Since February of this year, Western media outlets such as Fortune, (Wall Street Journal), and (New York Times) have reported that internal investigators at Binance discovered over $1 billion in funds flowing to entities associated with Iran, which subsequently led to the firing of an employee.
Binance denies that it fired employees due to compliance whistleblower reports, stating that the departures were due to violations of internal data protection regulations, and has filed a defamation lawsuit against the (Wall Street Journal) on March 11, requesting a retraction of the related report.
Recently, Binance won in two civil lawsuits filed under the U.S. (Anti-Terrorism Act) — the Southern District of New York and the Alabama Federal Court both dismissed all claims made by the plaintiffs, but these cases are civil claims by the victims' families, which fall under a different legal category from the sanctions compliance issues discussed in this article.
This article is written by Leo Schwartz for Fortune, who first disclosed the specific details of the two Chinese VIP accounts: an account belonging to a 79-year-old man transferred out $439 million, and the two accounts are suspected to share the same device.
Binance's position is that platform accounts have not directly transacted with sanctioned entities, that suspicious activities were discovered and reported to law enforcement by Binance itself, and that the involved accounts have been taken offline. The U.S. Department of Justice is currently investigating whether Iran has used Binance to evade sanctions, but it is unclear whether Binance itself is the subject of the investigation.
The following is the full translation by Fortune:
In early 2025, the beleaguered Iranian regime increasingly relied on cryptocurrency to evade economic sanctions. During this period, a VIP account registered in the name of a 79-year-old Chinese resident on the Binance platform transferred digital tokens worth $439 million from the exchange to an external wallet through a series of transfer operations. This wallet subsequently transferred most of the funds to other wallets—Binance's internal investigators later determined that these wallets were linked to Iranian sanctioned entities, including the Islamic Revolutionary Guard Corps.
Investigators noted in documents reviewed by Fortune that the transfer of hundreds of millions by an elderly individual is highly suspicious in itself. Even more concerning is that the related transactions involve the transfer of Tether stablecoins on the Tron blockchain—this is the payment method preferred by cybercriminals and money launderers.
However, surprisingly, these transfers did not trigger any immediate alerts on Binance. Binance had reached a plea agreement worth $4.3 billion with the U.S. government back in late 2023, promising to implement a series of strict compliance procedures.
Amanda Wick, head of the Americas region for crypto compliance software company VerifyVASP and a former federal prosecutor, stated after learning about the transaction details from Fortune: "This is not just a red flag; it is a triggering event that needs to be reported immediately."
The details of this VIP account had never been disclosed before, and its timing is particularly sensitive for Binance. In February of this year, a series of media reports revealed that Binance had fired internal investigators who had reported to executives—these individuals discovered that over $1 billion in funds flowed through the platform to wallets associated with Iran, and one of Binance's close business partners—a Hong Kong entity responsible for arranging the conversion of cryptocurrency to fiat—was also involved in these transfers.
The aforementioned reports have triggered an investigation in the U.S. Senate. Binance responded by stating that the departure of investigators was unrelated to the discovery of Iranian transfers and that the company has complied with its 2023 commitments. However, the new details involving Chinese accounts and Iranian accounts have once again raised questions about the effectiveness of that compliance program.
Binance did not deny the specific methods investigators traced the flow of funds. The exchange defended its operations for the platform's non-compliant transactions and stated that its compliance program is functioning as usual. However, at the same time, according to the Wall Street Journal, the Justice Department is investigating whether Iran is evading sanctions using Binance. A Binance spokesperson stated that the exchange was unaware of any investigation's existence. The Justice Department declined to comment.
Noah Perlman, Chief Compliance Officer at Binance, stated in a statement provided to Fortune: "Binance's compliance program is continuously improving and evolving, aiming to strengthen and prevent issues from recurring."
Chinese associated network
Like traditional financial institutions, cryptocurrency exchanges have dedicated compliance procedures to verify user identities and screen for illegal activities. Binance stated in a blog post earlier this February that its compliance program has nearly 600 full-time employees, which is "industry-leading."
As part of the program, Binance required the 79-year-old Chinese male to upload identification to open a VIP account. (A Binance spokesperson stated that VIP status is automatically granted based on asset holdings and trading volume.) It was through this identification that Binance's internal investigators ultimately determined he had indirectly transferred about $400 million to a previously unrecognized group of Iranian-associated wallets outside of Binance—referred to as "Entity A." Former prosecutor Wick stated that such activities should be automatically flagged by the system.
