A $1.5 billion cryptocurrency heist orchestrated by North Korean hackers has been traced to wallets controlled by Iran's central bank, according to an investigation by The Wall Street Journal. The findings, reported by Business Today, reveal a complex money trail that passed through the CoinEx exchange and highlight the growing role of digital assets in circumventing sanctions.
The Money Trail
Investigators tracking the movement of the $1.5 billion stolen from Bybit by North Korean hackers identified two wallets linked to the Central Bank of Iran, according to The Wall Street Journal. After passing through the Iranian wallets, the funds were routed through several platforms as part of a complex chain of transactions. One key stop was CoinEx, a cryptocurrency exchange launched in 2017 by Chinese engineer Haipo Yang, a former Tencent engineer who also operates a major bitcoin mining pool.
Blockchain data cited by the WSJ suggests CoinEx has become a major gateway for Iranian crypto users. According to TRM Labs, a blockchain intelligence firm, wallets linked to Iran have moved more than $3.84 billion through CoinEx since 2019. TRM Labs also found that wallets hosted by the exchange received hacked crypto linked to Iran’s central bank and interacted with accounts that U.S. officials have attributed to Iran’s Islamic Revolutionary Guard Corps (IRGC).
CoinEx: A Key Gateway
CoinEx, now based in Seychelles, has faced scrutiny over its ties to Iran. Yang told The Wall Street Journal that the exchange has been widely used by Iranians but denied any connection to the Iranian government. CoinEx said it uses monitoring systems to identify risky activity and has recently begun limiting access from Iran, including blocking new users with Iranian IP addresses. The exchange also said it would review transactions linked to the Bybit hack.
Former employees told The Wall Street Journal that CoinEx began building a presence in Iran shortly after its launch and hired staff in the country to help expand its user base. Over time, the exchange also became integrated into Iran’s informal financial networks operating alongside conventional banking channels.
| Key Figures | Value |
|---|---|
| Amount stolen from Bybit | $1.5 billion |
| Funds moved through CoinEx since 2019 (wallets linked to Iran) | More than $3.84 billion |
| Estimated Iranian crypto market value (2025) | $8 billion – $10 billion |
| Percentage of Iranians owning crypto | Around 13% |
Crypto Boom in Iran
The rise of crypto use in Iran has been fuelled by both investment demand and efforts by citizens to protect savings from the weakening rial. Researchers estimate that around 13% of Iranians own cryptocurrency, with the country's crypto market valued at between $8 billion and $10 billion in 2025. This growth has been accompanied by increasing integration of crypto platforms with Iran's financial system.
Sanctions and Compliance Challenges
The case highlights the difficulties faced by the United States in enforcing sanctions on Iran. CoinEx had already exited the U.S. market after being fined by New York’s attorney general in 2023. Other exchanges have also faced scrutiny: Binance was penalised in 2023 for allowing Iranian users to access its platform. Blockchain data shows Binance was once the largest foreign partner of Iran’s domestic crypto exchange Nobitex, but that relationship weakened after Binance tightened compliance measures in 2022.
By 2024, CoinEx had become Nobitex’s largest foreign counterparty. Earlier this month (report dated June 25, 2026), the Trump administration sanctioned Nobitex, alleging that it supported the Iranian government. TRM Labs data suggests more money flowed from Nobitex to CoinEx than in the other direction, allowing Iranian users to access a broader network of cryptocurrency platforms, including Binance.
The investigation also identified transactions involving CoinEx-hosted wallets and individuals or entities sanctioned by the U.S., though full details were not provided in the source. This case underscores the growing challenge of monitoring digital assets that move across borders and outside traditional financial systems, posing significant implications for import/export professionals and trade policy analysts dealing with Iran-related compliance.
Sources:
