WSJ: Iran-Linked $3.8B CoinEx Flow Reveals State Actors Using Crypto Rails
Iran-linked entities moved roughly $3.84 billion through the cryptocurrency exchange CoinEx since 2019 to bypass U.S. economic sanctions, according to a Wall Street Journal report citing blockchain analytics firm TRM Labs [1][2]. This massive on-chain volume highlights a coordinated effort by state actors to utilize crypto rails as a primary financial conduit, effectively replacing traditional banking channels that have been severed by international sanctions enforcement. The report identifies CoinEx as a critical enabler for Iran’s cryptocurrency ecosystem, processing funds for sanctioned entities including the Islamic Revolutionary Guard Corps (IRGC) and the Central Bank of Iran [2][3].
CoinEx has faced heightened scrutiny following the June 25, 2026 publication, which details how the Seychelles-based exchange facilitated transactions between Iran’s largest domestic exchange, Nobitex, and global markets [1][4]. While the exchange has publicly denied being a primary gateway for illicit activity and announced new compliance measures, the sheer scale of the verified flows-spanning over $3.8 billion in blockchain-traced transactions-suggests a deep structural integration with sanctioned Iranian entities [1][6].
Key Metrics: The Scale of Sanctioned Flows
Subscribe to our Social Media for Exclusive Crypto News and Insights 24/7!
- Total Verified Volume: Over $3.84 billion in blockchain-verified flows moved between CoinEx and Iran-linked entities from 2019 to 2026 [1][2].
- Primary Counterparty: Approximately $2.7 billion of the total volume originated from transactions with Nobitex, Iran’s largest domestic crypto exchange [2][3].
- Daily Transaction Rate: Funds from Nobitex flowed at an average rate of $1 million per day since 2018, indicating a coordinated operational arrangement [3][6].
- Central Bank Involvement: Roughly $67 million in funds from the Central Bank of Iran reached CoinEx addresses via a multi-chain laundering scheme between June 2025 and June 2026 [2][6].
- Market Replacement: In 2024, CoinEx surpassed Binance as the largest foreign counterparty for Nobitex, with cross-exchange volume exceeding $763 million [2][10].
CoinEx’s Role as a State Sanctions Enabler
The Wall Street Journal report, grounded in TRM Labs’ data, characterizes CoinEx not as an exchange with incidental exposure but as the “backbone of Iran’s cryptocurrency ecosystem” for seven consecutive years [2][3]. Analysts note that the volume is difficult to attribute to organic market adoption given the precision of the flows and the specific involvement of sanctioned government bodies. Data suggests that top Iranian exchanges route 5% to 10% of their total volume through CoinEx, reinforcing the view of a “coordinated arrangement” rather than organic user preference [3][6].
Specific on-chain traces reveal that wallets hosted by CoinEx received hacked crypto assets previously acquired by the Central Bank of Iran, including funds linked to the $1.5 billion Bybit hack [2][9]. Furthermore, the exchange conducted direct transactions with accounts identified by U.S. officials as belonging to the IRGC [2][10]. These connections place CoinEx in the center of a complex network involving state-sponsored hacking, oil smuggling, and military financing [10].
The timeline of these flows reveals a shift in strategy. While Binance previously served as a major partner for Iranian exchanges, the data shows CoinEx replaced it in 2024 as the primary overseas partner for Nobitex [2]. This transition occurred alongside increasing U.S. sanctions enforcement against Iranian crypto platforms, suggesting that Iranian state actors identified CoinEx as a more resilient or compliant alternative for moving funds globally [4].
On-Chain Evidence of Multi-Chain Laundering
TRM Labs’ investigation mapped flows across multiple blockchains, identifying a structured money laundering setup designed to obscure the origin of state funds. The report highlights that funds originating from the Central Bank of Iran were routed through a multi-chain laundering scheme to reach CoinEx addresses, totaling roughly $67 million in the last year alone [2][6].
| Laundering Attribute | Observed Data | Implication |
|---|---|---|
| Source Entity | Central Bank of Iran Wallets | Direct state involvement in crypto flows |
| Amount Laundered | ~$67 Million (June 2025-2026) | Significant state capital movement via crypto |
| Method | Multi-Chain Bridging | Intentional obfuscation of transaction paths |
| Destination | CoinEx Wallet Addresses | Exchange acting as final liquidity point |
| Linked Events | $1.5B Bybit Hack Funds | Connection to high-profile cyber theft |
Data sourced from TRM Labs report cited by WSJ [2][6].
