Iran-linked wallets moved more than $3.84 billion through CoinEx since 2019, according to a Wall Street Journal investigation that cited blockchain intelligence firm TRM Labs. The report said the Seychelles-based exchange emerged as a key off-ramp for Iranian entities after larger global platforms tightened compliance controls and pushed suspect flows toward smaller venues.
Bybit hack proceeds were traced to Iran-linked wallets
The case drew wider attention because investigators linked it to a major crypto theft. Earlier this year, two wallets said to be controlled by Iran’s central bank were flagged for unusual on-chain activity. Tracing later showed those wallets had received funds tied to the $1.5 billion Bybit hack, an attack the FBI has attributed to North Korean state-backed hackers.
The stolen assets did not move straight into those wallets. Investigators said the funds passed through a network of bridges and DeFi protocols before reaching accounts linked to Iran’s central bank and then CoinEx. That multi-hop structure obscures the source of funds and makes real-time screening much harder for centralized exchanges.
CoinEx and Nobitex described as a key corridor
The Wall Street Journal report also connected CoinEx-related flows to Nobitex, Iran’s largest domestic crypto exchange. The report said the U.S. Treasury sanctioned Nobitex in June 2026 under its Economic Fury campaign. Chainalysis estimated that Nobitex handled roughly half of all Iranian crypto trading activity.
Investigators described CoinEx and Nobitex as Iran’s most active two-exchange corridor for moving value beyond the reach of the U.S. financial system. The laundering trail tied to the Bybit hack also ran through THORChain, where the report said swap volume connected to the stolen assets reached nearly $3 billion. The pattern shows how funds can move back and forth between decentralized protocols and centralized exchanges before any cash-out attempt.
CoinEx response and regulatory pressure
CoinEx denied direct ties to the Iranian government and challenged the volume figures as misleading. The exchange said it had started blocking new Iranian users and planned to review the traced funds linked to the Bybit hack. No new U.S. sanctions action against CoinEx had been announced at the time of publication.
Still, the report said U.S. authorities are widening their focus on crypto platforms with Iran-linked exposure, including those outside the United States. Treasury has warned foreign financial institutions that significant dealings with designated Iranian crypto platforms could create secondary sanctions risk. Even without a direct OFAC action, that stance could put pressure on an exchange’s global banking relationships.
Key figures cited in the report
Beyond the $3.84 billion figure, the report listed several other data points tied to Iranian crypto activity: total Iranian crypto activity in 2025 was estimated at $8 billion to $10 billion; recent U.S. enforcement actions seized about $1 billion in Iran-linked crypto; and $344 million in USDT was frozen across two Tron wallets tied to Iran’s IRGC.