CoinEx closes its doors, the butterfly effect caused by North Korean hackers?

CN
1 hour ago
The cause of CoinEx's demise is more worth discussing than its manner of death.

Written by: Little Pancake

On September 15, CoinEx founder Yang Haipo tweeted to announce that CoinEx would cease operations.

The wording was very measured: "Taking on unlimited risks for limited income is no longer a rational choice." He stated that he rejected the proposal to sell the exchange and opted for an orderly closure. All user assets are 100% withdrawable, with a reserve ratio exceeding 100%, and the withdrawal window open until December 22.

The comments under this tweet were surprisingly calm, with no curses, no panic, and even some people leaving messages of "respect."

A cryptocurrency exchange that operated for nearly nine years choosing to exit gracefully in 2026 is already a rarity in the industry.

However, the cause of CoinEx's demise is more worth telling than its manner of death.

Butterfly Effect

A cause-and-effect chain that sounds like a joke is circulating in the market, but every link has on-chain evidence.

In February 2025, North Korea's Lazarus Group stole $1.5 billion from Bybit, marking the largest single theft in cryptocurrency history. Bybit did not collapse; Ben Zhou plugged the hole with bridge loans, and withdrawals continued as usual. But this money began a magical journey.

The stolen ETH was first laundered through THORChain's cross-chain bridge and various DeFi protocols in multiple layers, with related exchange volumes on THORChain nearing $3 billion during this period. After the laundering process, TRM Labs traced two wallets belonging to Iran's central bank—Bybit's stolen funds flowed into Iran's treasury. Analysts believe that this money was likely used for international trades to purchase oil and evade sanctions.

Next, Iran's funds needed an outlet to enter the global cryptocurrency market.

Nobitex, Iran's largest cryptocurrency exchange, served as the entry point. And from 2024, the largest foreign trading counterpart of Nobitex was no longer Binance, but CoinEx. In just 2025 alone, the flow of funds between Nobitex and CoinEx exceeded $763 million.

A report released by TRM Labs on June 25, 2026 (also reported by The Wall Street Journal) showed that since 2019, Iran-related wallets processed a total of $3.84 billion in transactions through CoinEx. Approximately $67 million can be directly traced back to the Iranian central bank accounts and has on-chain links to the stolen funds from Bybit.

Three weeks prior (on June 2, 2026), the U.S. Treasury Department's OFAC had already sanctioned four Iranian exchanges—Nobitex, Bitpin, Wallex, and Ramzinex—in the "Economic Fury" operation. This round of sanctions led to a dramatic 78% drop in observable cryptocurrency trading volume in Iran.

CoinEx was not on the sanctions list, but it was named.

Yang Haipo responded by stating that CoinEx indeed had Iranian users but had no ties to the Iranian government, and had begun to block new user registrations from Iranian IPs. The Wall Street Journal's report also did not claim that CoinEx "deliberately" facilitated illegal transfers.

But the damage had already been done. A medium-sized exchange suddenly faced scrutiny and pressure from the U.S. Treasury Department and OFAC. Legal compliance fees, sanctions compliance audits, geopolitical risk assessments—these bills add up to a considerable amount.

Yang Haipo's line about "taking on unlimited risks for limited income" carries deep meaning.

The Lazarus Group first stole CoinEx's money directly (in 2023), then stole Bybit's money (in 2025), and after washing Bybit's stolen money, it flowed back into CoinEx (2025-2026), ultimately leading to regulatory and legal pressure that indirectly overwhelmed CoinEx.

The perpetrator was the same. Killed twice. The first time with a knife, the second time with the butterfly effect.

Graceful Exit, Rare Quality

There are several details in Yang Haipo's announcement worth noting:

Reserve ratio exceeding 100%. This means that CoinEx chose to shut down while being able to fully meet withdrawals, rather than being insolvent. In this industry, such a choice in timing is itself a responsible judgment. Waiting until insolvency to close would mean users cannot get their money back.

Refusal to sell. Yang Haipo stated that he had received acquisition offers but chose to close rather than transfer ownership. His exact words were that shutting down and ensuring users could withdraw their funds in full was the only way to live up to users' trust. Selling the exchange would mean transferring users' assets and data to an unknown new owner, with uncontrollable risks.

CET token buyback. CoinEx announced a buyback of all remaining CET tokens at a price of 0.005 USDT, while the market price was around 0.00466 USDT, making the buyback price slightly above the market price. After September 29, any unwithdrawn CET will automatically be exchanged for USDT at this price.

ViaBTC and CoinEx Wallet operate independently. The mining pool and wallet businesses are unaffected by the exchange's closure.

A three-month withdrawal window. From September 15 to December 22, users have three months to withdraw their assets. After December 22, any unwithdrawn USDT will be transferred to independent custody, incurring a monthly custody fee of 5%, but users can still claim it before August 22, 2028.

Comparing Bitmart: The Cost of Grace and the Cost of Dishonor

CoinEx's exit method becomes clearer when viewed alongside Bitmart.

Bitmart announced its "orderly closure" on July 26, 2026, promising that "withdrawal services will continue to be open."

And then?

Two weeks later, users reported that withdrawal requests were frozen. One user said they could not withdraw their asset of $10.1 million, stating, "Not a penny could be withdrawn." Another user claimed Bitmart released only $5 from their $24,000 withdrawal request.

On-chain monitoring agency Lookonchain reported that within the first 24 hours after the closure announcement, only 58 wallets successfully withdrew a total of about $805,000, and for eight hours, no withdrawals were processed at all.

Founder Sheldon Xia, after remaining silent for two weeks, posted to deny absconding, saying the company "is auditing funds and considering court and third-party audits." He then fell silent again, and by the end of August, hired White & Case as restructuring lawyers, changing "complete closure" to "only one of the options," implying that there might be a distribution to creditors.

After being hacked for $196 million in 2021, Bitmart promised full compensation, yet many users claim they have not received any compensation to date. The "orderly closure" in 2026 similarly devolved into a farce of users chasing the founder for money.

CoinEx and Bitmart closed in the same year, but in entirely different ways. One chose to close while still able to meet withdrawals, providing a three-month window, while the other claimed "withdrawals are normal" but actually froze users' funds.

This is the definition of "grace": taking responsibility before problems arise, rather than waiting until the last moment to admit it.

CoinEx's closure will not be an isolated case.

The regulatory acceleration and liquidity concentration trends triggered by Bybit's hack are exerting systemic pressure on the entire mid-to-small exchange sector. Compliance costs continue to rise, and trading volumes are continuously concentrating towards top platforms like Binance, Coinbase, and OKX, while the survival space for mid-small exchanges is shrinking increasingly.

Yang Haipo chose to close when there was still money. The next exchange founder to close might not have the same luxury and grace.

免责声明:本文章仅代表作者个人观点,不代表本平台的立场和观点。本文章仅供信息分享,不构成对任何人的任何投资建议。用户与作者之间的任何争议,与本平台无关。如网页中刊载的文章或图片涉及侵权,请提供相关的权利证明和身份证明发送邮件到support@aicoin.com,本平台相关工作人员将会进行核查。

Share To
APP

X

Telegram

Facebook

Reddit

CopyLink