The cryptocurrency industry is facing renewed scrutiny after a Wall Street Journal investigation uncovered a complicated network of digital transactions involving Iranian-linked wallets, suspected North Korean hackers, and crypto exchange CoinEx.
The investigation traced cryptocurrency movements connected to a massive $1.5 billion theft from crypto exchange Bybit. Blockchain researchers found that some of the stolen funds allegedly passed through wallets linked to the Central Bank of Iran before moving across multiple platforms.
As a result, attention has shifted toward CoinEx, a cryptocurrency exchange that has become a significant part of Iran’s digital financial ecosystem.
How the Investigation Unfolded
Earlier this year, blockchain analysts tracking two wallets believed to be connected to Iran’s central banking system discovered a potential connection to the Bybit hack.
The cyberattack, which reportedly involved North Korean hackers, ranks among the largest cryptocurrency thefts ever recorded. Investigators found that after the funds entered Iranian-linked wallets, they moved through a series of transactions and eventually reached various cryptocurrency platforms.
Among those platforms, CoinEx emerged as a key destination.
Although blockchain transactions are publicly visible, identifying the actual owners behind wallet addresses remains a challenging task. Therefore, investigators rely on transaction patterns, public records, human intelligence, and other data points to connect wallets to specific entities.
CoinEx’s Growing Presence in Iran
According to blockchain intelligence firm TRM Labs, wallets connected to Iranian entities transferred more than $3.84 billion through CoinEx between 2019 and 2025.
Cryptocurrency adoption has grown rapidly in Iran in recent years. Many citizens use digital assets not only for investment purposes but also to protect their savings from the weakening Iranian rial.
Researchers estimate that around 13 percent of Iran’s population now owns cryptocurrency. Furthermore, Iran’s crypto market is believed to be worth between $8 billion and $10 billion in 2025.
CoinEx expanded its reach in the country over the years. Former employees claimed the exchange at times employed business-development managers to attract Iranian users. However, CoinEx denied these allegations and stated that it never operated an office in Iran or knowingly hired local business-development staff.
Strong Links Between CoinEx and Nobitex
The investigation also highlighted significant transaction activity between CoinEx and Nobitex, Iran’s largest cryptocurrency exchange.
TRM Labs reported that more than $763 million moved between the two platforms during the previous year alone. This finding suggests a deep financial connection between the exchanges.
However, CoinEx challenged the report’s conclusions. The company argued that TRM’s transaction estimates were misleading and pointed to alternative data showing lower figures.
Despite the disagreement, CoinEx’s own records reportedly identified Nobitex as its largest counterparty in 2025.
Transactions Connected to Sanctioned Networks
The investigation further revealed that some wallets interacting with CoinEx were linked by U.S. authorities to individuals and networks later targeted by sanctions.
Between 2022 and 2025, CoinEx-hosted wallets reportedly processed transactions involving Alireza Derakhshan, an Iranian figure accused by the United States of participating in an oil sales network.
Additionally, CoinEx wallets exchanged funds with wallets connected to Zedcex, a cryptocurrency exchange associated with Iranian businessman Babak Zanjani.
The U.S. Treasury eventually sanctioned both the network linked to Derakhshan and entities associated with Zanjani. Authorities alleged that these networks handled cryptocurrency tied to Iranian oil sales worth more than $100 million.
It is important to note that the transactions involving CoinEx occurred before those sanctions were officially imposed.
CoinEx has denied facilitating transactions for sanctioned individuals or Iranian government organizations.
Crypto Activity Continued During Internet Restrictions
Iran’s cryptocurrency sector faced challenges earlier this year when authorities restricted internet access following military strikes linked to tensions involving the United States and Israel.
Despite the disruptions, blockchain data suggested that the average size of transactions between CoinEx and Nobitex increased during the period.
TRM Labs viewed this as a notable trend. However, CoinEx disputed the claim and said its own analysis did not show a similar increase. The company also stated that such activity could not automatically be linked to government entities or sanctioned actors.
CoinEx Begins Distancing Itself From Iran
In recent weeks, CoinEx appears to have changed its approach toward the Iranian market.
Persian-language social media accounts associated with the exchange informed users about stricter verification requirements. At the same time, the company announced plans to stop accepting new users from Iran.
CoinEx representative Yang said the platform would remove existing Iranian users it could identify and gradually end services linked to the country.
According to Yang, the decision came after recent sanctions against Nobitex and growing regulatory risks.
He also confirmed that CoinEx would shut down its Persian-language communication channels as part of the transition.
What This Means for the Crypto Industry
The investigation highlights the challenges regulators and crypto platforms face when monitoring cross-border digital transactions.
While blockchain technology offers transparency, determining the real-world identities behind wallets remains difficult. Consequently, exchanges must balance user privacy, compliance requirements, and international sanctions regulations.
The findings are likely to intensify discussions around cryptocurrency oversight, sanctions enforcement, and the role of digital assets in countries facing financial restrictions.