"If nearly half a billion dollars flows from client accounts into a single non-custodial wallet, then rapidly transfers to wallets associated with sanctioned jurisdictions... this is precisely the type of activity the compliance team should capture," she said.
However, Binance allowed the VIP account to trade freely for several months. These transactions, which began in January 2025, were only flagged by the compliance department after Seychelles law enforcement submitted a request to Binance regarding "a serious case of terrorism financing" on August 11 of that year. A Binance spokesperson told Fortune that the 79-year-old VIP user's account was banned in September 2025 and was taken offline in January 2026.
Other compliance experts expressed surprise at Binance's failure to process the account more swiftly. Robert Appleton, a partner at the Olshan Law Firm and a former federal prosecutor responsible for Iran sanctions cases, told Fortune that, especially considering Binance's troubled history and previous legal predicaments over sanctions evasion issues, he expected the exchange to be more vigilant about any form of suspicious activity. "The agreement with the government changed everything because it raised their obligations," he said.
Meanwhile, the $439 million transfer made in the name of the elderly Chinese individual is only part of the Iranian-related activities. Documents reviewed by Fortune show that former Binance employees found that a group of Iranian-associated wallets, referred to as "Entity A," earned a total of $1.7 billion through companies and individuals holding Binance accounts. "Entity A" then transferred part of these funds to Iran's largest cryptocurrency exchange, Nobitex, as well as to digital wallets associated with U.S.-designated terrorist organizations (such as the Islamic Revolutionary Guard Corps and the Houthis). A Binance spokesperson stated that when the transactions occurred, the aforementioned wallets were not listed on global law enforcement sanctions lists, hence no alerts were triggered.
Although the wallets controlled by "Entity A" and related sanctioned entities are not on the Binance platform, crypto compliance experts told Fortune that the nature of the funds flowing out of Binance itself should have raised alarms.
After receiving a request from Seychelles, Binance investigators launched an investigation and subsequently categorized this series of fund flows as part of the "Chinese associated network"—which also involved another VIP trader. This VIP client is a 38-year-old Chinese woman who transferred nearly $200 million worth of Tether stablecoins into an intermediary wallet between November and December 2024, and then from that wallet to "Entity A." (A Binance spokesperson stated that the term "Chinese associated network" is an "informal internal designation that is not precise and may have changed over time," and indicated that the VIP account was taken offline in January 2026.)
More intriguingly, documents reviewed by Fortune indicate that these two VIP accounts were likely accessed through the same device—implying that the same person, or a third-party entity, may control both accounts. Wick stated: "If two ostensibly unrelated VIP clients are found accessing accounts from the same device, it would raise serious questions about actual ownership."
Regardless, investigators found from blockchain data that both accounts had received funds from Blessed Trust. Blessed Trust is a Hong Kong-based company that helps firms convert crypto funds into fiat currency while also handling payroll, tax, and other backend matters for Binance. Investigators ultimately concluded that of the $1.2 billion that flowed through Blessed Trust into "Entity A," about half came from these two Chinese VIP traders.
Binance attempted to downplay the connection between platform accounts and Iranian-associated wallets, stating in a recent blog that there are multiple intermediaries between the exchange and sanctioned wallets. The blog also noted that $1.1 billion of the funds originated from "a regulated large stablecoin issuer." Investigators wrote in their findings that most of the funds from the two Chinese VIP accounts likely came from stablecoins issued by Circle—a publicly listed U.S. crypto company. A Circle spokesperson told Fortune: "We take our regulatory obligations seriously," and added that Circle had terminated its relationship with Blessed Trust in 2025.
However, Binance has consistently not addressed the specific details of these two Chinese VIP accounts in its blog posts and responses to Fortune and other media. Furthermore, investigators also found that these two accounts shared the same device with Blessed Services (another company associated with Blessed Trust, caught between the funding flows to "Entity A"). The above evidence suggests that the same group of people may have operated all these accounts. A Binance spokesperson declined to comment on the device-sharing details and stated that Blessed Services has no business relationship with the exchange.
Emails related to Blessed Trust and Blessed Services did not respond to Fortune's request for comment.