The presence of hacked funds linked to the Bybit breach within this laundering chain indicates that Iranian state actors are leveraging crypto not just for sanctions evasion, but also for integrating stolen assets into the global financial system [9]. This dual use of crypto rails-sanctions evasion and cyber theft integration-marks a significant evolution in how state actors utilize digital assets.
Market Structure and Compliance Implications
The revelation of $3.84 billion in sanctioned flows through a single named exchange fundamentally alters the current market narrative regarding sanctions compliance. Unlike previous evasion stories that relied on anonymous wallets or decentralized mixers, this incident names a centralized entity, raising direct enforcement questions for regulators and corporations [7].
Market participants view this as a catalyst for stricter geo-fencing and enhanced Know Your Customer (KYC) protocols across the global exchange industry. The report suggests that current U.S. sanctions may have only targeted 78% of Iranian crypto volumes, leaving a significant portion of the ecosystem operational through channels like CoinEx [3]. This gap implies that regulatory frameworks must evolve to close loopholes that allow centralized exchanges to serve as primary gateways for sanctioned regimes.
For investors, the incident underscores the risk of custodial exposure to exchanges with opaque compliance histories. The “coordinated arrangement” identified by analysts suggests that exchanges may be intentionally bypassing standard compliance checks to capture high-volume state flows [3]. This behavior could lead to increased regulatory scrutiny and potential delisting risks for exchanges unwilling to implement rigorous sanctions screening.
Risks, Uncertainties, and CoinEx’s Response
CoinEx has publicly disputed the characterization that it served as a primary Iran gateway, stating that on-chain data showing funds passing through the exchange does not prove awareness or support for illicit activity [6]. In response to the report, the exchange announced it is conducting a review and implementing geo-fencing, enhanced KYC/AML, and broader sanctions screening to off-board Iran-related risk [1][6].
However, significant uncertainties remain regarding the scope of the investigation. TRM Labs’ findings are research data, not court judgments, and the specific legal determination of the exchange’s liability awaits further regulatory action [6]. Additionally, the report notes that recent U.S. sanctions only targeted 78% of Iranian crypto volumes, suggesting that undiscovered channels or alternative entities may still be facilitating the remaining 22% of flows [3].
A downside scenario for the crypto market involves a potential “de-risking” event where major global exchanges preemptively freeze assets linked to Iranian entities to avoid regulatory penalties, potentially causing liquidity fragmentation. Conversely, if regulators fail to enforce stricter compliance, sanctioned actors may continue to expand their use of crypto rails, undermining the effectiveness of global economic sanctions.
The long-term structural impact of this event will likely be a permanent shift in how centralized exchanges approach compliance with sanctioned jurisdictions. The $3.84 billion figure serves as a stark warning that the integration of crypto rails by state actors is not a marginal occurrence but a systemic feature of the modern financial landscape.
Sources
- https://lcx.com/en/cryptonews/iran-linked-entities-moved-38b-through-coinex-trm-says
- https://coinness.com/en/news/1161408
- https://ambcrypto.com/4b-iran-crypto-trail-puts-coinex-under-the-spotlight-report/
- https://grafa.com/en/news/crypto/coinex-faces-scrutiny-over-3-84b-flows
- https://cryptoast.fr/exchange-crypto-iran-transactions-illicites-coinex/
- https://www.mexc.com/news/1176396
- https://www.spendnode.io/blog/iran-coinex-3-8b-sanctions-evasion-wsj-june-2026/
- https://www.youtube.com/watch?v=okKCJePCNOs
- https://whale-alert.io/stories/f9c501e8dd0de26/CoinEx-denies-claims-it-served-as-384-billion-gateway-to-sanctioned-Iranian-crypto-firms
- https://www.odaily.news/en/newsflash/494102
- https://www.iranintl.com/en/202606253859
- https://bitcoinfoundation.org/news/crypto-exchanges-news/coinex-iran-links/
- https://www.coindesk.com/markets/2026/06/25/iran-linked-entities-moved-38b-through-coinex-wsj-reports
- https://www.ledgerinsights.com/coinex-denies-iran-sanctions-trm-labs-report/
