Author: Fortune
Compiled by: Deep Tide TechFlow
Deep Tide Introduction: This article is compiled from Fortune's investigative report on March 12. Readers are reminded to note the following background:
Since February this year, Western media outlets including Fortune, The Wall Street Journal, and The New York Times have reported that Binance's internal investigators discovered over $1 billion in funds flowing to entities linked to Iran, and were subsequently fired.
Binance denied firing employees due to compliance whistleblowing, stating that the departures were due to violations of internal data protection policies. On March 11, Binance filed a defamation lawsuit against The Wall Street Journal, demanding a retraction of the related reports.
Concurrently, Binance won two civil lawsuits filed under the U.S. Anti-Terrorism Act—federal courts in the Southern District of New York and Alabama dismissed all claims from the plaintiffs. However, these cases were civil claims by victims' families, which belong to a different legal category than the sanctions compliance disputes discussed in this article.
This article was written by Fortune author Leo Schwartz, who for the first time disclosed specific details of two Chinese VIP accounts: an account under the name of a 79-year-old individual transferred out $439 million, and the two accounts were suspected of sharing the same device.
Binance's stance is: platform accounts did not directly trade with sanctioned entities; the suspicious activity was discovered by Binance itself and reported to law enforcement agencies; the involved accounts have been taken offline. Currently, the U.S. Department of Justice is investigating whether Iran used Binance to evade sanctions, but it is unclear whether Binance itself is the target of the investigation.
Below is the full compilation of the Fortune article:
In early 2025, the embattled Iranian regime increasingly relied on cryptocurrency to circumvent economic sanctions. During this period, a VIP account on the Binance platform, registered under the name of a 79-year-old Chinese resident, transferred $439 million worth of digital tokens from the exchange to external wallets through a series of transactions. These wallets subsequently transferred most of the funds to other wallets—which Binance's internal investigators later identified as being associated with Iranian sanctioned entities, including the Islamic Revolutionary Guard Corps.
As noted in documents reviewed by Fortune, the transfer of hundreds of millions of dollars by an elderly individual was itself highly suspicious. More concerning was that the transactions involved transferring Tether stablecoins on the Tron blockchain—a preferred payment method for cybercriminals and money launderers.
Surprisingly, however, these transfers did not trigger any immediate alerts at Binance. This was despite Binance having reached a $4.3 billion plea agreement with the U.S. government in late 2023, promising to implement a series of stringent compliance procedures.
Amanda Wick, Head of Americas at crypto compliance software firm VerifyVASP and a former federal prosecutor, stated after learning the details of these transactions from Fortune: "This is not just a red flag; it's a trigger event that requires immediate reporting."
The details of this VIP account had not been publicly disclosed before, and its emergence is particularly sensitive for Binance. In February, a series of media reports revealed that Binance had dismissed internal investigators who had reported to senior management—these individuals had discovered that over $1 billion in funds flowed through the platform to wallets linked to Iran, and that a close business partner of Binance—a Hong Kong-based entity responsible for arranging conversions between cryptocurrency and fiat currency—was also involved in these transfers.
These reports have prompted an investigation by the U.S. Senate. Binance responded that the investigators' departures were unrelated to the discovery of Iranian transfers and that the company has been adhering to its 2023 compliance commitments. However, new details involving Chinese and Iranian accounts have again raised doubts about the effectiveness of this compliance program.
Binance did not deny the specific methods investigators used to trace the fund flows. The exchange defended the platform's handling of the违规 (non-compliant) transactions and stated that its compliance program is functioning normally. Meanwhile, according to The Wall Street Journal, the Department of Justice is investigating whether Iran used Binance to evade sanctions. A Binance spokesperson said the exchange is unaware of any such investigation. A DOJ spokesperson declined to comment.
Binance Chief Compliance Officer Noah Perlman said in a statement provided to Fortune: "Binance's compliance program is continuously improving and evolving, with the goal of constantly strengthening and preventing issues from recurring."
China-Linked Network
Like traditional financial institutions, crypto exchanges have specialized compliance procedures to verify user identities and screen for illegal activities. In a February blog post, Binance stated that its compliance program has nearly 600 full-time employees and is "industry-leading."
As part of this process, Binance required this 79-year-old Chinese man to upload identification documents to open a VIP account. (A Binance spokesperson said VIP status is automatically granted based on asset holdings and trading volume.) It was through this ID that the exchange's internal investigators ultimately determined that he had indirectly transferred approximately $400 million to a previously unidentified group of Iran-linked wallets outside Binance—which investigators referred to as "Entity A." Former prosecutor Wick said this type of activity should have been automatically flagged by the system.
