An investigation into cryptocurrency transactions by the Wall Street Journal has uncovered a complicated trail involving Iranian-linked wallets, North Korean hackers and a crypto exchange that has become an important part of Iran’s digital financial network.
Earlier this year, blockchain researchers tracking two wallets controlled by the Central Bank of Iran found that the funds inside them could be traced back to the $1.5 billion crypto theft from exchange Bybit, allegedly carried out by North Korean hackers.
After entering the Iranian-linked wallets, the stolen funds moved through multiple transactions before reaching different platforms, including one exchange that has emerged as a major route for Iran’s cryptocurrency activity amid strict US sanctions.
CoinEx’s Role In Iran’s Crypto Ecosystem
The exchange at the centre of the investigation is CoinEx, a platform founded eight years ago by a Chinese engineer.
According to blockchain intelligence company TRM Labs, wallets connected to Iranian entities moved more than $3.84 billion through CoinEx since 2019.
Cryptocurrency has become increasingly popular in Iran, not only among traders looking for profits but also among people trying to protect their savings as the Iranian rial continues to lose value. Researchers estimate that nearly 13 per cent of Iran’s population owns crypto, with the country’s crypto market estimated to be worth between $8 billion and $10 billion in 2025.
CoinEx expanded its presence in Iran after its launch and, according to former employees, had business-development managers in the country at times to attract users. According to the report, the company denied this, saying it never opened an office in Iran and did not knowingly employ local business-development staff.
A Possible Link To Iran’s Shadow Financial Network
Although blockchain transactions are visible publicly, identifying who controls a specific wallet is much harder.
Companies such as TRM Labs attempt to connect wallets to individuals, organisations and governments by studying blockchain activity, public records, human sources and other indicators. However, such analysis can differ between firms.
For its review of CoinEx’s Iranian connections, TRM studied activity involving wallets it linked to more than 60 Iranian entities.
The analysis found that a large share of the money moving between Iran and CoinEx involved Nobitex, Iran’s biggest crypto exchange. More than $763 million reportedly moved between the two platforms last year.
CoinEx rejected TRM’s findings, saying the company’s calculation of transaction volumes was misleading. It said another third-party estimate showed lower figures and argued that the findings of a single blockchain analytics firm should not be considered conclusive.
However, the exchange’s own figures still showed Nobitex as its biggest counterparty in 2025.
Transactions Linked To Sanctioned Networks
Some wallets that interacted with CoinEx have also been connected by US officials to Iranian-linked networks.
Between 2022 and 2025, CoinEx-hosted wallets processed transactions involving Alireza Derakhshan, an Iranian figure accused by the US of being part of an oil sales network that was later sanctioned.
CoinEx wallets also exchanged funds with wallets linked to Zedcex, a crypto exchange registered in London that has been associated with Iranian businessman Babak Zanjani, who has described himself as a strategist for Iran’s sanctions-evasion efforts.
The US Treasury later sanctioned a network accused of handling more than $100 million in cryptocurrency linked to Iranian oil sales, including Derakhshan. In January, it also sanctioned Zedcex and Zanjani. The transactions involving CoinEx took place before those sanctions were announced.
Zanjani said on social media that the sanctions showed “the effectiveness of our economic activities”. A spokesperson previously told the Journal that he “has neither required nor relied upon any cryptocurrency exchange for the purpose of money laundering or sanction evasion”.
CoinEx denied helping Iranian government bodies or sanctioned individuals carry out transactions.
Crypto Activity Continued During Internet Shutdown
Iran’s crypto market faced major disruption in late February after coordinated US and Israeli military attacks led Iranian authorities to restrict internet access.
However, TRM’s analysis showed that while the internet blackout and attacks continued, the average size of transactions between CoinEx and Nobitex increased.
CoinEx disputed that finding, saying it did not see the same rise in transaction sizes and that the activity could not be linked specifically to government or sanctioned actors.
CoinEx Moves Away From Iran
In recent weeks, CoinEx has started distancing itself from Iranian users.
Persian-language social media accounts linked to the exchange informed users about new customer verification requirements.
Yang, a CoinEx representative, said the platform would no longer accept new users from Iran and would remove existing Iranian users it could identify.
He said the move came after sanctions against Nobitex, adding that CoinEx took action after “realising that the stakes were getting higher”. The Persian-language accounts, he said, would also be shut down.
