Earlier this year, crypto sleuths found an alarming series of transactions tied to two digital wallets controlled by the Central Bank of Iran.
Tracing backward, investigators discovered the wallet’s funds were linked to $1.5 billion that North Korean hackers stole from the crypto exchange Bybit. After reaching the Iranian wallets, the money flowed through a complex maze of transactions. One destination was a crypto exchange that has become key to Iran’s ability to use cryptocurrency to evade far-reaching U.S. economic sanctions.
CoinEx, an 8-year-old exchange founded by a Chinese engineer, has played a growing role in connecting Iran’s crypto operations to the wider world, blockchain data shows. Since 2019, wallets with an identifiable link to Iran have moved more than $3.84 billion through CoinEx, according to blockchain intelligence firm TRM Labs.
Among its dealings, wallets hosted by the exchange have received hacked crypto acquired by Iran’s Central Bank and transacted directly with accounts that U.S. officials have since attributed to the country’s Revolutionary Guard, that analysis shows.
Haipo Yang, a former Tencent engineer who runs one of the world’s largest bitcoin mining pools, launched CoinEx from Hong Kong in 2017. In text messages with The Wall Street Journal, Yang acknowledged that the exchange had been widely used by Iranians, but said it doesn’t have a relationship with the Iranian government.
CoinEx, which is now based in the African island of Seychelles, maintains a transaction monitoring system, screens for high-risk users and this month began taking steps to distance itself from the Iranian market, including by blocking new users with Iranian IP addresses, Yang said.
A CoinEx spokesperson said the exchange would conduct an internal review of the transactions linking funds with the Bybit hack.
The ability of Iranians to use CoinEx highlights the difficulty the U.S. faces enforcing sanctions against the Islamic Republic. The country has publicly embraced cryptocurrency, and the industry provides a range of sometimes obscure platforms operating largely outside the reach of the U.S. that connect Iran’s domestic economy to the global crypto ecosystem.
CoinEx is one of them, having agreed to exit from the U.S. market after being fined in 2023 by New York’s attorney general.
The U.S. is currently negotiating a peace-deal with Iran that could include significantly easing its economic restrictions on Iran. It had previously threatened to extend sanctions against foreign financial institutions that support Iran’s activities.
The U.S. has tried to limit crypto exchanges working with Iran.
In 2023, the U.S. penalized Binance, the world’s largest crypto exchange which has a business in the U.S., in part for allowing Iranian customers to use the exchange. Binance for years had been the largest counterparty to Iran’s largest domestic crypto exchange, Nobitex, blockchain data shows.
That exposure began to fall in 2022, as Binance said it took steps to improve its sanctions controls. By 2024, CoinEx had replaced Binance as the largest foreign counterparty to Nobitex, according to the blockchain data.
Nobitex was sanctioned by the Trump administration earlier this month for allegedly supporting Iran’s government. Its representatives didn’t respond to requests for comment.
More crypto flowed from Nobitex to CoinEx than was routed back into the Iranian exchange, according to TRM’s findings. From CoinEx, Iranian users gained access to the wider crypto ecosystem, including Binance.
Digital assets are popular among everyday Iranians who want to trade cryptocurrencies for profit, while at the same time protecting themselves against the deterioration of Iran’s physical currency, the rial. Researchers have estimated that around 13% of Iran’s population own crypto, participating in a market valued at between $8 billion to $10 billion in 2025.
CoinEx began to build a presence within Iran in the years after its launch and has at times employed business-development managers in the country to recruit users, according to former employees. The CoinEx spokesperson said the company never established an office in Iran and denied knowingly hiring business-development personnel.
Along the way, it also became a favored channel for Iran’s shadow banking system.
While transactions on the blockchain are public, who holds the key to any particular digital wallet isn’t. Mapping out the obscure corners of the ecosystem and attributing specific wallets to Iran’s government or anyone else can be difficult and has created a market for firms like TRM. Blockchain analytics firms use public data, human sources and analytical indicators to map out wallets, though their findings can vary.
To examine CoinEx’s business footprint in Iran, TRM analyzed activity by crypto wallets that it has tied to more than 60 Iranian entities.
Most of the money that has flowed between Iran and CoinEx has come through Nobitex, with more than $763 million moving between the two last year, according to TRM’s analysis.
CoinEx said TRM’s aggregation of volumes that went back and forth was misleading and that volume estimates from a separate third-party provider were lower. It also said the findings of any single blockchain analytics platform shouldn’t be treated as definitive. The volume estimates it provided still ranked the exchange as Nobitex’s largest counterparty in 2025.
Other entities that have transacted with CoinEx wallets have been linked by U.S. officials to Iran’s Islamic Revolutionary Guard Corps. Between 2022 and 2025, for example, wallets hosted by CoinEx processed transactions for Alireza Derakhshan, an Iranian allegedly involved in an oil sales network sanctioned by the U.S. last year.
CoinEx wallets also sent and received money from wallets attributed to Zedcex, an exchange registered to a central London office that has been connected to Babak Zanjani, an Iranian businessman who has identified himself as a strategist for the IRGC’s sanctions evasion operations.
The Journal reviewed the transactions related to Derakhshan and Zedcex using publicly available blockchain explorers.
The U.S. Treasury Department last year sanctioned a network accused of processing more than $100 million worth of crypto stemming from Iranian oil sales, including Derakhshan. In January, it also sanctioned Zedcex and Zanjani. The transactions involving CoinEx occurred before the Treasury actions.
Zanjani on social media has said the sanctions indicate “the effectiveness of our economic activities.” A spokesperson also previously told the Journal that he “has neither required nor relied upon any cryptocurrency exchange for the purpose of money laundering or sanction evasion.”
Derakhshan couldn’t be reached for comment.
The CoinEx spokesperson denied facilitating direct transactions on behalf of Iranian or sanctioned entities.
Iran’s cryptocurrency market was severely disrupted in late February, when coordinated attacks by U.S. and Israeli military prompted Iranian authorities to suspend most internet access. Iranian crypto users who spoke to the Journal said they weren’t able to access CoinEx.
But during the bombings and monthslong internet blackout, the average size of transactions flowing between CoinEx and Nobitex actually increased, according to TRM’s analysis.
CoinEx said it didn’t observe the same increase in the size of transactions and that it wasn’t possible to attribute the activity to government or state-sanctioned actors.
CoinEx in recent weeks began taking actions to distance itself from the Iranian market. Persian-language social-media accounts informed users that the exchange was implementing new customer identification procedures.
Yang said CoinEx wouldn’t accept any new Iran users and was removing prior Iranian users it could identify. The exchange took the new measures following the Nobitex sanctions after “realizing that the stakes were getting higher,” he said. The Persian-language social-media accounts will be closed, he said.
Write to Dylan Tokar at dylan.tokar@wsj.com
