In early 2025, an embattled Iranian regime was turning increasingly to crypto in order to thwart sanctions choking its economy. During this time, a VIP account on Binance registered to a 79-year-old Chinese resident used a series of transfers to send $439 million worth of digital tokens from the crypto exchange to an outside wallet. That wallet in turn forwarded most of the funds to ones that company investigators would later identify as connected to sanctioned organizations linked to Iran like the Islamic Revolutionary Guard Corps.
As the investigators detailed in documents reviewed by Fortune, it was suspicious for a single elderly man to be moving hundreds of millions of dollars. This was especially the case since the transactions in question involved moving Tether stablecoins on the blockchain Tron—a payment method favored by cyber-criminals and money launderers.
Surprisingly, though, the transfers triggered no immediate alarms for Binance, which had agreed in late 2023 to impose a rigorous series of compliance procedures as part of a $4.3 billion plea agreement with the U.S. government.
“This is not merely a red flag, it is an immediate escalation trigger,” said Amanda Wick, a former federal prosecutor and head of Americas at the crypto compliance software company VerifyVASP, upon learning of the transactions from Fortune.
The details of the VIP account, which have not been previously reported, come at a sensitive time for Binance. In February, a series of media reports revealed that the company had fired internal investigators who had described to top executives that over $1 billion had flowed through the exchange to Iran-linked wallets, and that one of Binance’s close commercial partners—a Hong Kong entity that arranged crypto to fiat payments—had facilitated the transfers.
Binance has responded to the reports, which have prompted inquiries by the U.S. Senate, by arguing the investigators’ departures were unrelated to the discovery of the Iran transfers, and that the company has upheld its 2023 pledge to maintain a rigorous compliance program. The new details related to the Chinese and Iranian accounts, however, raise new questions about the efficacy of that program.
Binance has not disputed the specifics of how investigators linked money flows to these accounts. The exchange has defended its approach to any illicit transactions on its platform and argued that its compliance program worked as designed. Still, this comes as the Justice Department is reportedly investigating Iran’s use of Binance to evade sanctions, according to the Wall Street Journal. A Binance spokesperson said the exchange isn’t aware of any investigations. A DOJ spokesperson declined to comment.
“Binance’s compliance program is constantly improving and evolving,” said the exchange’s chief compliance officer Noah Perlman in a statement shared with Fortune. “The goal is to become stronger and prevent issues from recurring.”
Chinese nexus
Like traditional financial institutions, crypto exchanges have dedicated compliance procedures set up to verify users and to screen for illegal activity. In a blog post in February, Binance touted a “best-in-class” program that has almost 600 full-time employees.
As part of this program, Binance asked the 79-year-old Chinese man to upload an ID to open his VIP account. (Binance users automatically receive VIP status based on asset holdings and trading volumes, a spokesperson said.) That’s how internal investigators at the exchange eventually found he had indirectly contributed around $400 million to a cluster of previously unidentified wallets tied to Iran outside of Binance, which they dubbed “Entity A”—the sort of activity that Wick, the former prosecutor, says should be flagged as a matter of course.
“If nearly half a billion dollars move out of a client’s account into a single noncustodial wallet, then quickly flow onward to wallets tied to a sanctioned jurisdiction… that’s the kind of activity compliance teams are built to catch,” she said.
Binance, though, allowed the VIP’s account to trade freely for months. The exchange’s compliance staff would only flag the activity, which began in January of 2025, much later, after a law enforcement agency in the Seychelles submitted a request to Binance on Aug. 11 concerning “a serious case involving terrorism financing.” A Binance spokesperson told Fortune that the 79-year-old VIP user’s account was blocked in September 2025 and offboarded in January 2026.
Other compliance experts expressed surprise that Binance did not move more promptly to address the account. Robert Appleton, a partner at Olshan Frome Wolosky who used to prosecute Iran-related sanctions cases for the Justice Department, told Fortune that, especially in light of Binance’s checkered past and prior legal struggles with sanctions evasion, he expected the exchange would be more vigilant about suspicious activity of any sort. “That agreement with the government changes everything because it increases their obligations,” he said.
