CoinEx Iran Controversy: Did Iranian Wallets Receive Bybit Hack Funds?

Iran-Linked Crypto Wallets Moved $3.84 Billion Using CoinEx Since 2019

If your exchange of choice has unclear sanctions controls, your funds could be sharing rails with Iranian state-sponsored theft — and you'd never know until regulators come knocking.

Here's what most reports aren't telling you — the paper trail goes far deeper than CoinEx exchange, and it points to a compliance gap that could reshape how every offshore exchange operates next.

$3.84 Billion and a Paper Trail That Leads to Bybit

According to a Wall Street Journal investigation citing blockchain intelligence firm TRM Labs, Iran-linked wallets have channeled more than $3.84 billion through CoinEx since 2019. The Seychelles-based exchange, which has grown quietly over eight years, appears to have become a primary off-ramp for Iranian entities after compliance tightening at larger global platforms pushed illicit flows to smaller venues.

What makes this case unusual is the direct link to a high-profile theft. Earlier this year, investigators flagged two wallets controlled by Iran's Central Bank showing unusual activity. On-chain tracing revealed those wallets had received funds tied to the $1.5 billion hack of crypto exchange Bybit — a heist the FBI has attributed to North Korean state-sponsored hackers.

Source: Wu Blockchain X

How the Funds Moved and Why It's Hard to Stop

The stolen Bybit assets didn't flow directly into Iranian wallets. Investigators tracked the funds through a web of bridges and DeFi protocols before they reached accounts linked to Iran's Central Bank — and eventually CoinEx. This multi-hop structure is a deliberate obfuscation tactic and complicates real-time screening by centralized exchanges.

Nobitex Connection Widens the Picture

The WSJ report also ties CoinEx flows to Nobitex, Iran's largest domestic crypto exchange, which the U.S. Treasury sanctioned in June 2026 under its Economic Fury campaign. 

Chainalysis estimated that Nobitex handled roughly half of all Iranian crypto trading activity. Together, CoinEx and Nobitex form what investigators describe as Iran's most active two-exchange corridor for moving value outside U.S. financial reach.

THORChain and DeFi Routes Add Another Layer

Post-hack laundering from the Bybit incident also moved through THORChain, which recorded nearly $3 billion in swap volume tied to those stolen assets. That activity illustrates how funds can bounce between decentralized venues and centralized exchanges before any cash-out attempt — making attribution difficult and enforcement reactive rather than preventive.

What CoinEx Said? What Regulators Are Watching?

CoinEx has denied direct government ties and disputed the transaction volume figures as misleading. The exchange says it has begun blocking new Iranian users and plans to review the traced funds connected to the Bybit hack. No new U.S. sanctions action against CoinEx has been announced as of the report's publication.

However, U.S. authorities have shown an expanding appetite for targeting crypto platforms with Iran-linked exposure — even those based outside the United States. 

Treasury has warned foreign financial institutions that significant dealings with designated Iranian crypto platforms could trigger secondary sanctions risk. That framing means CoinEx's global banking relationships could face pressure even without a direct OFAC action.

Key Figures to Track:

• $3.84B — total Iran-linked volume on CoinEx since 2019 (TRM Labs)

• $1.5B — assets stolen from Bybit, traced partly to Iranian Central Bank wallets

• $8–10B — estimated total Iranian crypto activity in 2025 (blockchain analytics firms)

• $1B — Iran-linked crypto seized by U.S. authorities in recent enforcement actions

• $344M — USDT frozen across two Tron wallets tied to Iran's IRGC

What Traders and Investors Should Watch Next

The CoinEx report signals that compliance scrutiny on offshore exchanges is intensifying. Exchanges without robust KYC, wallet-screening, and sanctions controls are increasingly exposed — not just legally, but reputationally. That dynamic affects which venues attract institutional liquidity and which lose banking relationships.

For traders using smaller offshore venues, the question is whether those platforms are conducting adequate due diligence on counterparty wallets. Public blockchain data is increasingly weaponized by regulators — what looks like a clean transaction today can become a compliance problem tomorrow if the upstream source is flagged.

Conclusion

The $3.84 billion CoinEx-Iran flow is not an isolated incident — it is part of a documented shift in how sanctioned states use smaller exchanges and DeFi routes to access global liquidity after compliance pressure closes the doors at major platforms. 

For investors, the takeaway is clear: the exchange you use matters, and on-chain data is now the primary tool regulators rely on. The next enforcement action may not be far behind.

Disclaimer: This article is for informational purposes only and does not constitute financial, legal, or investment advice. Cryptocurrency investments carry significant risk. Always conduct your own research before making any financial decisions. CoinGabbar does not endorse any specific exchange or trading strategy mentioned in this article.