A comprehensive investigation has revealed how a $1.5 billion cryptocurrency heist operated from North Korea became connected to Iran's central bank. According to reports from The Wall Street Journal, investigators tracked the movement of funds stolen from Bybit across the crypto ecosystem, discovering two wallets linked to the Central Bank of Iran before the funds eventually reached CoinEx, a major cryptocurrency exchange. The investigation has now revealed that these wallets have received hacked cryptocurrency tied to Iran's central bank and interacted with accounts linked to the Islamic Revolutionary Guard Corps (IRGC), as reported by blockchain intelligence firm TRM Labs. The stolen Bybit assets didn't flow directly into Iranian wallets - investigators tracked the funds through a web of bridges and DeFi protocols before they reached accounts linked to Iran's Central Bank, representing a deliberate obfuscation tactic that complicates real-time screening by centralized exchanges.
The investigation has highlighted the significant role of CoinEx in Iran's cryptocurrency ecosystem, with the exchange appearing to have become a primary off-ramp for Iranian entities after compliance tightening at larger global platforms pushed illicit flows to smaller venues. As reported by The Wall Street Journal and TRM Labs, CoinEx wallets have processed over $3.84 billion in transactions linked to Iranian entities since 2019, with some funds tied to the $1.5 billion Bybit heist that later passed through Iranian central bank wallets. The exchange, launched in 2017 by Chinese engineer Haipo Yang, who previously worked at Tencent and runs a major bitcoin mining pool, has become a major gateway for Iranian crypto users despite Yang's denial of any connection to the Iranian government. The exchange, now based in Seychelles, has implemented monitoring systems to detect risky activities and has begun restricting access from Iran, including blocking new users with Iranian IP addresses and reviewing flagged accounts to ensure compliance with international rules.
The case demonstrates significant challenges in enforcing US sanctions on Iran's cryptocurrency networks, with the investigation revealing that CoinEx and Nobitex form what investigators describe as Iran's most active two-exchange corridor for moving value outside US financial reach. According to The Wall Street Journal, CoinEx had previously exited the US market after being fined by New York's attorney general in 2023, while Binance was penalized in 2023 for allowing Iranian users to access its platform. The Trump administration recently sanctioned Nobitex, Iran's domestic crypto exchange, alleging it supported the Iranian government, with TRM Labs data showing more money flowed from Nobitex to CoinEx than in the other direction. Blockchain data shows that Binance was once the largest foreign partner of Nobitex but that relationship weakened after Binance tightened compliance measures in 2022, with CoinEx becoming Nobitex's largest foreign counterparty by 2024. Chainalysis estimated that Nobitex handled roughly half of all Iranian crypto trading activity. CoinEx now faces similar scrutiny to what Binance experienced over Iran connections, with the company insisting it's working to stay compliant with international rules.
The investigation reveals the substantial growth of cryptocurrency adoption in Iran, driven by both investment demand and efforts to protect savings from the weakening rial. As reported by The Wall Street Journal, researchers estimate that around 13% of Iranians own cryptocurrency, with the country's crypto market valued at between $8 billion and $10 billion in 2025. CoinEx former employees told the publication that the exchange began building a presence in Iran shortly after its launch, hiring staff in the country to expand its user base and integrate into Iran's informal financial networks. This case underscores the difficulties the United States faces in enforcing sanctions against Iran, where cryptocurrency usage is on the rise and many trading platforms operate outside US jurisdiction.
The investigation identified transactions involving CoinEx-hosted wallets and individuals or entities sanctioned by US authorities. According to The Wall Street Journal, between 2022 and 2025, CoinEx wallets processed activity linked to Alireza Derakhshan, whom US authorities say was part of an oil sales network sanctioned last year. The exchange also interacted with Zedcex, a London-registered exchange linked to Iranian businessman Babak Zanjani, who has been associated with IRGC-linked sanctions evasion operations. The US Treasury has previously sanctioned networks connected to more than $100 million in cryptocurrency generated from Iranian oil sales, including Derakhshan and Zanjani. In January, Zedcex and Zanjani were also sanctioned, with transactions involving CoinEx occurring prior to these sanctions. Post-hack laundering from the Bybit incident also moved through THORChain, which recorded nearly $3 billion in swap volume tied to those stolen assets, illustrating how funds can bounce between decentralized venues and centralized exchanges before any cash-out attempt.
