Wall Street Journal Report Links CoinEx to Iranian Fund Flows and Bybit Hack Proceeds
A report from the Wall Street Journal, citing on-chain analysis from blockchain intelligence firm TRM Labs, has drawn attention to the movement of digital assets through cryptocurrency exchange CoinEx. The report traces more than $3.84 billion in transactions linked to Iranian entities since 2019, including a transaction pathway that reportedly connects two central bank-associated wallets to funds stolen in the Bybit hack.
🚨 Ever wondered where the $1.5B stolen from Bybit may have ended up?
According to the Wall Street Journal, investigators traced transactions linking wallets tied to Iran's central bank with funds connected to the Bybit hack carried out by North Korea's Lazarus Group.
The… pic.twitter.com/6F7rnuwpBG
— Wise Advice (@wiseadvicesumit) June 25, 2026
According to the journal, investigators worked backward from the Iran-linked wallets and identified digital assets that passed through CoinEx before reaching the platform. The analysis, which relies on publicly visible blockchain data, indicates that roughly 60 sanctioned Iranian entities moved funds through the exchange, representing an estimated 8 percent of tracked illicit transaction volume during the period.
Secondary coverage noted that the Wall Street Journal article specifically highlighted the routing tied to assets attributed to North Korean-linked actors responsible for the Bybit breach.
CoinEx has issued a clear rejection of the claims. The exchange stated it has never maintained commercial relationships with Iranian government entities, domestic crypto platforms, the Revolutionary Guard, or sanctioned parties. The company noted that its official domain has been blocked in Iran since 2021 following local regulatory restrictions.
Regarding the stolen Bybit funds, CoinEx said it actively coordinated with Bybit to block related accounts and freeze assets once the breach was identified, and confirmed it would conduct an internal review of the specific transactions referenced in the report.
The exchange also challenged the methodology behind the reported $3.84 billion aggregate. CoinEx argued that the figure combines two-way transaction flows and presents them as unidirectional processing volume, which it described as misleading.
The company emphasized that while blockchain ledgers are publicly traceable, transaction paths do not automatically indicate platform knowledge, endorsement or participation, and noted that different analytics firms can reach varying conclusions depending on how wallet attribution and transaction paths are interpreted.
As of the available reporting, no formal enforcement actions, new sanctions or regulatory penalties have been announced against CoinEx in connection with these findings. The report places the platform under renewed public and regulatory scrutiny as U.S. authorities continue to expand sanctions targeting cryptocurrency accessibility and wallet addresses associated with restricted jurisdictions.
Additional confirmation on the full scope of the on-chain attribution remains pending, and the available sources do not indicate an immediate operational change or formal compliance directive from regulators.