"If nearly half a billion dollars moves from a customer account to a single non-custodial wallet and then quickly flows to wallets associated with a sanctioned jurisdiction... this is exactly the type of activity a compliance team should capture," she said.
However, Binance allowed this VIP account to trade freely for months. These transactions, which began in January 2025, were not flagged by the compliance department until August 11 of that year, after Seychelles law enforcement submitted a request to Binance regarding "a serious terrorism financing case." A Binance spokesperson told Fortune that the 79-year-old VIP user's account was blocked in September 2025 and fully taken offline by January 2026.
Other compliance experts expressed surprise that Binance did not handle the account more quickly. Robert Appleton, a partner at law firm Olshan and former head of the Iran sanctions task force at the DOJ, told Fortune that especially given Binance's checkered past and previous legal troubles over sanctions evasion, he would have expected the exchange to be more vigilant about any form of suspicious activity. "The agreement with the government changes everything because it raises their obligations," he said.
Meanwhile, the $439 million transfer in the name of this Chinese elderly individual was only part of the Iran-related activity. Documents reviewed by Fortune show that former Binance employees discovered in their investigation that the Iran-linked wallet cluster, referred to as "Entity A," received a total of $1.7 billion from companies and individuals holding Binance accounts. "Entity A" then transferred part of these funds to Nobitex, Iran's largest cryptocurrency exchange, and to digital wallets associated with U.S.-designated terrorist organizations such as the Islamic Revolutionary Guard Corps and the Houthis). The Binance spokesperson said that at the time of the transactions, none of these wallets were on sanctions lists maintained by global law enforcement agencies, so they did not trigger any alerts.
Although the wallets controlled by "Entity A" and related sanctioned entities were not on the Binance platform, crypto compliance experts told Fortune that the nature of the funds flowing out of Binance itself should have raised alarms.
After receiving the request from Seychelles, Binance investigators opened a case and subsequently characterized this series of fund flows as part of a "China-Linked Network"—which also involved another VIP trader. This VIP client was a 38-year-old Chinese woman who transferred nearly $200 million in Tether stablecoins to an intermediate wallet between November and December 2024, which then transferred the funds to "Entity A." (The Binance spokesperson said the term "China-Linked Network" was "an internal, informal designation, not precise, and may have evolved over time," and stated that this VIP account was also taken offline by January 2026.)
More intriguingly, documents reviewed by Fortune indicate that these two VIP accounts were highly likely accessed from the same device—suggesting that the same person, or a third-party entity, might have controlled both accounts. Wick said: "If two ostensibly unrelated VIP clients are found accessing their accounts from the same device, it raises serious questions about beneficial ownership."
In any case, investigators found from blockchain data that both accounts had received funds from Blessed Trust. Blessed Trust is a Hong Kong-based enterprise that helps companies convert crypto funds into fiat currency and also handles back-office tasks like payroll and taxes for Binance. Investigators ultimately concluded that of the total $1.2 billion flowing through Blessed Trust into "Entity A," approximately half came from these two Chinese VIP traders.
Binance attempted to downplay the connection between the platform accounts and the Iran-linked wallets, stating in a recent blog post that there were multiple intermediaries between the exchange and the sanctioned wallets. The post also noted that $1.1 billion of the funds originated from "a large, regulated stablecoin issuer." Investigators concluded in their findings that most of the funds from the two Chinese VIP accounts likely came from stablecoins issued by Circle—a U.S.-listed crypto company. A Circle spokesperson told Fortune: "We take our regulatory obligations seriously," adding that Circle had designated Blessed Trust for termination in 2025.
However, Binance, in its blog post and responses to Fortune and other media, consistently avoided addressing the specific details of these two Chinese VIP accounts on its platform. Furthermore, investigators also found that these two accounts and Blessed Services (another company related to Blessed Trust, which was intermediary in the fund flow to "Entity A") also shared the same device. This evidence suggests the same group might have operated all these accounts. The Binance spokesperson declined to comment on the device-sharing details and stated that Blessed Services has no business relationship with the exchange.
Email addresses associated with Blessed Trust and Blessed Services did not respond to Fortune's requests for comment.
