Earlier this year, crypto sleuths found an alarming series of transactions tied to two digital wallets controlled by the Central Bank of Iran.
Tracing backward, investigators discovered the wallet’s funds were linked to $1.5 billion that North Korean hackers stole from the crypto exchange Bybit. After reaching the Iranian wallets, the money flowed through a complex maze of transactions. One destination was a crypto exchange that has become key to Iran’s ability to use cryptocurrency to evade far-reaching U.S. economic sanctions.
CoinEx, an 8-year-old exchange founded by a Chinese engineer, has played a growing role in connecting Iran’s crypto operations to the wider world, blockchain data shows. Since 2019, wallets with an identifiable link to Iran have moved more than $3.84 billion through CoinEx, according to blockchain intelligence firm TRM Labs.
Digital assets are popular among everyday Iranians who want to trade cryptocurrencies for profit, while at the same time protecting themselves against the deterioration of Iran’s physical currency, the rial. Researchers have estimated that around 13% of Iran’s population own crypto, participating in a market valued at between $8 billion to $10 billion in 2025.
CoinEx began to build a presence within Iran in the years after its launch and has at times employed business-development managers in the country to recruit users, according to former employees. The CoinEx spokesperson said the company never established an office in Iran and denied knowingly hiring business-development personnel.
Along the way, it also became a favored channel for Iran’s shadow banking system.
While transactions on the blockchain are public, who holds the key to any particular digital wallet isn’t. Mapping out the obscure corners of the ecosystem and attributing specific wallets to Iran’s government or anyone else can be difficult and has created a market for firms like TRM. Blockchain analytics firms use public data, human sources and analytical indicators to map out wallets, though their findings can vary.
To examine CoinEx’s business footprint in Iran, TRM analyzed activity by crypto wallets that it has tied to more than 60 Iranian entities.
Most of the money that has flowed between Iran and CoinEx has come through Nobitex, with more than $763 million moving between the two last year, according to TRM’s analysis.
CoinEx said TRM’s aggregation of volumes that went back and forth was misleading and that volume estimates from a separate third-party provider were lower. It also said the findings of any single blockchain analytics platform shouldn’t be treated as definitive. The volume estimates it provided still ranked the exchange as Nobitex’s largest counterparty in 2025.
Other entities that have transacted with CoinEx wallets have been linked by U.S. officials to Iran’s Islamic Revolutionary Guard Corps. Between 2022 and 2025, for example, wallets hosted by CoinEx processed transactions for Alireza Derakhshan, an Iranian allegedly involved in an oil sales network sanctioned by the U.S. last year.
CoinEx wallets also sent and received money from wallets attributed to Zedcex, an exchange registered to a central London office that has been connected to Babak Zanjani, an Iranian businessman who has identified himself as a strategist for the IRGC’s sanctions evasion operations.
The Journal reviewed the transactions related to Derakhshan and Zedcex using publicly available blockchain explorers.
The U.S. Treasury Department last year sanctioned a network accused of processing more than $100 million worth of crypto stemming from Iranian oil sales, including Derakhshan. In January, it also sanctioned Zedcex and Zanjani. The transactions involving CoinEx occurred before the Treasury actions.
Zanjani on social media has said the sanctions indicate “the effectiveness of our economic activities.” A spokesperson also previously told the Journal that he “has neither required nor relied upon any cryptocurrency exchange for the purpose of money laundering or sanction evasion.”
Derakhshan couldn’t be reached for comment.
The CoinEx spokesperson denied facilitating direct transactions on behalf of Iranian or sanctioned entities.
Iran’s cryptocurrency market was severely disrupted in late February, when coordinated attacks by U.S. and Israeli military prompted Iranian authorities to suspend most internet access. Iranian crypto users who spoke to the Journal said they weren’t able to access CoinEx.
But during the bombings and monthslong internet blackout, the average size of transactions flowing between CoinEx and Nobitex actually increased, according to TRM’s analysis.
CoinEx said it didn’t observe the same increase in the size of transactions and that it wasn’t possible to attribute the activity to government or state-sanctioned actors.
CoinEx in recent weeks began taking actions to distance itself from the Iranian market. Persian-language social-media accounts informed users that the exchange was implementing new customer identification procedures.
Yang said CoinEx wouldn’t accept any new Iran users and was removing prior Iranian users it could identify. The exchange took the new measures following the Nobitex sanctions after “realizing that the stakes were getting higher,” he said. The Persian-language social-media accounts will be closed, he said.
Write to Dylan Tokar at dylan.tokar@wsj.com