The offshore exchange CoinEx has become Iran’s primary crypto exit ramp to the global market, stepping into a role Binance vacated under U.S. sanctions pressure, with more than $3.84 billion in Iran-linked funds flowing through it since 2019, according to blockchain analysis.
From Binance’s retreat to CoinEx’s rise
A Wall Street Journal investigation, drawing on analysis from blockchain intelligence firm TRM Labs, identified CoinEx as a significant exit point for Iran’s efforts to use cryptocurrency to evade U.S. sanctions. TRM built its $3.84 billion estimate by analyzing activity across crypto wallets it has tied to more than 60 Iranian entities. Most of that flow came through Nobitex, Iran’s largest domestic exchange, with more than $763 million moving between the two platforms last year alone.
CoinEx’s prominence appears to be a direct consequence of tighter enforcement elsewhere. For years, Binance was the largest counterparty to Nobitex, until the U.S. penalized it in 2023 partly for serving Iranian customers, prompting the exchange to tighten its sanctions controls from 2022 onward.
As Binance’s exposure fell, CoinEx’s grew; and by 2024 it had replaced Binance as Nobitex’s largest foreign counterparty, according to the blockchain data. More crypto flowed from Nobitex out to CoinEx than was routed back, and from there Iranian users gained access to the broader ecosystem, including Binance itself.
CoinEx was founded in 2017 by Haipo Yang, a former Tencent engineer who runs one of the world’s largest bitcoin mining pools, and launched from Hong Kong before relocating to the Seychelles. It agreed to exit the U.S. market in 2023 after a fine from New York’s attorney general, leaving it operating largely outside direct U.S. reach.
A $67 million trail from a North Korean hack
The investigation opens with a single, vivid thread. Crypto investigators earlier this year traced an alarming series of transactions tied to two wallets controlled by the Central Bank of Iran and found the funds linked to the roughly $1.5 billion that North Korean hackers stole from the exchange Bybit in February 2025. From the Iranian wallets, the money entered an elaborate maze designed to break the trail.
According to TRM’s reconstruction, the funds began as the stablecoin tether (USDT) on the Tron blockchain—a notable choice, since USDT can be frozen by its issuer. The tokens were split apart and bridged to Ethereum, run through a decentralized-finance smart contract that swapped them into other currencies, then forwarded to unhosted wallets controlled by a single user or small group.
Those wallets converted the funds into the stablecoin DAI, bridged them again onto the Binance Smart Chain, and fragmented them once more before they landed at Nobitex. Ultimately, $67 million was forwarded to CoinEx deposit accounts and then moved into a CoinEx treasury wallet and commingled with other deposits—at which point the trail became impossible to follow further.
That $67 million strand is distinct from, and far smaller than, the $3.84 billion total, but it illustrates the laundering choreography — chain-hopping, DeFi swaps, and unhosted wallets — that makes such flows so hard to trace. Beyond it, TRM’s analysis found CoinEx wallets transacting with accounts U.S. officials have since linked to Iran’s Revolutionary Guard, including those tied to the IRGC’s crypto operations.
Between 2022 and 2025, CoinEx wallets processed transactions for Alireza Derakhshan, named in a U.S.-sanctioned oil network, and exchanged funds with Zedcex, an entity connected to Babak Zanjani, an Iranian businessman who has described himself as a strategist for the Guard’s sanctions-evasion operations. Those transactions occurred before the U.S. Treasury designated Derakhshan, Zedcex, and Zanjani.
CoinEx pushes back
CoinEx disputes the characterization. Yang acknowledged that the exchange had been widely used by Iranians but said it has no relationship with the Iranian government, and a CoinEx spokesperson denied facilitating direct transactions on behalf of Iranian or sanctioned entities.
The company said it maintains a transaction-monitoring system and screens for high-risk users, and it called TRM’s method of aggregating funds moving back and forth “misleading,” arguing that no single analytics firm’s findings should be treated as definitive—though its own volume estimates still ranked it as Nobitex’s largest counterparty in 2025. A spokesperson said CoinEx would conduct an internal review of the transactions linked to the Bybit hack.
Some details sit awkwardly against that defense. TRM found that during the wartime internet blackout in late February, when Iranian users said they struggled to access the platform, the average size of transactions between CoinEx and Nobitex actually rose — a pattern CoinEx said it did not observe and could not attribute to state actors. Former employees said CoinEx at times used business-development staff to recruit users inside Iran; the spokesperson denied that and said the company never opened an office there.
Notably, CoinEx’s clampdown is recent and reactive. Only this month, after Nobitex was sanctioned under the Trump administration’s “Economic Fury” campaign, did it begin blocking new users with Iranian IP addresses, removing identifiable Iranian users, and closing its Persian-language social accounts. Yang said the exchange acted after “realizing that the stakes were getting higher.”
The episode underscores how hard the U.S. finds it to enforce sanctions against a country that has publicly embraced crypto, where obscure offshore platforms keep connecting Iran’s economy to the global market. The wildcard now is political: even as this exposure surfaces, Washington is negotiating a peace deal with Tehran that could significantly ease the very sanctions this network was built to evade.
Also Read: Hormuz Peace Dividend: How the US-Iran Deal Fuels Dubai RWAs & Not Tehran