The "China-Linked Network" involved one final link: a Hong Kong-registered company, Hexa Whale Trading Limited, which operated on the Binance platform and transferred approximately $500 million to "Entity A." By the time Binance investigators discovered Hexa Whale's activity, other members of the company's compliance team had already taken the account offline. The Wall Street Journal and The New York Times had previously reported details related to Hexa Whale and Blessed Trust.
Fortune's attempts to contact Hexa Whale and the two Chinese VIP users were unsuccessful.
The investigators involved in the preliminary report were fired by Binance weeks after submitting their initial findings. Binance denied that these employees were dismissed for raising compliance issues and stated in a blog post that the departure of some personnel was decided "after an internal review found violations of company data protection and confidentiality policies." The exchange insisted that it continued the relevant investigation and completed the takedown of Blessed Trust in January 2026.
The investigators declined to comment.
Iran-Linked Clues
Another, smaller set of transaction records also caught the investigators' attention. These transactions were operated by two individuals suspected of Iranian nationality. Compliance experts stated that the mere fact that these two individuals were able to successfully open accounts on Binance and complete transfers already raises questions about the strictness of the company's screening procedures.
The first account was opened in 2021, held by a 44-year-old male whose Dominica ID indicated Iran as his place of birth, and whose name appeared in a 2020 UN Security Council report—a report concerning a gold and cash smuggling network serving Iran and North Korea. The second account was also opened in 2021, held by a 37-year-old male whose uploaded Iraqi ID also indicated Iran as his place of birth. By the time Binance investigators discovered these accounts, they had already been restricted.
The relevant transactions included: each of the two accounts transferring around $100 worth of TRX cryptocurrency to the Iran-linked wallet cluster in 2024—TRX is the native currency used to pay transaction fees on the Tron blockchain. Although the total amount was negligible, this TRX transfer was significant because it likely paid the fees for transfers between the "Entity A" wallet cluster. This situation is roughly analogous to tracking credit card records used to pay for car fuel: if the same card repeatedly pays for gas, it doesn't tell you who is driving, but it can reveal who is footing the bill for the journey.
Lex Fisun, Co-founder and CEO of blockchain analytics firm Global Ledger, said: "Most people only look at large transactions, but small transactions are equally important. On the blockchain, you often can't link a wallet to a real identity. However, when an address repeatedly sends TRX to another wallet to pay fees, it indicates a connection between the two."
Furthermore, Wick pointed out that the association of these accounts with Iran should have triggered more immediate scrutiny. After all, Binance had already pleaded guilty for similar transactions and promised to eradicate such behavior on its platform.
"When multiple high-risk indicators appear simultaneously—especially involving a heavily sanctioned jurisdiction like Iran, or individuals appearing in UN Security Council reports—a properly functioning compliance program should report in real-time," she said. "Account restrictions, enhanced due diligence, blockchain tracing, sanctions risk assessments, these measures should be triggered immediately when the issue occurs, not months later."
The Binance spokesperson said one of the Iranian accounts has been completely taken offline, and the other has been restricted from trading and is in the process of being taken offline. The exchange did not specify whether these accounts were restricted at the time the transactions occurred.
Fortune's attempts to contact the two relevant individuals were unsuccessful.
Exposure to sanctioned entities is a significant risk for any financial institution, and Binance has already paid a heavy price for it. In 2023, it reached a $4.3 billion plea agreement with the U.S. government, partly for failing to maintain an effective anti-money laundering and sanctions compliance program.
Under the plea agreement, co-founder Changpeng Zhao stepped down as CEO and spent four months in federal prison. Binance also agreed to cooperate with a monitor reporting to the Justice and Treasury Departments on its internal operations.
However, the recent dismissal of investigators and the potential Iranian exposure have raised concerns among members of Congress. In late February, Senator Richard Blumenthal (D-Conn.) launched a preliminary investigation into Binance and sent a letter to co-CEO Richard Teng requesting information on the findings of the dismissed investigators and other Iran-related activities.
Blumenthal also specifically mentioned President Trump's pardon of Changpeng Zhao in October—a move that raised conflict-of-interest allegations due to Binance's increasingly close ties to the Trump family's cryptocurrency business.
A White House spokesperson told Fortune: "President Trump's assets are held in a trust managed by his children, and there is no conflict of interest."
However, Blumenthal told Fortune that Binance's connection to the White House presents ongoing ethical concerns: "One of my biggest concerns is that the relationship between Binance and the administration could deter or discourage compliance monitors from exposing and reporting violations, or could hinder the Justice Department from pursuing prosecution."
