Crypto exchange CoinEx processed more than $3.84 billion in transactions linked to Iranian entities since 2019, according to a Wall Street Journal report citing blockchain analytics firm TRM Labs and public on-chain data. Investigators traced funds from wallets identified as controlled by the Central Bank of Iran to assets stolen in the 2025 Bybit hack, which the FBI attributed to North Korean hackers. While CoinEx has not been accused of wrongdoing or faced new US enforcement action, the findings highlight ongoing scrutiny of crypto exchanges' anti-money laundering and sanctions compliance measures as US authorities increase pressure on Iran's cryptocurrency ecosystem.
WSJ Investigation Links CoinEx to Iran-Related Transactions
The Wall Street Journal reported that CoinEx allegedly became one of the primary channels used by Iran-linked entities to move digital assets beyond the reach of US sanctions. The report focuses on blockchain activity involving two crypto wallets that investigators identified as being controlled by the Central Bank of Iran. Analysts reportedly traced the movement of funds from these wallets and found connections to crypto that was stolen during the 2025 hack of crypto exchange Bybit.
Investigators reportedly followed the transaction trail backward from the Iranian central bank wallets and eventually linked the funds to assets stolen during the Bybit breach. The stolen cryptocurrency is said to have passed through numerous wallets and transactions before eventually reaching CoinEx.
FBI Attributes Bybit Hack to North Korean Hackers
The Bybit hack is one of the largest crypto thefts on record. The US Federal Bureau of Investigation previously attributed the attack to North Korean hacking groups and alleged that the stolen assets were laundered through an extensive network of wallets before being converted into Bitcoin and other cryptocurrencies.
After the exchange hack, blockchain investigators reported that decentralized protocol THORChain processed close to $3 billion in swap volume linked to the stolen funds. Unlike decentralized protocols, centralized exchanges like CoinEx are generally expected to implement customer verification and transaction monitoring systems designed to detect suspicious activity.
US Treasury Sanctions Iranian Crypto Exchanges
US authorities are increasing pressure on Iran's cryptocurrency ecosystem. Earlier this year, the US Treasury sanctioned four Iranian cryptocurrency exchanges, including Nobitex, as part of its Economic Fury campaign. Officials alleged that these platforms enabled sanctioned individuals and organizations to access digital asset markets despite existing financial restrictions.
Blockchain analytics company Chainalysis has also reported that Nobitex accounts for roughly half of Iran's crypto trading activity.
CoinEx Faces Regulatory Scrutiny
While CoinEx has not been accused of wrongdoing by US authorities or subjected to new enforcement action, the report raised serious questions about the exchange's anti-money laundering controls and sanctions screening procedures. Although the Wall Street Journal report does not allege that CoinEx knowingly facilitated sanctions evasion or money laundering, the findings are likely to draw regulatory attention.
FAQ
What did the Wall Street Journal report about CoinEx?
The Wall Street Journal reported that CoinEx processed more than $3.84 billion in transactions linked to Iranian entities since 2019, according to blockchain analytics firm TRM Labs and public on-chain data. Investigators traced funds from wallets identified as controlled by the Central Bank of Iran to assets stolen in the 2025 Bybit hack.
Who attributed the Bybit hack to North Korean hackers?
The US Federal Bureau of Investigation attributed the 2025 Bybit hack to North Korean hacking groups. The FBI alleged that the stolen assets were laundered through an extensive network of wallets before being converted into Bitcoin and other cryptocurrencies.
What sanctions did the US Treasury impose on Iranian crypto exchanges?
Earlier this year, the US Treasury sanctioned four Iranian cryptocurrency exchanges, including Nobitex, as part of its Economic Fury campaign. Officials alleged that these platforms enabled sanctioned individuals and organizations to access digital asset markets despite existing financial restrictions.