Meanwhile, the $439 million of transfers made in the name of the elderly Chinese man represent only part of the Iran-related activity. The documents reviewed by Fortune show that, in the course of their investigation, the former Binance staffers found that the cluster of Iran-linked wallets known as Entity A had received $1.7 billion in total via businesses and individuals who held Binance accounts. Entity A, in turn, sent a portion of those funds to the largest Iranian crypto exchange, Nobitex, and to digital wallets linked to U.S.-designated terrorist groups like the IRGC and the Houthis. A Binance spokesperson said that none of the wallets were sanctioned by global law enforcement agencies when the transactions occurred, meaning the transfers did not trigger alerts.
Though the wallets controlled by Entity A and the sanctioned groups did not sit on Binance, the nature of the flows from the crypto exchange still should have raised alarm bells, crypto compliance experts told Fortune.
The Binance investigators, who opened a case after receiving the Seychelles request, would come to describe the series of flows as part of a “Chinese nexus” that also included another VIP trader. In this case, the VIP customer was a 38-year-old Chinese woman who sent nearly $200 million of the stablecoin Tether to an intermediary wallet, which then relayed the funds to Entity A between November and December 2024. (A spokesperson for Binance said the term “Chinese nexus” was “an informal internal reference that is imprecise and likely changed over time” and that the VIP’s account was offboarded in January 2026.)
Even more revealing, documents reviewed by Fortune showed that the accounts for the two VIPs likely accessed Binance from the same device—suggesting the same person, or possibly a third party entity, controlled both accounts. “If two ostensibly unrelated VIP clients were also found to be accessing accounts from the same device, that would raise serious beneficial ownership concerns,” said Wick.
In any case, the investigators found blockchain data that revealed both accounts had received funds from Blessed Trust, a Hong Kong-based business that helps firms convert crypto funds to fiat, and that also performed back-office tasks such as payroll and taxes for Binance. They eventually concluded that, of the $1.2 billion in total funds that flowed through Blessed Trust to Entity A, around half came from the two Chinese VIP traders.
Binance has sought to downplay the links between accounts on its platform and the Iran-linked wallets, arguing in a recent blog post that there were multiple intermediaries between the exchange and the sanctioned wallets. The post also notes that $1.1 billion of the funds flowed into Binance from a “major regulated stablecoin issuer.” In their findings, the investigators wrote that the two Chinese VIP accounts likely received a majority of their funds through stablecoins issued by Circle, the publicly traded U.S. crypto company. “We take our regulatory obligations seriously,” a Circle spokesperson told Fortune, adding that Circle had terminated Blessed Trust as a customer in 2025.
However, Binance’s blog posts as well as responses to Fortune and other media outlets concerning the money flows have not included the specifics of the two Chinese VIP accounts on its exchange. Moreover, the investigators found the two accounts also shared a device with Blessed Services, another business tied to Blessed Trust that sat in between crypto flows to Entity A. The evidence suggests that the same people may have operated all of the accounts. A Binance spokesperson declined to comment on device sharing details and said that Blessed Services had no business relationship with the exchange.
An email address tied to Blessed Trust and Blessed Services did not respond to a request for comment.
The “Chinese nexus” included one more element: a Hong Kong-registered business, Hexa Whale Trading Limited, which operated on Binance, and sent around $500 million to Entity A. By the time Binance investigators discovered the Hexa Whale activity, other members of the company’s compliance team had already offboarded the account. The Wall Street Journal and New York Times previously reported details about Hexa Whale and Blessed Trust.
Efforts by Fortune to reach Hexa Whale and the two Chinese VIP users were unsuccessful.
Those investigators involved in the initial reports were fired by Binance in the weeks after they filed their initial conclusions. Binance denied that the employees were let go for raising compliance concerns and said in a blog post that some left “after an internal review found breaches of company data-protection and confidentiality guidelines.” The exchange maintains that it continued the investigation and that it offboarded Blessed Trust in January 2026.
