BTC-2.76%
Market Analysis
How CoinEx Became Iran Offshore Crypto Lifeline and a Node for North Korean Funds
TRM Labs found CoinEx processed $3.84B for sanctioned Iranian entities and traced $67M in North Korean Bybit theft proceeds through the exchange.
Editorial disclosureRead more
All reviews, research, news and assessments of any kind on The Tokenist are compiled using a strict editorial review process by our editorial team. Neither our writers nor our editors receive direct compensation of any kind to publish information on tokenist.com. Our company, Tokenist Media LLC, is community supported and may receive a small commission when you purchase products or services through links on our website. Click here for a full list of our partners and an in-depth explanation on how we get paid.
In Iran CoinEx, a joint investigation by The Wall Street Journal and TRM Labs, published on June 25, 2026, revealed that the Seychelles-registered crypto exchange CoinEx processed over $3.84Bn in transactions linked to sanctioned Iranian entities from 2019 to 2026, making it Iran’s primary offshore gateway for cryptocurrency.
Notably, TRM Labs traced around $67M in funds moved by Iran’s Central Bank through CoinEx, connected to a laundering operation tied to the $1.5Bn stolen from Bybit by North Korean hackers.
On June 2, 2026, the US Treasury’s OFAC designated four Iranian exchanges for sanctions evasion, which reduced Iran’s observable crypto volume by about 78%. However, CoinEx’s offshore infrastructure remained largely unaffected.
CoinEx founder Haipo Yang stated that while the exchange is used by Iranian nationals, it has no ties to the Iranian government and has begun blocking new user registrations from Iranian IP addresses. The WSJ investigation did not claim CoinEx knowingly facilitated illegal transfers.
Iran CoinEx: How CoinEx Became Iran’s Primary Offshore Gateway Across More Than 60 Domestic Platforms
TRM Labs’ forensic analysis revealed that $2.7Bn of the $3.84Bn identified in flows moved between CoinEx and Nobitex, Iran’s largest exchange, through around 6.2 million blockchain transfers, averaging $1M per day since 2018.
By 2024, CoinEx had become Nobitex’s largest external counterparty, accounting for about 16.3% of Nobitex’s total transaction volume.
TRM found CoinEx transacting with over 60 Iranian platforms, with most routing 5–15% of their volume through CoinEx for foreign liquidity, suggesting a coordinated arrangement.
CoinEx’s illicit transaction volume was approximately 8%, significantly higher than the 0.3% benchmark for compliant exchanges.
Its Seychelles registration limits enforcement options, as it falls outside the US jurisdiction. CoinEx has faced regulatory scrutiny, including lawsuits and fines from US and international authorities.
The Bybit Hack Connection: Tracing North Korean Stolen Funds Through Iran’s Central Bank and Into CoinEx’s Address Cluster
North Korean hackers stole $1.5B from Bybit, marking the largest exchange theft by a state actor. Part of these funds was traced to wallets linked to Iran’s Central Bank (CBI) through the National Iranian Exchange (NIE).
The laundering included USDT on the TRON network and cross-chain transfers to Ethereum, eventually consolidating around CoinEx, with about $67M connected by June 2026.
Additionally, TRM reported on-chain links between Iran CoinEx wallets and accounts related to the Islamic Revolutionary Guard Corps (IRGC), tracing around $6M, alongside connections to Palestinian Islamic Jihad and Hezbollah.
TRM also identified $154M in transfers from the ViaBTC mining pool to Nobitex-linked wallets, indicating payouts to sanctioned Iranian exchanges.
Following a 2025 cyberattack on Nobitex, dormant Bitcoin mining wallets were reactivated, returning approximately $2.7M to a Nobitex hot wallet via ViaBTC.
OFAC’s June 2 Designation and the Immediate Volume Collapse: Enforcement Mechanics, Exchange Compliance Obligations, and the Jurisdictional Gap
On June 2, OFAC designated Nobitex, BitPin, Wallex, and Ramzinex as part of its third enforcement action against Iran’s crypto infrastructure in five months.
This adds them to the Specially Designated Nationals (SDN) list, requiring US entities to freeze assets and halt transactions without an OFAC license.
Following this action, Iran CoinEx flows plummeted to under $150,000, significantly down from the multi-billion-dollar annual baseline documented by TRM.
The four sanctioned exchanges had previously accounted for about $7.7Bn, or 78%, of Iran’s estimated $9.9Bn in crypto volume in 2025.
TRM noted that it was unclear if new mechanisms were created to avoid detection, highlighting a need for coordinated compliance with offshore gateways and liquidity providers to effectively address the issue.
The author does not hold or have a position in any securities discussed in the article.
Tim Baker
Tim Baker is a Senior Market Analyst at Tokenist with over a decade of experience educating readers about traditional finance, crypto and DeFi. A former equity researcher turned on-chain analyst, Tim specializes in regulatory framework shifts and institutional DeFi adoption. His work focuses on distilling complex liquidity cycles and the macro environment into actionable intelligence for the modern DIY investor.
