enforcement: as the US successfully pressures major exchanges like Binance to tighten controls, illicit flows migrate to less regulated platforms operating outside US jurisdiction. The article directly connects to the broader story of China’s yuan-based financial architecture enabling sanctions evasion — crypto provides a parallel lane. Iranian entities used CoinEx to access global liquidity, convert oil revenues into usable digital assets, and reconnect with the international financial system despite SWIFT exclusion and dollar payment bans. The Bybit-to-Iran-to-CoinEx transaction chain also raises questions about whether North Korea is effectively subsidizing Iran’s sanctions-evasion operations through shared hacking proceeds.
What’s Next?
The Trump administration sanctioned Nobitex earlier this month, apparently triggering CoinEx’s decision to distance itself from Iranian users. CoinEx says it has blocked new Iranian IP registrations and is removing identified existing users — though the practical effectiveness of such measures against determined state actors using VPNs and unhosted wallets remains limited. The broader US-Iran peace talks create an odd backdrop: a sanctions architecture that Iran has largely learned to circumvent is now being used as negotiating leverage in a deal that could formalize dollar access for Iran anyway. Meanwhile, DeFi protocols, bridging services, and stablecoin layers that obscured the Bybit-to-CoinEx transaction trail remain largely outside the regulatory perimeter.
Source: The Wall Street Journal
