Iran-linked entities moved $3.84 billion through cryptocurrency exchange CoinEx between 2019 and 2026, according to blockchain analysis by TRM Labs cited in a Wall Street Journal investigation published June 25, 2026. The flows traversed more than 60 Iranian entities, with CoinEx serving as the p...
"Treasury will continue to follow the money in support of Economic Fury, whether it is through the banking system or through digital assets, to prevent the regime from developing a nuclear weapon." — Scott Bessent, U.S. Treasury Secretary
Iran-linked entities moved $3.84 billion through cryptocurrency exchange CoinEx between 2019 and 2026, according to blockchain analysis by TRM Labs cited in a Wall Street Journal investigation published June 25, 2026. The flows traversed more than 60 Iranian entities, with CoinEx serving as the primary off-ramp from Iran's domestic exchange Nobitex to global crypto markets. TRM Labs identified $763 million in bilateral flows between Nobitex and CoinEx in the peak year alone.
The investigation surfaced a connection between CoinEx and $67 million in proceeds from North Korea's $1.5 billion Bybit hack of February 2025, with funds traced through two Central Bank of Iran wallets before being deposited into CoinEx accounts and commingled with other deposits. On June 2, 2026, the U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned Nobitex and three other Iranian exchanges — Wallex, Bitpin, and Ramzinex — under the "Economic Fury" campaign.
CoinEx, a Seychelles-registered exchange founded in 2017 by former Tencent engineer Haipo Yang, has not been directly sanctioned. The exchange acknowledged widespread Iranian usage but denied ties to the Iranian government, stating it operates transaction-monitoring systems and screens high-risk users. CoinEx has since blocked new signups from Iranian IP addresses.
TRM Labs built its estimate by analyzing on-chain activity across wallets tied to more than 60 Iranian entities. The $3.84 billion figure represents traceable flows since 2019; the actual volume is likely higher due to privacy tools and peer-to-peer transactions that evade on-chain forensics.
The scale is notable in context. Chainalysis reported a 694% surge in state-driven sanctions evasion volume during 2025, with the Islamic Revolutionary Guard Corps (IRGC) and its proxy networks accounting for over 50% of value received from Iranian addresses in Q4 2025. Total Iranian state-linked crypto transfers exceeded $3 billion in 2025 alone, according to Chainalysis.
CoinEx's role as conduit is distinct from the decentralized mixing and bridging services typically associated with sanctions evasion. As a centralized exchange with a corporate domicile, banking relationships, and a compliance desk, CoinEx maintained the infrastructure to screen transactions. A $3.84 billion flow over seven years through a single centralized venue raises direct questions about the exchange's transaction-monitoring capabilities and willingness to act on flagged activity.
USDT stablecoins were the primary asset transferred. The choice of Tether's dollar-pegged token for sanctions evasion is consistent with broader patterns documented by blockchain analytics firms: stablecoins provide dollar-denominated liquidity without requiring access to the U.S. banking system.
Nobitex, Iran's largest domestic crypto exchange, processed over 50% of all Iranian digital asset inflows in 2025, according to Treasury Department findings. The exchange served as the primary on-ramp for Iranian entities seeking dollar-denominated crypto exposure.
The flow pattern was straightforward: Iranian entities converted rials to crypto on Nobitex, moved assets through intermediary wallets to obscure origin, and deposited them at CoinEx for conversion to globally liquid assets or fiat withdrawal. CoinEx became Nobitex's largest foreign counterparty by 2024, filling a gap left when Binance tightened compliance controls and reduced exposure to Iranian-linked flows.
TRM Labs traced direct transactions between CoinEx wallets and accounts that U.S. officials have since linked to the IRGC. OFAC's designation documents stated that Nobitex facilitated transactions for IRGC-affiliated ransomware actors and helped the Central Bank of Iran access hundreds of millions in stablecoins.
The bilateral relationship between the two exchanges intensified over time. The $763 million peak annual flow between Nobitex and CoinEx represented a concentration of counterparty exposure that would typically trigger enhanced due diligence at compliant exchanges.
The most consequential finding in the TRM Labs analysis involves proceeds from the Bybit hack. On February 21, 2025, North Korea's Lazarus Group stole approximately $1.5 billion from Bybit — the largest single theft in cryptocurrency history. The FBI confirmed the attribution and released 51 Ethereum addresses used to launder the stolen funds.
Investigators traced $67 million from the Bybit hack proceeds to two wallets controlled by the Central Bank of Iran. The funds were forwarded to CoinEx deposit accounts and then transferred into a CoinEx treasury wallet, where they were commingled with other user deposits. At that point, the on-chain trail became untraceable.
The connection between North Korean theft proceeds and Iranian state wallets raises questions about the intersection of two distinct sanctions regimes. North Korea stole more than $2 billion in crypto during 2025, according to Chainalysis, with stolen funds used to finance weapons development. Iran's apparent receipt of a portion of those funds suggests cross-pollination between sanctioned state actors in the crypto ecosystem.
The commingling of $67 million in hack proceeds with legitimate deposits in a CoinEx treasury wallet is particularly significant. Treasury wallets are exchange-controlled omnibus accounts; once funds enter, they lose individual identity. This mechanism effectively launders provenance, making further tracing impossible without the exchange's internal records.
