$1.5 Billion Crypto Link: The North Korean Heist’s Impact on Iran’s Central Bank
What began as a $1.5 billion crypto heist linked to North Korean hackers has revealed a complex web of transactions involving Iran’s central bank. Investigators traced the stolen funds from Bybit through various wallets, ultimately connecting them to CoinEx, a cryptocurrency exchange. This investigation highlights the challenges authorities face in monitoring cross-border digital asset movements.
CoinEx: A Key Link
CoinEx, launched in 2017 by Chinese engineer Haipo Yang, has emerged as a significant platform for Iranian cryptocurrency users. Blockchain data indicates that wallets associated with Iran have transacted over $3.84 billion through CoinEx since 2019. These wallets have received hacked cryptocurrency tied to Iran’s central bank and interacted with accounts linked to the Islamic Revolutionary Guard Corps (IRGC), according to blockchain intelligence firm TRM Labs.
Yang, who previously worked at Tencent and runs a major bitcoin mining pool, stated that CoinEx is widely used by Iranians but denied any ties to the Iranian government. The exchange, now based in Seychelles, has implemented monitoring systems to detect risky activities and has begun restricting access from Iran, including blocking new users with Iranian IP addresses. CoinEx also plans to review transactions related to the Bybit hack.
Crypto Boom in Iran
The increasing use of cryptocurrency in Iran is driven by investment interest and the need for citizens to safeguard their savings amid a declining rial. Research suggests that approximately 13% of Iranians own cryptocurrency, with the market projected to be valued between $8 billion and $10 billion by 2025. Former employees revealed that CoinEx established a presence in Iran shortly after its launch, hiring local staff to expand its user base and integrating into the country’s informal financial networks.
Sanctions Challenges and Iran’s Crypto Network
This case underscores the difficulties the United States faces in enforcing sanctions against Iran, where cryptocurrency usage is on the rise and many trading platforms operate outside US jurisdiction. CoinEx exited the US market after being fined by New York’s attorney general in 2023. Other exchanges, including Binance, have also faced scrutiny for allowing Iranian users access to their platforms.
Blockchain data shows that Binance was once the largest foreign partner of Iran’s domestic crypto exchange, Nobitex, but that relationship weakened after Binance tightened compliance measures in 2022. By 2024, CoinEx had become Nobitex’s largest foreign counterparty. Earlier this month, the Trump administration sanctioned Nobitex for allegedly supporting the Iranian government.
Links to Sanctioned Individuals and Entities
The investigation revealed transactions involving CoinEx-hosted wallets and individuals or entities sanctioned by US authorities. Between 2022 and 2025, CoinEx wallets processed activities linked to Alireza Derakhshan, part of a sanctioned oil sales network. Additionally, CoinEx wallets interacted with Zedcex, a London-registered exchange associated with Iranian businessman Babak Zanjani, known for IRGC-linked sanctions evasion operations.
The US Treasury has previously sanctioned networks connected to over $100 million in cryptocurrency from Iranian oil sales, including Derakhshan. In January, Zedcex and Zanjani were also sanctioned. Transactions involving CoinEx occurred prior to these sanctions.
Observer Voice is the one stop site for National, International news, Sports, Editor’s Choice, Art/culture contents, Quotes and much more. We also cover historical contents. Historical contents includes World History, Indian History, and what happened today. The website also covers Entertainment across the India and World.
