- The CoinEx platform had transactions worth $3.84 billion involving Iran-related cryptocurrencies from 2019 to 2026.
- Tracing of some of the stolen funds in the Bybit hack led to some Iranian-linked wallets before being channeled to CoinEx wallets.
- CoinEx denied any links with government agencies and challenged the report in question.
CoinEx has again been put into the regulatory crosshairs following a blockchain probe that revealed over $3.84 billion in cryptocurrency transactions through the exchange from 2019 to 2026 that had connections to Iran-based entities.
According to The Wall Street Journal, the investigation, done through TRM Labs, assessed transactions conducted between CoinEx, Nobitex, which is Iran’s largest cryptocurrency exchange and the wallets of sanctioned entities.
Other transactions that were assessed included those made with cryptocurrency that was stolen in the Bybit hack.
The report comes as U.S. enforcement agencies expand their enforcement activities against cryptocurrency transactions involving sanctioned jurisdictions. CoinEx denies claims regarding its involvement in business dealings with the Iranian regime and/or any transactions involving sanctioned entities, as well as some of the analysis done on the blockchain technology used in the report.
CoinEx Becomes Largest Trading Partner for Nobitex
TRM Labs believes that CoinEx becomes the largest trading partner of Nobitex as of 2024 due to regulatory actions against the sanction compliance program of Binance.
It is alleged that a total of $2.7 billion in crypto transactions were conducted between the two cryptocurrency exchanges. TRM Labs estimated the transfers averaged roughly $1 million per day beginning in 2018.
The blockchain analytics firm also identified about 60 Iranian cryptocurrency platforms connected to the transaction network.
Based on the report, the majority of the Iranian domestic markets sent around 5%-10% of their transaction volume via CoinEx, which is said to be an unusual pattern compared to other independent market activity.
The report further noted that CoinEx’s share of alleged illicit transaction volume approached 8%, compared with approximately 0.3% reported at exchanges considered compliant under similar measurement standards.
Investigation Followed Funds From the Bybit Hack
Investigators also examined cryptocurrency linked to the $1.5 billion Bybit security breach.
According to the report, blockchain analysts traced portions of the stolen assets through multiple blockchain bridges, smart contract swaps, and self-custodied wallets before the funds reached wallets attributed to Iran’s Central Bank. Some of the transactions later moved to CoinEx deposit addresses.
One transaction path identified by investigators involved approximately $67 million in cryptocurrency.
According to the report, the blockchain analysis could not prove that CoinEx knew anything about the processing of the stolen cryptocurrency. The investigators used the publicly available blockchain data to trace the path of the transactions.
Transactions Related to Sanctioned Networks
In addition to the above-mentioned Bybit probe, TRM Labs also discovered historical transactions relating to wallets linked to sanctioned entities.
In its findings, it is mentioned that CoinEx wallets engaged in transactions with wallets belonging to Alireza Derakhshan who has been recognized by U.S. government as a member of a sanctioned Iranian oil trading network.
Investigators also reported transactions involving Zedcex and Zedxion, platforms that the U.S. Office of Foreign Assets Control sanctioned earlier this year after alleging they operated as front companies supporting the Islamic Revolutionary Guard Corps.
The report said investigators found limited exposure involving other sanctioned organizations during their review of blockchain activity.
Separate findings also indicated that CoinEx-affiliated mining pool ViaBTC accounted for approximately $154 million in traced exposure to Nobitex through mining payouts. TRM Labs further reported that ViaBTC supplied emergency liquidity to Nobitex following the Predatory Sparrow cyberattack that targeted the Iranian exchange in June 2025. ViaBTC had not publicly responded to the findings at the time the report was published.
CoinEx Rejects Allegations of Government Links
CoinEx responded to the findings by denying any commercial relationship with the Iranian government or domestic Iranian exchanges.
Source: CoinEx
In a statement published on X, the company said it has never provided funding channels or active assistance to Iranian government agencies, Revolutionary Guard-related entities, or other sanctioned organizations.
The exchange also disputed TRM Labs’ interpretation of blockchain transaction data, arguing that on-chain transfers alone cannot establish whether an exchange had knowledge of or participated in unlawful activity.
CoinEx stated that it operates transaction monitoring systems and screens high-risk users. The company also said it had launched an internal review into the Bybit-related transactions referenced in the investigation.
In addition, CoinEx said it has begun restricting new account registrations originating from Iranian IP addresses while removing identifiable Iranian users from its platform.
Sanctions Continue to Shape Crypto Oversight
The report was released several weeks after the U.S. Treasury sanctioned four Iranian cryptocurrency exchanges as part of its Economic Fury campaign targeting sanctions evasion.
Earlier this month, Treasury Secretary Scott Bessent said authorities had seized approximately $1 billion in cryptocurrency connected to Iranian exchanges and digital wallets since the start of the conflict.
Chainalysis previously reported that Nobitex accounted for roughly half of Iran’s cryptocurrency trading activity, reinforcing its role within the country’s digital asset market.
The Wall Street Journal also cited industry estimates placing Iran’s cryptocurrency market between $8 billion and $10 billion, with approximately 13% of the country’s population holding digital assets.
