A new investigation has found that wallets linked to Iranian entities moved more than $3.84 billion through cryptocurrency exchange CoinEx between 2019 and 2026, highlighting the growing role of digital assets in navigating international sanctions.
According to a report by The Wall Street Journal, blockchain intelligence firm TRM Labs identified extensive transaction activity involving CoinEx, Iran’s largest domestic crypto exchange Nobitex, and wallets allegedly connected to state-linked organizations, including Iran’s Central Bank and entities associated with the Islamic Revolutionary Guard Corps (IRGC).
The findings come as regulators intensify scrutiny of cryptocurrency platforms that may facilitate cross-border transfers involving sanctioned jurisdictions.
CoinEx Emerged as Major Foreign Counterparty
TRM Labs’ analysis of public blockchain data showed that CoinEx became Nobitex’s largest foreign transaction partner by 2024. The exchange reportedly surpassed Binance in that role after Binance faced enforcement actions related to sanctions compliance.
Investigators said transaction volumes between CoinEx and Nobitex increased significantly over recent years, reaching hundreds of millions of dollars annually. The report also noted that average transfer sizes rose during periods of internet disruption in Iran earlier this year.
North Korean Hack Funds Allegedly Passed Through Iranian Wallets
Among the most notable findings, investigators traced portions of cryptocurrency stolen during the $1.5 billion Bybit hack to wallets attributed to Iran’s Central Bank.
According to the report, the funds were routed through a series of blockchain bridges, smart contract swaps and self-custodied wallets before eventually reaching CoinEx deposit addresses. One traced transaction path reportedly involved approximately $67 million.
The investigation did not allege that CoinEx knowingly facilitated the transfers.
Transactions Linked to Sanctioned Networks
The report also identified historical transactions involving wallets later associated with the IRGC and individuals connected to sanctioned oil-trading networks.
TRM Labs said CoinEx-linked addresses interacted with accounts connected to Alireza Derakhshan, who has been linked by U.S. authorities to a sanctioned Iranian oil sales network. Investigators also cited transactions involving Zedcex, a platform associated with individuals accused of helping sanctioned entities evade restrictions.
The blockchain analytics firm further reported limited exposure to other sanctioned organizations.
CoinEx Rejects Government Ties
CoinEx founder Haipo Yang told The Wall Street Journal that the platform has been widely used by Iranian users but denied any relationship with the Iranian government.
The exchange said it maintains transaction monitoring systems and conducts screening of high-risk users. CoinEx added that it has launched an internal review related to the Bybit hack-linked transactions highlighted in the investigation.
The company also stated that it has begun restricting new registrations from Iranian IP addresses and removing identifiable users linked to Iran from the platform.
CoinEx disputed portions of TRM Labs’ methodology, arguing that transaction volumes may have been overstated when compared with estimates from other blockchain analytics providers.
Crypto Remains Critical to Iran’s Financial Ecosystem
Iran has increasingly embraced cryptocurrency as both individuals and businesses seek alternatives to traditional financial channels restricted by international sanctions.
Industry estimates cited by the report suggest the country’s crypto market is valued between $8 billion and $10 billion, with roughly 13% of the population holding digital assets. While cryptocurrencies provide a hedge against the weakening rial for many citizens, authorities have long expressed concerns that digital assets can also be used to facilitate international transfers outside conventional banking networks.
Earlier this month, U.S. authorities sanctioned Nobitex and several other Iranian crypto-related entities as part of a broader enforcement effort targeting sanctions evasion.
The latest findings underscore the ongoing challenge facing regulators and blockchain investigators. While public blockchains offer unprecedented transparency, identifying wallet ownership and enforcing sanctions across decentralized networks remains a complex task.
