The Wall Street Journal reported on June 25 that, according to analysis by blockchain intelligence firm TRM Labs, Iranian entities have transferred over $3.84 billion via the cryptocurrency exchange CoinEx since 2019, with funds ultimately flowing into wallets linked to the Central Bank of Iran and the domestic exchange Nobitex.
Fund Flow Path: Central Bank of Iran → Nobitex → CoinEx, Peak Annual Transaction Volume $763 Million
According to The Wall Street Journal report, the fund flow path is as follows: Funds, including USDT stablecoins, from wallets controlled by the Central Bank of Iran flowed out through multiple intermediary channels; Iran's largest domestic crypto exchange, Nobitex, served as the entry point; CoinEx acted as the exit to the global market. At peak trading volume, the annual transaction volume between Nobitex and CoinEx reached $763 million.
By 2024, CoinEx had become Nobitex's largest offshore counterparty, replacing Binance, which had previously withdrawn from Nobitex transactions due to tightened sanctions compliance controls.
On-Chain Link Between North Korea's Bybit Hack and Central Bank of Iran Wallets
The report reveals that suspicious transactions related to two digital wallets controlled by the Central Bank of Iran earlier this year can trace their source to the $1.5 billion stolen by North Korean hackers from Bybit. After reaching the Central Bank of Iran wallets, the funds went through a complex transaction maze before ultimately flowing to CoinEx.
TRM Labs tracked crypto flows linked to more than 60 Iranian entities. The report also notes that the $3.84 billion may only represent transactions traceable through on-chain analysis; considering the use of privacy tools, cross-chain transactions, and peer-to-peer trading, the actual scale of Iranian fund flows could be much higher than this figure.
U.S. Sanctions Timeline for Nobitex: June 2, Linking to IRGC
On June 2, 2026, U.S. authorities sanctioned Nobitex for its ties to multiple entities, including Iran's Islamic Revolutionary Guard Corps (IRGC). CoinEx, founded by Yang Haipo in 2017 and based in Seychelles, allegedly processed billions of dollars in suspicious transactions over a seven-year period (2019-2026) until it announced tightened KYC processes after the report was published.
Frequently Asked Questions
Does the $3.84 billion tracked by TRM Labs represent the total transaction volume of Iranian entities?
According to the analysis in the Wall Street Journal report, this figure may only represent the portion traceable via on-chain analysis. Due to the widespread use of privacy tools, cross-chain transactions, and peer-to-peer trading that bypass centralized exchanges, the actual scale of Iranian fund flows could be much higher than $3.84 billion.
Why did Binance exit its trading relationship with Nobitex?
According to the report, Binance exited Nobitex transactions after implementing stricter sanctions compliance controls, leaving CoinEx to fill the gap and become Nobitex's largest offshore counterparty by 2024.
Were CoinEx's announced KYC improvements proactive or reactive?
According to the report, CoinEx announced tightened KYC processes and restrictions on Iranian users only after the Wall Street Journal report was published, making it a reactive response. Prior to this, the exchange had processed billions of dollars in related transactions over approximately seven years (2019 to the time of the 2026 report).
