WSJ Reports Iran Used Funds Tied to North Korea’s Bybit Hack Through CoinEx to Evade Sanctions

The Central Bank of Iran appears to have used crypto assets stolen by a North Korean hacking group and laundered them through a Chinese-linked exchange, according to a Wall Street Journal report.

The Journal reported on June 24, citing blockchain analysis, that some of the funds stolen in the Bybit hack flowed into digital wallets controlled by Iran’s central bank.

The funds were traced to about $1.5 billion of crypto assets stolen from Bybit by a North Korean hacking group, the report said. After passing through multiple transactions, the assets were moved to CoinEx, a Chinese-linked cryptocurrency exchange. The transfers may have been used to bypass U.S. economic sanctions on Iran.

TRM Labs, a blockchain analytics firm, estimated that wallets linked to Iran have moved more than $3.84 billion through CoinEx since 2019. Its analysis also found that CoinEx wallets had directly transacted with accounts linked to Iran’s Islamic Revolutionary Guard Corps, or IRGC.

CoinEx was founded in 2017 by Haipo Yang, a former Tencent engineer. The exchange is now headquartered in Seychelles.

Yang told the Journal that CoinEx was widely used by Iranian users, but denied any ties to the Iranian government.

He added that the exchange operates a transaction-monitoring system and screens high-risk users. Starting this month, it has also blocked new signups from Iranian IP addresses as part of efforts to distance itself from the Iranian market.

CoinEx also said it plans to conduct an internal investigation into transactions tied to the Bybit hack funds.