What began as a crypto heist operated from North Korea spiralled into a web of transactions linked to Iran’s central bank!The trail started with investigators tracking the movement of the $1.5 billion stolen from Bybit across the crypto ecosystem. Along the way, they found two wallets linked to the Central Bank of Iran, before the funds eventually made their way to CoinEx, one of the key stops in the money trail.The findings have drawn attention to the growing role of cryptocurrency in Iran and the challenges authorities face in monitoring digital assets that move across borders and outside traditional financial systems.Earlier this year, crypto investigators identified a series of transactions connected to two wallets controlled by Iran’s central bank. By tracing the movement of funds, they found links to the $1.5 billion stolen from Bybit by North Korean hackers, Wall Street Journal reported. After passing through the Iranian wallets, the funds were routed through several platforms as part of a complex chain of transactions.
CoinEx: A key link
Among those platforms was CoinEx, a cryptocurrency exchange launched in 2017 by Chinese engineer Haipo Yang. Blockchain data cited by WSJ, suggests the exchange has become a major gateway for Iranian crypto users.According to blockchain intelligence firm TRM Labs, wallets linked to Iran have moved more than $3.84 billion through CoinEx since 2019. The firm also found that wallets hosted by the exchange received hacked crypto linked to Iran’s central bank and interacted with accounts that US officials have attributed to Iran’s Islamic Revolutionary Guard Corps (IRGC).Yang, who previously worked as an engineer at Tencent and also operates a major bitcoin mining pool, told The Wall Street Journal that CoinEx has been widely used by Iranians but denied any connection to the Iranian government.CoinEx, now based in Seychelles, said it uses monitoring systems to identify risky activity and has recently begun limiting access from Iran, including blocking new users with Iranian IP addresses. The exchange also said it would review transactions linked to the Bybit hack.
Crypto boom in Iran
The rise of crypto use in Iran has been fuelled by both investment demand and efforts by citizens to protect savings from the weakening rial. Researchers estimate that around 13% of Iranians own cryptocurrency, with the country’s crypto market valued at between $8 billion and $10 billion in 2025.Former employees told The Wall Street Journal that CoinEx began building a presence in Iran shortly after its launch and hired staff in the country to help expand its user base. Over time, the exchange also became integrated into Iran’s informal financial networks operating alongside conventional banking channels.
Sanctions challenges and Iran’s crypto network
The case also highlights the difficulties faced by the United States in enforcing sanctions on Iran, where cryptocurrency has become increasingly popular and many trading platforms operate beyond US jurisdiction.CoinEx had already exited the US market after being fined by New York’s attorney general in 2023. Other exchanges have also faced scrutiny. Binance was penalised in 2023 for allowing Iranian users to access its platform.Blockchain data shows Binance was once the largest foreign partner of Iran’s domestic crypto exchange Nobitex. However, that relationship weakened after Binance tightened compliance measures in 2022.By 2024, CoinEx had become Nobitex’s largest foreign counterparty. Earlier this month, the Trump administration sanctioned Nobitex, alleging that it supported the Iranian government.TRM Labs data suggests more money flowed from Nobitex to CoinEx than in the other direction, allowing Iranian users to access a broader network of cryptocurrency platforms, including Binance.
Links to sanctioned individuals and entities
The investigation also identified transactions involving CoinEx-hosted wallets and individuals or entities sanctioned by US authorities. Between 2022 and 2025, CoinEx wallets processed activity linked to Alireza Derakhshan, whom US authorities say was part of an oil sales network sanctioned last year.CoinEx wallets also interacted with Zedcex, a London-registered exchange linked to Iranian businessman Babak Zanjani, who has been associated with IRGC-linked sanctions evasion operations.The US Treasury has previously sanctioned networks connected to more than $100 million in cryptocurrency generated from Iranian oil sales, including Derakhshan. Back in January, it also sanctioned Zedcex and Zanjani. The transactions involving CoinEx occurred before those sanctions were imposed.Zanjani has said on social media that sanctions show “the effectiveness of our economic activities.” His spokesperson also said he has not used crypto exchanges for money laundering or sanctions evasion.
