CoinEx Traced Funneling $3.84B to Iran, Sanctions Evasion Probe Finds

Blockchain intelligence firm TRM Labs has traced approximately $3.84 billion in flows between the cryptocurrency exchange CoinEx and sanctioned Iranian entities over the past seven years, according to a Wall Street Journal investigation published today. The finding marks one of the largest sanctions evasion schemes uncovered in the crypto sector and has triggered immediate regulatory scrutiny of the Seychelles-based exchange, which denies any deliberate involvement in circumventing US sanctions.

Background on the Investigation

The WSJ report, corroborated by TRM Labs analysis, reveals that CoinEx functioned as a critical gateway for Iran’s crypto sector, maintaining direct transaction exposure with more than 60 Iranian crypto platforms. The exchange became the single largest trading partner of Nobitex, Iran’s biggest crypto platform, which accounted for roughly $2.7 billion of the total $3.84 billion in traced flows. Beginning in 2018, approximately $2.7 billion transferred between CoinEx and Nobitex through roughly 6.2 million separate transactions, representing a daily average of $1 million in transaction flow across nearly eight years.

The investigation intensified following US Treasury Department sanctions imposed on Nobitex on June 2, 2026, which cited connections to entities including the Islamic Revolutionary Guard Corps. Immediately after those designations, transaction volumes between CoinEx and Iranian platforms collapsed to less than $150,000 daily, suggesting the exchange rapidly adjusted its operations once regulatory pressure mounted. Investigators uncovered additional concerns during their probe, including approximately $67 million connected to Iran’s Central Bank that entered CoinEx between June 2025 and June 2026. TRM Labs also identified exposure to designated terrorist entities, including $6 million in transactions involving wallets associated with the Islamic Revolutionary Guard Corps and $374,000 of exposure connected to Palestinian Islamic Jihad.

Critical Links to North Korean Hackers and Stolen Assets

The investigation uncovered an unexpected nexus between sanctioned Iranian activity and assets stolen by North Korean threat actors. Investigators discovered that funds linked to Iran’s Central Bank had connections to assets stolen from the cryptocurrency exchange Bybit by hackers previously attributed to North Korea. The FBI previously blamed North Korean actors for the Bybit theft, which involved approximately $1.5 billion in virtual assets. This connection underscores how multiple state-level actors may be using the cryptocurrency ecosystem to move illicit funds and evade international sanctions simultaneously.

CoinEx’s Defense and Stated Remediation

Founded in 2017 by Haipo Yang, CoinEx has rejected allegations of knowing involvement in sanctions evasion. The exchange stated that on-chain fund flows through a platform do not prove that the exchange knew about, supported, or participated in the activity. CoinEx said it has never established any commercial relationship with Iranian government-related entities, Iranian domestic exchanges, the Revolutionary Guard, or sanctioned parties. The exchange also noted that its official domain has been blocked in Iran since 2021 after the Iranian government blacklisted it.

The exchange claimed it has taken remedial steps including strengthened Know Your Customer protocols, enhanced Iran-related risk reviews, geo-fencing, sanctions screening, and transaction monitoring. CoinEx stated it had begun exiting Iran-related business and recently announced enhanced verification procedures restricting access to users based in Iran. However, critics have noted that the dramatic collapse in transaction volume only occurred after the June 2 sanctions announcement, raising questions about whether these compliance measures were truly proactive or merely reactive to regulatory enforcement.

Regulatory Context and Broader Implications

The CoinEx investigation occurs within a broader crackdown on cryptocurrency platforms failing to implement adequate sanctions screening. US authorities have increasingly targeted exchanges that facilitate transactions involving designated entities, particularly those connected to Iran’s government or military apparatus. The timing of the discovery, combined with evidence of rapid operational adjustments following the Nobitex sanctions, suggests CoinEx may face regulatory action similar to that imposed on other exchanges found facilitating sanctions evasion.

Market Impact and Sentiment

The scandal broke during a broader market downturn, with Bitcoin trading near $60,843, down 3.3 percent on the day. Ethereum declined 3.2 percent to around $1,620, while broader cryptocurrency markets moved lower across asset classes. The Crypto Fear and Greed Index sat at 17, indicating extreme fear sentiment. The news added to regulatory concerns already weighing on market participants, as enforcement actions typically trigger broader industry reassessment of compliance standards and risk management practices.

What This Means for the Market

The CoinEx investigation demonstrates that cryptocurrency exchanges remain vulnerable vectors for sanctions evasion and that blockchain analysis firms have substantially improved their capacity to trace illicit flows across platforms and borders. Regulatory agencies appear committed to identifying and sanctioning exchanges that, whether intentionally or through inadequate compliance systems, facilitate transactions involving designated entities. This case will likely accelerate compliance spending across the industry and increase scrutiny of exchanges operating without robust sanctions screening, particularly those with exposure to high-risk jurisdictions or serving primarily retail investors who lack sophisticated due diligence capabilities.

Disclaimer: This content is for informational purposes only and does not constitute financial advice. Cryptocurrency markets are highly volatile and unpredictable. All trading decisions should be made based on your own research and risk tolerance. Block Digest is not responsible for any financial losses incurred as a result of acting on this content.