"Chinese associated network" also involves the final link: a Hong Kong-registered company, Hexa Whale Trading Limited, which operates on the Binance platform and transferred about $500 million to "Entity A." When Binance investigators discovered Hexa Whale's activities, other members of the company's compliance team had already taken the account offline. The Wall Street Journal and The New York Times had previously reported details related to Hexa Whale and Blessed Trust.
Fortune's efforts to contact Hexa Whale and the two Chinese VIP users were unsuccessful.
The investigators involved in the preliminary report were fired by Binance weeks after submitting their initial findings. Binance denied that the aforementioned employees were dismissed for raising compliance issues and stated in a blog that some departures were decisions "made after internal reviews found violations of company data protection and confidentiality regulations." The exchange insisted that it has continued to advance relevant investigations and completed the offline handling of Blessed Trust in January 2026.
The investigators declined to comment.
Iranian associated clues
There was also a separate transaction record that was smaller in scale but still drew the attention of investigators. These transactions were operated by two individuals suspected of Iranian nationality. Compliance experts stated that the fact that these two individuals were able to successfully open accounts and complete transfers on Binance itself raises questions about the strictness of the company's screening procedures.
The first account was opened in 2021 by a 44-year-old male, whose Dominican ID states his birthplace as Iran, and his name appeared in a United Nations Security Council report from 2020—this report involved a network smuggling gold and cash for Iran and North Korea. The second account was also opened in 2021 by a 37-year-old male, whose uploaded Iraqi ID also states his birthplace as Iran. By the time Binance investigators discovered these two accounts, they had already been restricted.
The relevant transactions include: the two accounts each transferring about $100 worth of TRX cryptocurrency to the Iranian-associated wallet group in 2024—TRX is the only currency used to pay transaction fees on the Tron blockchain. Although the total amount is negligible, this TRX transfer is significant as it likely covered key transfer fees between the "Entity A" wallet group. This situation is somewhat akin to tracking credit card records used for paying for gasoline: if the same card is used repeatedly for fuel, it won't tell you who is driving, but it can reveal who is footing the bill for the journey.
Lex Fisun, co-founder and CEO of blockchain analytics firm Global Ledger, stated: "Most people focus only on large transactions, but small transactions are equally important. On the blockchain, you typically cannot link a wallet to a real identity. However, when one address repeatedly transfers TRX to another wallet to pay fees, it indicates a connection between the two."
Additionally, Wick pointed out that the association of these accounts with Iran should have triggered more immediate scrutiny. After all, Binance has pleaded guilty to similar transactions and promised to eradicate such behavior from the platform.
"When multiple high-risk indicators occur simultaneously—especially involving jurisdictions like Iran, which is subject to strict sanctions, or individuals mentioned in United Nations Security Council reports—a properly functioning compliance program should report in real-time," she said. "Account restrictions, enhanced due diligence, blockchain tracking, and sanctions risk assessments should all trigger immediately when issues arise, not months later."
A Binance spokesperson stated that one of the Iranian accounts has been fully taken offline, and the other has been restricted from trading and is in the process of being taken offline. The exchange did not clarify whether these accounts had been restricted at the time of the transactions.
Fortune's efforts to contact the two relevant individuals were unsuccessful.
For any financial institution, engaging with sanctioned entities poses significant risks, and Binance has paid a heavy price for this. In 2023, it reached a $4.3 billion plea agreement with the U.S. government due to failures in establishing effective anti-money laundering and sanctions compliance programs.
According to the plea agreement, co-founder Zhao Changpeng stepped down as CEO and spent four months in federal prison. Binance also agreed to cooperate with the monitors to report internal operations to the Justice Department and the Treasury Department.
However, the recent firings of investigators and the potential Iranian exposure have raised concerns among congressional members. At the end of February, Senator Richard Blumenthal (Democrat, Connecticut) initiated a preliminary investigation into Binance, writing to co-CEO Richard Teng requesting information about the findings of the dismissed investigators and other Iranian-related activities.
Blumenthal also specifically mentioned President Trump's pardon of Zhao Changpeng this October—an action that has raised conflict of interest accusations due to the increasing ties between Binance and Trump family's cryptocurrency business.
A White House spokesperson told Fortune: "President Trump's assets are held in a trust managed by his children, and there is no conflict of interest."
However, Blumenthal told Fortune that Binance's connections to the White House present ongoing ethical risks: "What I am most concerned about is that the relationship between Binance and the government may prevent or dissuade compliance officers from disclosing and reporting violations, which could also hinder the Justice Department's pursuit of this matter."