The Wall Street Journal reported that Iran-linked entities moved more than $3.84 billion through crypto exchange CoinEx since 2019.
The report cited TRM Labs and public on-chain data. It said CoinEx became one of the main crypto routes allegedly used to move funds outside U.S. sanctions.
The report said investigators found unusual activity from two wallets controlled by the Central Bank of Iran earlier this year. The WSJ also said those funds had links to assets stolen from Bybit by North Korean hackers. CoinEx has not become subject to a new U.S. action in the report, but the claims place the exchange under fresh review.
Central bank wallets enter the trail
According to the WSJ, investigators traced the flow backward from the two Iranian central bank wallets. The trail then pointed to funds tied to the Bybit hack, one of the largest thefts in crypto history. The report said the money later moved through many transactions before reaching CoinEx.
See how a crypto exchange became a major hub for illicit Iranian cash https://t.co/4qe3BjeuWo
— The Wall Street Journal (@WSJ) June 25, 2026
The FBI previously blamed North Korean actors for the Bybit theft, which involved about $1.5 billion in virtual assets. U.S. officials said the hackers were converting stolen assets into Bitcoin and other tokens across many wallets. That pattern made the CoinEx report part of a wider debate over exchange screening and sanctions controls.
Sanctions pressure grows around crypto
As crypto.news reported, the U.S. Treasury sanctioned four Iranian crypto exchanges, including Nobitex, under its Economic Fury campaign. The agency accused the platforms of helping sanctioned entities enter the digital asset market. Chainalysis also said Nobitex handled about half of Iran’s crypto trading activity.
In our last update, crypto.news examined how U.S. officials said they had seized nearly $1 billion in Iran-linked crypto. That action followed a $344 million USDT freeze across two Tron wallets tied to Iran’s Islamic Revolutionary Guard Corps. The Treasury said it would keep tracking money that Tehran tries to move through crypto and banks.
Bybit link widens laundering concern
As previously reported, Bybit-related laundering also moved through decentralized routes after the 2025 hack. THORChain saw almost $3 billion in trading volume from swaps tied to stolen Bybit assets, according to on-chain tracking cited at the time. The activity showed how stolen funds can move from one venue to another before cash-out attempts.
The CoinEx report adds another layer because it names a centralized exchange, not only mixers or decentralized protocols. Centralized platforms usually run customer checks and transaction screening, but blockchain data can still show funds moving through accounts and wallets. Regulators may now review whether existing controls caught the alleged Iran-linked activity.
Compliance questions move back to exchanges
The WSJ report arrives as U.S. officials continue to target crypto flows tied to sanctioned states. Iran remains cut off from many dollar channels, while digital assets offer a route for cross-border transfers. Retail users also rely on crypto as the rial weakens, which can make clean and flagged flows harder to separate.
For CoinEx, the report creates a reputational test and may draw questions from compliance teams, banks, and regulators. For the wider market, the case shows why on-chain tracing now sits at the center of sanctions enforcement. The next issue is whether authorities act on the data or ask exchanges to tighten screening further.
