Nearly $4 billion in Iran-linked crypto moved through CoinEx over seven years, WSJ says

Iranian entities moved about $3.84 billion through CoinEx over the past seven years, according to The Wall Street Journal, citing analysis by blockchain firm TRM Labs. For PSPs and exchanges, the useful part is not the headline number; it is the routing pattern, the counterparties involved, and the fact that sanctions exposure can sit inside a chain of apparently ordinary crypto transfers.

1. TRM Labs said CoinEx wallets interacted with addresses linked to the Central Bank of Iran and with Nobitex, Iran’s largest crypto exchange, which was sanctioned by the United States in June.
2. By 2024, CoinEx had become Nobitex’s largest foreign counterparty, replacing Binance, which had already tightened its sanctions compliance controls.
3. WSJ said the funds moved through a multi-step path: first into USDT on Tron, then through cross-chain bridges to Ethereum, then through decentralized protocols into other cryptocurrencies, including DAI, before moving across several blockchains again and finally reaching Nobitex accounts and then CoinEx.
4. TRM Labs also found that funds stolen by North Korean hackers in the Bybit hack were sent to wallets linked to Iran. WSJ estimated that at least $67 million of those assets later ended up on CoinEx deposits.
5. After the report, CoinEx said it had not conducted transactions on behalf of sanctioned persons. The exchange also began tightening customer identification procedures and restricting access for users from Iran, according to WSJ.

The U.S. Treasury has sanctioned four of Iran’s largest crypto exchanges — Nobitex, Wallex, Bitpin and Ramzinex — and said these platforms handle at least 72% of all digital assets entering Iran. That makes counterparties, blockchain hops, and bridge exposure a very practical risk-check item for any PSP touching crypto-adjacent flows.