Cryptocurrency exchange CoinEx is facing renewed scrutiny following a Wall Street Journal report alleging that Iran-linked entities moved billions of dollars through the platform.
According to the WSJ report, more than $3.84 billion in cryptocurrency connected to Iranian entities has flowed through CoinEx since 2019. The report relied on public blockchain data and analysis from TRM Labs.
The findings have raised questions about how sanctioned actors use digital assets to move money across borders. CoinEx has not been accused of wrongdoing by U.S. authorities, making the distinction between activity allegedly conducted through an exchange and conduct by the exchange itself important.
See how a crypto exchange became a major hub for illicit Iranian cash https://t.co/4qe3BjeuWo
— The Wall Street Journal (@WSJ) June 25, 2026
Iranian wallets appear in the investigation
The WSJ report said investigators traced transactions involving two wallets allegedly controlled by Iran’s central bank earlier this year. The wallets were reportedly connected to cryptocurrency stolen during the $1.5 billion Bybit hack.
U.S. authorities previously attributed the Bybit attack to North Korean hackers. Blockchain investigators subsequently tracked the stolen assets through multiple wallets and services, with some of the funds eventually reaching CoinEx, according to the report.
The case shows why blockchain analysis has become useful to investigators. Although wallet addresses do not automatically reveal the identity of their owners, transaction histories can expose connections between addresses, exchanges, bridges, and other services.
ALSO READ: Iran Turns to USDT as Sanctions Push Businesses Toward Crypto Payments
Crypto exchanges face stronger sanctions scrutiny
CoinEx is being examined against a backdrop of increasing U.S. enforcement against cryptocurrency platforms operating in or connected to sanctioned jurisdictions.
Earlier this year, the U.S. Treasury sanctioned four Iranian cryptocurrency exchanges, including Nobitex, under its Economic Fury campaign. U.S. officials accused the targeted platforms of helping sanctioned individuals and entities access digital-asset markets.
Chainalysis previously estimated that Nobitex accounted for about half of Iran’s cryptocurrency trading volume.
U.S. authorities have also reported the seizure of nearly $1 billion in Iran-linked cryptocurrency and the freezing of $344 million in USDT connected to Iran’s Islamic Revolutionary Guard Corps.
Compliance becomes harder as funds cross multiple networks
The CoinEx allegations highlight the difficulty centralized exchanges face when tracing funds that have passed through several wallets and protocols.
Exchanges generally rely on customer verification, transaction monitoring, sanctions screening, and blockchain analytics to identify suspicious activity. Yet investigators can encounter fragmented transaction trails when funds move through decentralized exchanges, bridges, mixers, or multiple intermediary wallets.
The issue was also visible after the Bybit hack. Earlier blockchain tracking showed that billions of dollars in trading activity linked to the stolen assets moved through decentralized platforms, including THORChain.
Bybit 被盗事件的赢家除了黑客，就是 @THORChain 了：黑客洗钱为 THORChain 带来了 $29.1 亿的交易量跟 $300 万的手续费收入。
Bybit 黑客的主要洗钱方式是通过 @THORChain 将 ETH 兑换成 BTC。这为 THORChain 带来了巨量的交易量跟手续费。同时也带动了 THORChain 的代币 $RUNE 上涨。… https://t.co/952qqgyuoN pic.twitter.com/QV3BPWoDqC
— 余烬 (@EmberCN) February 27, 2025
For centralized exchanges, the report could increase pressure to demonstrate that their monitoring systems can identify sanctioned entities even when those entities use intermediaries or obstruct transaction trails.
The report puts exchange controls under the microscope
The allegations do not establish that CoinEx knowingly facilitated sanctions evasion. However, they highlight the challenge exchanges face when illicit funds interact with their platforms.
For regulators, blockchain analytics firms, and compliance teams, the case may become another example of how public transaction records can support investigations years after funds initially move.
The next developments will depend on any response from CoinEx, further findings from investigators, and whether U.S. or other authorities announce formal enforcement measures. For the wider industry, the case reinforces the growing importance of transaction monitoring as regulators examine crypto flows connected to sanctioned jurisdictions.
Update: CoinEx has announced that it will cease operations, with most services ending on September 29 and withdrawals remaining open until December 22, 2026.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