On June 2, 2026, OFAC designated Nobitex, Wallex, Bitpin, and Ramzinex under Executive Orders 13224 and 13902. The action was the Treasury Department's largest against Iran's digital asset economy.
The designations included four named individuals:
The Kharrazi family connection is significant. Members of the Aghamir family belong to the network of Supreme Leader Ali Khamenei, placing Nobitex's co-founders within the senior echelons of the Iranian regime. This is not a case of inadvertent exposure; according to OFAC, the exchange's founders maintained direct ties to regime leadership.
Wallex accounted for 12% of Iranian digital asset inflows in 2025. Bitpin processed 10% and handled millions in IRGC-linked transactions. Ramzinex processed over $2.45 billion in total transactions since 2018.
Treasury Secretary Scott Bessent stated that total U.S. cryptocurrency recovered from Iranian exchanges and wallets since the start of the Economic Fury campaign reached approximately $1 billion.
CoinEx was not included in the June 2 designations. The exchange remains unsanctioned, though the WSJ report and TRM Labs analysis published three weeks later place it at the center of the same flow network.
CoinEx's regulatory history predates the Iran revelations. The exchange has accumulated enforcement actions across multiple jurisdictions.
In June 2023, CoinEx settled with the New York Attorney General for $1.7 million in fines and refunds for operating as an unregistered broker-dealer. The settlement required CoinEx to block all U.S. IP addresses. The exchange's U.S. Money Services Business license was revoked.
In September 2023, CoinEx suffered a $54 million hack attributed to North Korea's Lazarus Group — the same entity responsible for the Bybit theft. The exchange compensated affected users but the breach raised questions about its security infrastructure.
CoinEx is registered in Estonia (since 2019) and Poland (since 2024) but is banned from operating in the United States, mainland China, Canada, and Hong Kong.
The exchange's founder Haipo Yang told the Wall Street Journal that CoinEx was widely used by Iranian users but denied ties to the Iranian government. Yang said the exchange acted after "realizing that the stakes were getting higher." CoinEx has since announced enhanced KYC measures and blocked new Iranian signups.
The timeline presents a compliance gap. CoinEx was Nobitex's largest foreign counterparty by 2024, yet enhanced compliance measures were announced only after public reporting in June 2026. Whether the exchange's transaction-monitoring systems flagged Iranian flows during the intervening period — and what action was taken — remains unclear.
The CoinEx case surfaces a structural problem in crypto exchange compliance. Centralized exchanges operate KYC and AML programs specifically to screen for sanctioned counterparties. When $3.84 billion in sanctioned-jurisdiction flows passes through a single venue over seven years, the question shifts from "did the exchange know" to "what did its systems detect and when."
Three structural factors enabled the flow:
Jurisdictional arbitrage. CoinEx operates from the Seychelles, outside the direct enforcement reach of U.S. regulators. OFAC designations apply to U.S. persons and the U.S. financial system; non-U.S. exchanges face secondary sanctions risk but not direct regulatory authority.
Compliance displacement. When Binance tightened controls on Iranian-linked flows, the activity migrated to CoinEx rather than ceasing. This pattern — compliant exchanges shedding risk that migrates to less-compliant venues — is well-documented in traditional finance and appears to replicate in crypto markets.
Stablecoin opacity. USDT transfers between exchanges can be difficult to attribute to sanctioned entities when intermediary wallets break the direct on-chain link between origin and destination. The CBI-to-CoinEx flows used intermediary wallets specifically to obscure provenance.
The case may accelerate regulatory pressure on offshore exchanges. U.S. enforcement agencies have expanded their toolkit: the DOJ's recent seizure of Huione infrastructure (for $134 billion in total crypto flows) and OFAC's Iranian exchange designations suggest a pattern of increasing willingness to pursue non-U.S. venues handling sanctioned flows.
The CoinEx-Iran pipeline represents a case study in centralized exchange compliance failure — or, at minimum, compliance delay. A $3.84 billion flow over seven years through a single venue with corporate infrastructure, banking relationships, and stated KYC programs is difficult to attribute to mere oversight.
The connection between North Korean hack proceeds and Iranian state wallets adds a layer of complexity. Two of the most heavily sanctioned states in the world appear to have intersected through the same crypto exchange, with $67 million in stolen Bybit funds traced through the Central Bank of Iran to CoinEx treasury wallets.
OFAC's sanctioning of Nobitex and three other Iranian exchanges on June 2 removed the domestic end of the pipeline. Whether CoinEx faces similar designation remains to be seen. The exchange's belated compliance measures — blocking Iranian signups and enhancing KYC after seven years of documented flows — may prove insufficient if enforcement agencies conclude that the exchange's monitoring systems should have flagged the activity years earlier.
The broader implication is clear: when a compliant exchange tightens controls, sanctioned flows do not disappear. They migrate. Until enforcement reaches the next venue in the chain, the pipeline simply reroutes. The CoinEx case demonstrates that crypto sanctions enforcement is only as effective as its weakest compliant node.