Inside the $3.84 Billion Crypto Pipeline Linked to Iran

Blockchain researchers at TRM Labs identified that funds stolen during the $1.5 billion Bybit hack moved through wallets controlled by the Central Bank of Iran. These assets were subsequently funneled into the global crypto ecosystem via CoinEx. The exchange, founded by a Chinese engineer, became a central node for Iranian activity, with nearly 13 percent of the Iranian population now estimated to utilize digital currencies to hedge against the devaluing rial.

Transactions involving CoinEx have frequently intersected with individuals and entities under US sanctions. Notably, the platform processed funds linked to Alireza Derakhshan, a figure central to illicit oil sales networks, and interacted with Zedcex, an exchange associated with sanctioned businessman Babak Zanjani. While CoinEx explicitly denies knowingly facilitating sanctions evasion or working with state actors, internal data confirms that the Iranian platform Nobitex remained its largest counterparty throughout 2025.

Following increased international pressure and the imposition of new sanctions against Nobitex, CoinEx has begun to pivot. Representative Yang confirmed that the exchange is now barring new Iranian users and purging existing accounts to mitigate rising regulatory risks. Despite the company’s insistence that blockchain analytics firms provide misleading volume estimates, the exchange's decision to shutter its Persian-language operations signals a retreat from a market that had become a critical, albeit controversial, component of its business architecture.