How a crypto exchange became a hub for illicit Iranian cash

Earlier this year, crypto sleuths found an alarming series of transactions tied to two digital wallets controlled by the Central Bank of Iran.

- Dylan Tokar & Will Briskin

Tracing backward, investigators discovered the wallet’s funds were linked to $1.5 billion that North Korean hackers stole from the crypto exchange Bybit. After reaching the Iranian wallets, the money flowed through a complex maze of transactions. One destination was a crypto exchange that has become key to Iran's ability to use cryptocurrency to evade far-reaching U.S. economic sanctions.

CoinEx, an 8-year-old exchange founded by a Chinese engineer, has played a growing role in connecting Iran’s crypto operations to the wider world, blockchain data shows. Since 2019, wallets with an identifiable link to Iran have moved more than $3.84 billion through CoinEx, according to blockchain intelligence firm TRM Labs.

Among its dealings, wallets hosted by the exchange have received hacked crypto acquired by Iran’s Central Bank and transacted directly with accounts that U.S. officials have since attributed to the country’s Revolutionary Guard, that analysis shows.

Haipo Yang, a former Tencent engineer who runs one of the world’s largest bitcoin mining pools, launched CoinEx from Hong Kong in 2017. In text messages with The Wall Street Journal, Yang acknowledged that the exchange had been widely used by Iranians, but said it doesn’t have a relationship with the Iranian government.

CoinEx, which is now based in the African island of Seychelles, maintains a transaction monitoring system, screens for high-risk users and this month began taking steps to distance itself from the Iranian market, including by blocking new users with Iranian IP addresses, Yang said.

A CoinEx spokesperson said the exchange would conduct an internal review of the transactions linking funds with the Bybit hack.