How CoinEx Became Iran Offshore Crypto Lifeline and a Node for North Korean Funds
In Iran CoinEx, a joint investigation by The Wall Street Journal and TRM Labs, published on June 25, 2026, revealed that the Seychelles-registered crypto exchange CoinEx processed over $3.84Bn in transactions linked to sanctioned Iranian entities from 2019 to 2026, making it Iran’s primary offshore gateway for cryptocurrency.
Notably, TRM Labs traced around $67M in funds moved by Iran’s Central Bank through CoinEx, connected to a laundering operation tied to the $1.5Bn stolen from Bybit by North Korean hackers.
On June 2, 2026, the US Treasury’s OFAC designated four Iranian exchanges for sanctions evasion, which reduced Iran’s observable crypto volume by about 78%. However, CoinEx’s offshore infrastructure remained largely unaffected.
CoinEx founder Haipo Yang stated that while the exchange is used by Iranian nationals, it has no ties to the Iranian government and has begun blocking new user registrations from Iranian IP addresses. The WSJ investigation did not claim CoinEx knowingly facilitated illegal transfers.
Iran CoinEx: How CoinEx Became Iran’s Primary Offshore Gateway Across More Than 60 Domestic Platforms
TRM Labs’ forensic analysis revealed that $2.7Bn of the $3.84Bn identified in flows moved between CoinEx and Nobitex, Iran’s largest exchange, through around 6.2 million blockchain transfers, averaging $1M per day since 2018.
By 2024, CoinEx had become Nobitex’s largest external counterparty, accounting for about 16.3% of Nobitex’s total transaction volume.
TRM found CoinEx transacting with over 60 Iranian platforms, with most routing 5–15% of their volume through CoinEx for foreign liquidity, suggesting a coordinated arrangement.
CoinEx’s illicit transaction volume was approximately 8%, significantly higher than the 0.3% benchmark for compliant exchanges.
Its Seychelles registration limits enforcement options, as it falls outside the US jurisdiction. CoinEx has faced regulatory scrutiny, including lawsuits and fines from US and international authorities.
The Bybit Hack Connection: Tracing North Korean Stolen Funds Through Iran’s Central Bank and Into CoinEx’s Address Cluster
North Korean hackers stole $1.5B from Bybit, marking the largest exchange theft by a state actor. Part of these funds was traced to wallets linked to Iran’s Central Bank (CBI) through the National Iranian Exchange (NIE).
The laundering included USDT on the TRON network and cross-chain transfers to Ethereum, eventually consolidating around CoinEx, with about $67M connected by June 2026.
Additionally, TRM reported on-chain links between Iran CoinEx wallets and accounts related to the Islamic Revolutionary Guard Corps (IRGC), tracing around $6M, alongside connections to Palestinian Islamic Jihad and Hezbollah.
TRM also identified $154M in transfers from the ViaBTC mining pool to Nobitex-linked wallets, indicating payouts to sanctioned Iranian exchanges.
Following a 2025 cyberattack on Nobitex, dormant Bitcoin mining wallets were reactivated, returning approximately $2.7M to a Nobitex hot wallet via ViaBTC.
OFAC’s June 2 Designation and the Immediate Volume Collapse: Enforcement Mechanics, Exchange Compliance Obligations, and the Jurisdictional Gap
On June 2, OFAC designated Nobitex, BitPin, Wallex, and Ramzinex as part of its third enforcement action against Iran’s crypto infrastructure in five months.
This adds them to the Specially Designated Nationals (SDN) list, requiring US entities to freeze assets and halt transactions without an OFAC license.
Following this action, Iran CoinEx flows plummeted to under $150,000, significantly down from the multi-billion-dollar annual baseline documented by TRM.
The four sanctioned exchanges had previously accounted for about $7.7Bn, or 78%, of Iran’s estimated $9.9Bn in crypto volume in 2025.
TRM noted that it was unclear if new mechanisms were created to avoid detection, highlighting a need for coordinated compliance with offshore gateways and liquidity providers to effectively address the issue.
The author does not hold or have a position in any securities discussed in the article.
The post How CoinEx Became Iran Offshore Crypto Lifeline and a Node for North Korean Funds appeared first on Tokenist.
