CoinEx: A $3.84B Iran Report in June, a Shutdown in September

In the early hours of 15 September 2026, Haipo Yang posted a letter on X telling his customers that CoinEx was closing. CoinEx is a crypto exchange, a company that works like an online stockbroker: it holds customers' digital money and lets them buy and sell. It went live on 22 December 2017. It will switch off on 22 December 2026, nine years to the day.

The letter opened with reassurance. CoinEx said it held more than 100 per cent of what it owed customers and that withdrawals would stay open until 02:00 UTC on 22 December. Everything else is being shut in stages. Futures, loans and savings products stopped on 22 September. Ordinary buying and selling ends on 29 September, and any coins still sitting in accounts at that point will be sold for Tether, a digital token designed to stay worth one US dollar, whether the owner wants to sell or not. Coins with no market elsewhere will simply be dropped. Money left behind after December goes into custody at a fee of 5 per cent of the balance a month, with claims closing on 22 August 2028.

Yang's explanation was short. CoinEx "did not become one of the industry's leading exchanges", he wrote, and the security and compliance risks of running one had become hard to contain. "Carrying unlimited risk for limited revenue is no longer a rational choice." The company's formal notice blamed a long market slump, shrinking trading volumes and rising regulatory costs across major countries.

Neither document mentioned Iran. Twelve weeks earlier, on 24 June, the blockchain analytics firm TRM Labs had published a report titled "How CoinEx Became Iran's Primary Gateway to Global Cryptocurrency Markets". It said it had traced $3.84 billion moving between CoinEx and sanctioned Iranian companies over more than seven years. CoinEx denied it. The company has not linked the report to its closure, and nothing in the public record does. The sequence is simply this: the report in June, the shutdown in September.

What the report said

Crypto payments are recorded on public ledgers called blockchains, which anyone can read, rather like a stock exchange tape that shows every trade but not the names of the traders. Firms such as TRM Labs, Chainalysis and Elliptic make their living by attaching names to the accounts on that tape.

TRM's central finding concerned Nobitex, Iran's largest crypto exchange. Since November 2018, it said, $2.7 billion had moved between Nobitex and CoinEx in about 6.2 million transfers, roughly $1 million a day. By 2024 CoinEx was Nobitex's biggest outside trading partner, by nearly nine times over the next named exchange. TRM found direct links between CoinEx and more than 60 Iranian platforms, including Wallex, Ramzinex and Bitpin, and said each major Iranian exchange sent a similar slice of its business, roughly 5 to 10 per cent, through CoinEx. That, it argued, pointed to "a coordinated arrangement rather than organic adoption".

The report went further. It said about $67 million from the Central Bank of Iran reached CoinEx between June 2025 and June 2026, after being passed across several blockchains to disguise where it came from. It traced about $6 million to wallets tied to the Islamic Revolutionary Guard Corps (IRGC), which the United States lists as a terrorist organisation, and about $374,000 to Palestinian Islamic Jihad. It also named ViaBTC, a bitcoin mining pool (a co-operative in which thousands of computers combine to earn new coins) owned by the same parent company as CoinEx, Viabtc Technology Limited. TRM said ViaBTC had paid $154 million to wallets linked to Nobitex, and that mining wallets connected to it sent about $2.7 million to Nobitex after the pro-Israel hacking group Predatory Sparrow drained and destroyed about $90 million of Nobitex's funds in June 2025.

The report arrived three weeks after a crackdown. On 2 June 2026 the US Treasury's Office of Foreign Assets Control (OFAC), the office that enforces American sanctions, had blacklisted Nobitex, Wallex, Bitpin and Ramzinex, along with Nobitex's chairman, Amir Hossein Rad. A company on that list is cut off from the American financial system, and outsiders who keep dealing with it risk the same treatment. TRM said CoinEx changed its hot wallets, the internet-connected accounts an exchange uses for day-to-day withdrawals, on the day of the sanctions, and that flows between CoinEx and Iranian exchanges fell below $150,000 after 4 June.

What CoinEx said

CoinEx rejected the report. It said it had never set up a business relationship with Iranian government bodies or helped any sanctioned party, and that money passing through a platform on a blockchain did not mean the platform knew about it. It called TRM's method of adding flows in both directions into one total misleading, pointed out that Iran's authorities had blocked its website since 2021, and said it had cut off Iranian users after the June sanctions. The Wall Street Journal also reported on the findings. As of 28 September, CoinEx had not been sanctioned, and no government had publicly accused it of breaking sanctions law.

Its token did not wait for a verdict. CET, a coin CoinEx issued in 2018 that gave holders discounts on trading fees, rather like a loyalty card that trades on the open market, was worth about 1.8 US cents on 24 June. A week later it was worth 1.1 cents, a fall of about 40 per cent, according to prices from CoinGecko. It fell again in September, from 1.26 cents on 1 September to 0.49 cents on 14 September, the day before Yang's letter.

©CMZ chart. Data: CoinGecko

The last buyback

Yang promised to buy back every CET for half a US cent (0.005 Tether), the price at which it first listed in 2018, with no limit on quantity. About 2.44 billion CET are in circulation, so the whole lot is worth about $12.2 million at that price. At its peak in July 2018, CET traded at about 15 cents; the buyback returns roughly 3 per cent of that. "I am sorry that we were not able to create the long-term value we once hoped CET would deliver," Yang wrote. He also said he had seriously considered selling CoinEx and decided not to: "A clean ending is the right ending." CoinEx Smart Chain, the company's own blockchain, and its OneSwap trading service close on 29 September. CoinEx Wallet and CoinEx Vault, run as separate businesses, carry on.

A record before Iran

The Iran report was not CoinEx's first bad headline. On 12 September 2023, its systems spotted strange withdrawals from its hot wallets. The private keys, the secret codes that approve payments from a wallet, had leaked. Coins left on more than a dozen blockchains, including 231 bitcoin, 4,953 ether and 137 million Tron tokens. Estimates of the total ran from about $53 million to $70 million. Elliptic put it at about $54 million and linked the thief to North Korea's Lazarus Group, after some of the money passed through an address used to launder the proceeds of the Stake.com hack earlier that month. CoinEx covered the losses from its own reserve fund.

Earlier that year it had been thrown out of New York. Letitia James, the state's attorney general, sued CoinEx in February 2023 after her investigators opened an account from a New York internet address and traded tokens she considered securities and commodities, which requires a broker-dealer registration CoinEx did not have. In June 2023 it settled, refunding $1,172,971.50 to 4,691 New York investors, paying more than $600,000 in penalties and agreeing to block New York users. It then left the United States. In November 2023 a Quebec tribunal fined CoinEx companies C$2 million and Yang personally C$300,000 for operating without registration. In 2025 Thailand's Securities and Exchange Commission ordered the site blocked for operating without a licence.

CoinEx is the third long-running exchange to announce its closure since July, after BitMEX and BitMart. Yang's stated reasons were a slump and the cost of compliance. The June report, on which no regulator has yet said a word, sits in the record beside them. TRM itself warned that it could not tell whether Iranian traffic had stopped after June or simply moved to accounts nobody had traced yet.