Iranian entities moved more than $3.84 billion since 2019 through CoinEx, a Seychelles-based cryptocurrency exchange founded by Chinese engineer Haipo Yang. Wallets hosted by CoinEx received hacked cryptocurrency obtained by the Central Bank of Iran (CBI) and transacted directly with accounts later attributed to Iran’s Islamic Revolutionary Guard Corps (IRGC). To discover the activity, analytical firm TRM Labs traced stablecoins from wallets attributed to the CBI, including funds linked to $1.5 billion stolen by North Korean hackers. The funds progressed through multiple blockchains and cryptocurrencies to wallets hosted by Nobitex, Iran’s largest cryptocurrency exchange, before being transferred to CoinEx accounts and rendered untraceable through a series of additional steps.

CoinEx became Nobitex’s largest foreign counterparty by 2024, after the United States penalized Binance for allowing Iranian customers to use its platform. More than $763 million moved between CoinEx and Nobitex in 2025. Between 2022 and 2025, CoinEx-hosted wallets processed transactions for Alireza Derakhshan, an Iranian individual allegedly involved in an oil sales network sanctioned by the United States in 2025. CoinEx wallets also sent and received funds from wallets attributed to Zedcex, a London-registered cryptocurrency exchange connected to IRGC-linked sanctions evader Babak Zanjani. CoinEx denied facilitating direct transactions on behalf of Iranian or sanctioned entities.