Skydagger — skydagger.com

Inside the $3.8 Billion Crypto Pipeline Moving Blacklist Iranian Capital Globally

Blockchain intelligence reveals how cryptocurrency exchange CoinEx became a vital conduit for billions of dollars in illicit Iranian capital, processing funds linked to state-backed hacks and sanctioned networks seeking to evade U.S. economic controls.

June 26, 2026Clash Report

Cover Image

Cryptocurrency exchange CoinEx has emerged as a central clearinghouse for illicit Iranian financial flows, facilitating the movement of more than $3.84 billion linked to the sanctioned state since 2019.

Blockchain data compiled by intelligence firm TRM Labs reveals that wallets with identifiable links to Iran have funneled billions through the Seychelles-based platform, according to The Wall Street Journal.

CoinEx has integrated deeply with Iran's domestic shadow financial system, processing hacked digital assets and transacting directly with accounts linked to the Islamic Revolutionary Guard Corps (IRGC).

By 2024, CoinEx effectively replaced Binance as the largest foreign counterparty to Nobitex, Iran's dominant domestic cryptocurrency exchange.

Routing Stolen Millions

Investigators traced an alarming chain of transactions back to two digital wallets controlled by the Central Bank of Iran.

These wallets received a portion of the $1.5 billion stolen by North Korean hackers from the crypto exchange Bybit, routing the funds through a complex maze of bridging services and decentralized finance protocols to obfuscate their origin.

Ultimately, at least $67 million from the hack was forwarded to CoinEx deposit accounts, where the funds were commingled with the platform's treasury assets.

Shadow Banking and Sanctions Evasion

The platform has frequently been utilized by individuals and networks designated under U.S. sanctions programs.

Between 2022 and 2025, CoinEx wallets processed transactions for Alireza Derakhshan, an Iranian national penalized by the U.S. Treasury for his involvement in an IRGC-linked oil sales network.

The exchange also engaged with wallets linked to Zedcex, a London-registered platform associated with Babak Zanjani, a self-described strategist for Iranian state sanctions-evasion operations.

Regulatory Fallout and Retraction

CoinEx was founded in Hong Kong in 2017 by Chinese engineer Haipo Yang and later relocated to Seychelles after agreeing to exit the U.S. market following a 2023 fine by New York's attorney general.

Following recent U.S. sanctions imposed on Nobitex, CoinEx has begun taking measures to distance itself from the Iranian market by blocking new accounts with Iranian IP addresses and implementing stricter identification controls.

Yang acknowledged the heavy historical usage of the platform by Iranian actors but denied maintaining any direct relationship with the Iranian government.

Inside the $3.8 Billion Crypto Pipeline Moving Blacklist Iranian Capital Globally