CoinEx Iran-linked crypto flows totalling more than $3.84 billion since 2019 are at the centre of a Wall Street Journal investigation, which drew on TRM Labs analysis and public on-chain data to trace alleged sanctions evasion routes through the exchange.
CoinEx has not been named in a new US enforcement action. The report does, however, put the exchange under fresh regulatory scrutiny at a moment when US authorities are actively widening crypto sanctions enforcement against Iranian entities.
What TRM Labs Found in the CoinEx Iran-Linked Crypto Flows
The figures the WSJ leaned on are sharper than the headline number suggests. According to TRM Labs, approximately $67 million in funds originating from Iran’s Central Bank reached CoinEx addresses through a structured laundering scheme spanning multiple blockchains.
TRM Labs also found that by 2024, CoinEx had replaced Binance as the largest foreign counterparty to Iran’s Nobitex exchange, with over $763 million moving between the two platforms, per TRM Labs’ own insights data. Every major Iranian exchange routes roughly 5% to 10% of its volume through CoinEx, a pattern TRM characterises as coordinated rather than organic.
The compliance picture looks worse at the exchange level. TRM Labs pegs CoinEx’s share of illicit transaction volume at nearly 8%, against the 0.3% threshold typical of exchanges operating within standard compliance frameworks.
The Bybit Thread and What It Adds to the Case
The investigation’s most arresting detail is the connection to the Bybit theft. Investigators traced activity in two wallets controlled by the Central Bank of Iran back to funds stolen from Bybit on or about 21 February 2025.
The FBI’s Internet Crime Complaint Centre (IC3) confirmed in a public service announcement that North Korean TraderTraitor actors stole approximately $1.5 billion in virtual assets from Bybit on that date and subsequently converted a portion into Bitcoin and other assets dispersed across thousands of addresses on multiple blockchains.
TRM Labs’ post-mortem on the Bybit hack explains how attackers infiltrated a developer’s computer associated with Gnosis Safe’s multi-signature wallet and injected malicious JavaScript into the UI, making a fraudulent transaction appear legitimate. The funds then moved through a long chain of wallets before portions surfaced in Iranian-linked addresses.
What this does to the CoinEx story is add a cross-jurisdictional layer. The alleged route now runs from a North Korean state-sponsored theft through Iranian central bank wallets and into a centralised exchange that was supposed to be running customer checks and transaction screening.
Iranian Crypto Volumes in 2025: Declining but Still Active
The WSJ report lands against a backdrop of shrinking but persistent Iranian crypto activity. Between January and July 2025, total cryptocurrency flows involving Iranian entities fell to $3.7 billion, an 11% decrease on the same period in 2024, according to TRM Labs’ Iran 2025 report.
The drop was partly structural. TRM attributes the decline to a 12-day conflict with Israel beginning 13 June 2025, widespread power outages from Israeli kinetic and cyber operations, and a $90 million hack of Nobitex on 18 June 2025. Volume fell because the infrastructure to move it was disrupted, not because compliance improved.
The US Treasury has been running parallel pressure. Its Economic Fury campaign sanctioned four Iranian crypto exchanges, including Nobitex, accusing them of providing sanctioned entities access to digital asset markets. A separate action seized nearly $1 billion in Iran-linked crypto, following a $344 million USDT freeze across two Tron wallets tied to Iran’s Islamic Revolutionary Guard Corps.
What Comes Next for CoinEx and the Wider Exchange Landscape
The CoinEx case reinforces a pattern regulators have been building toward: centralised exchanges present a chokepoint that mixers and decentralised protocols do not, and on-chain tracing now routinely works backwards from sanctions lists to exchange deposit addresses.
For CoinEx, the immediate question is whether existing know-your-customer and transaction monitoring controls flagged any of the activity TRM Labs identified. An 8% illicit-volume share is the kind of figure that draws direct questions from correspondent banks and regulators, regardless of whether a formal enforcement action follows the WSJ report.
The broader market implication is straightforward. If authorities move from data-gathering to enforcement, CoinEx faces the same outcome Nobitex did. The on-chain record is already public; the decision is whether to act on it.