The investigators declined to comment.
The Iran connection
Though much smaller in volume, a separate pattern of transactions on Binance also concerned the investigators. These were carried out by two suspected Iranian nationals. According to compliance experts, the success of these individuals in obtaining Binance accounts and sending funds in the first place raises questions about the rigor of the company’s screening program.
The first account, opened in 2021, belonged to a 44-year-old with an ID from Dominica that listed Iran as his place of birth, and whose name appeared in a 2020 report from the United Nations Security Council about a gold-and-cash smuggling network for Iran and North Korea. The other account, also opened in 2021, belonged to a 37-year-old who uploaded an Iraqi ID that listed Iran as his place of birth. The pair of accounts had been restricted by the time the Binance investigators discovered them.
Those transactions included both accounts sending around $100 each in 2024 to the Iran-linked cluster in a cryptocurrency called TRX, which is the only currency accepted by the Tron blockchain to pay for transactions. While the overall sum may have been trivial, the transfer of TRX was significant as it likely paid for the vital transfer fees between the cluster of wallets in Entity A. The situation is roughly analogous to tracking the credit card payments used to pay for a car’s fuel. If the same card keeps paying for gas, it won’t describe who’s driving, but can signal who’s funding the car’s trip.
“Most people look only at big transactions, but small ones are equally important,” said Lex Fisun, cofounder and CEO of the blockchain analytics company Global Ledger. “On the blockchain, you usually cannot link a wallet to a real person. However, when one address repeatedly sends TRX to cover another wallet’s fees, that shows a connection.”
Moreover, Wick noted that the accounts’ ties to Iran also should have drawn more immediate scrutiny. Binance, after all, had pleaded guilty to charges related to similar transactions and had pledged to stamp out such activity on its platform.
“In a scenario where multiple high-risk indicators converge—particularly involving a heavily sanctioned jurisdiction such as Iran or individuals identified in reporting by the United Nations Security Council—a properly functioning compliance program should escalate in real time,” she said. “You would expect account restrictions, enhanced due diligence, blockchain tracing, and a sanctions risk assessment. These are the kinds of issues that should trigger action as they occur, not months after the fact.”
A Binance spokesperson said that one of the Iranian accounts was fully offboarded and the other is blocked from making transactions and is in the offboarding process. The exchange did not specify if the accounts were restricted at the time of the transactions.
Efforts by Fortune to reach the two individuals were unsuccessful.
Fallout
Exposure to sanctioned entities is a significant worry for any financial institution, and Binance already has paid a hefty price for its connections to Iran. In 2023, it struck a $4.3 billion plea deal with the U.S. government for failing to establish effective anti-money laundering and sanctions programs, among other charges.
As part of the plea agreement, the exchange’s cofounder, Changpeng Zhao, stepped down as CEO and spent four months in federal prison. Binance also agreed to cooperate with monitors that reported to the DOJ and Treasury Department about its internal operations.
But the recent firings of the investigators and potential exposure to Iran has members of Congress worried. In late February, Sen. Richard Blumenthal (D-Conn.) opened a preliminary inquiry into Binance and sent a letter to co-CEO Richard Teng demanding information on the fired investigators’ findings and other Iran-related activity at Binance.
Blumenthal also pointed to President Donald Trump’s recent pardon of Zhao in October, which drew accusations of conflicts of interest due to Binance’s increasing ties to the Trump family’s crypto businesses.
“President Trump’s assets are in a trust managed by his children,” a White House spokesperson told Fortune. “There are no conflicts of interest.”
Still, Blumenthal told Fortune that Binance’s connection to the White House raises ongoing ethics concerns: “One of my main worries is that the relationship between Binance and the administration may discourage or deter the compliance monitors from uncovering and reporting wrongdoing, or the Department of Justice from pursuing and prosecuting it.”
