Iran’s central bank appears to have funneled millions of dollars stolen in the massive Bybit hack through a Chinese-linked exchange called CoinEx – using the proceeds to skirt U.S. sanctions. That is the finding of a Wall Street Journal report published Wednesday, citing blockchain analysis from TRM Labs.
The hack itself was brutal. A North Korean state-sponsored group made off with roughly $1.5 billion in crypto from Bybit. On-chain sleuths traced a portion of those stolen assets through a chain of transactions that ended up in wallets controlled by the Central Bank of Iran. From there, the funds moved onto CoinEx, an exchange founded by former Tencent engineer Haipo Yang and now headquartered in Seychelles.
TRM Labs estimates that wallets linked to Iran have moved more than $3.84 billion through CoinEx since 2019. Its analysis also flagged direct transactions between CoinEx wallets and accounts tied to Iran’s Islamic Revolutionary Guard Corps (IRGC), a designated terrorist organization in the U.S.
Yang told the Journal that CoinEx is “widely used by Iranian users” but denied any link to the Iranian government. He said the exchange operates a transaction-monitoring system and screens high-risk accounts. Starting this month, CoinEx has blocked new signups from Iranian IP addresses – a clear attempt to distance itself from the Iranian market. Yang added that an internal investigation into transactions linked to the Bybit hack funds is planned.
The report lands at a sensitive time. U.S. sanctions on Iran remain tight, and any crypto exchange that knowingly processes sanctioned transactions faces severe legal exposure. CoinEx’s claim of ignorance may not hold if the blockchain trail is as clear as TRM Labs suggests.
For traders, the story reinforces a longer-term risk: exchanges with weak compliance controls can become conduits for illicit flows, inviting regulatory crackdowns that rattle markets. The immediate catalyst to watch is CoinEx’s internal probe – its findings, or lack thereof, will determine whether U.S. authorities step in.
Iran’s central bank laundered stolen Bybit funds through CoinEx to bypass U.S. sanctions
Millions of dollars stolen in the Bybit crypto hack were funneled through CoinEx by Iran’s central bank, helping Iran avoid U.S. sanctions. This involves the central bank and affects efforts to track stolen funds and enforce sanctions.