Binance and Iran: What the $1.7 billion trail actually shows

Binance (Courtesy: Reuters photo)

The issue did not surface through a regulator or a whistleblower. It emerged from Binance’s own internal investigators. While reviewing transaction patterns last year, the team found that people located in Iran had accessed more than 1,500 Binance accounts in a twelve-month period. That alone was sensitive, given Iran’s sanctions status. What followed was more serious.

Investigators traced about $1.7 billion in cryptocurrency transfers from two Binance accounts to entities with links to Iran. According to internal records reviewed by The New York Times, some of those recipient wallets were connected to groups flagged by law enforcement for terror financing. One of the originating accounts, the investigators found, was linked to a Binance vendor rather than an ordinary customer.

Why this mattered more than earlier violations

This was not happening in a regulatory vacuum. In 2023, Binance pleaded guilty in the United States to breaking anti-money-laundering and sanctions laws. The company admitted it had allowed users from Iran and other sanctioned countries onto its platform, paid a $4.3 billion penalty, and promised to report future violations to US authorities.

The Iran-linked transactions uncovered internally occurred after that settlement. That is why they landed differently. They suggested that sanction exposure was not just a legacy issue from Binance’s early growth years but something still surfacing under a supposedly tightened compliance regime.

What happened to the investigators

After reporting their findings to senior executives, at least four employees involved in the investigation were suspended or dismissed within weeks, according to internal documents and people familiar with the episode. Binance said the actions were taken over breaches of protocol related to handling confidential client data, not because staff raised compliance concerns.

The timing, however, unsettled people inside the firm. Over the following months, several senior compliance figures left Binance, including a sanctions manager and the head of enterprise compliance. The company’s chief compliance officer has also discussed leaving, according to people familiar with internal conversations.

How vendors and intermediaries came into focus

The investigation expanded beyond direct user accounts. One strand examined a Hong Kong firm, Hexa Whale Trading, which allegedly moved roughly $490 million through Binance to wallets tied to Iranian entities. Israeli law enforcement officials told investigators they believed Hexa Whale was linked to financing groups such as the Houthis.

Another strand focused on Blessed Trust, a Hong Kong company that acted as a “fiat partner” for Binance, handling payments and operational disbursements. Investigators linked about $1.2 billion in transfers from Blessed Trust’s Binance account to Iranian-linked wallets over roughly two years, including wallets allegedly associated with Iran’s Revolutionary Guards.

Binance says these links were indirect, involving multiple intermediary wallets, and that neither Hexa Whale nor Blessed Trust transactions amounted to sanctions breaches under its interpretation.

Binance rejects claims

Refuting the claims made in the NYT report, Binance spokesperson said, “We strongly dispute the assertions made in recent reports. Binance did not violate sanctions laws in respect of the transactions described in the article and is subject to a high level of regulatory compliance and standards among our global operations and licensed entities."

"Binance’s internal review did not find evidence of violations of applicable sanctions laws or regulations related to the transactions described. Binance detected and reported suspicious activity, and this is evidence that our controls are working, not the opposite. No investigator was dismissed for raising compliance concerns or for reporting potential sanctions issues," he added.

What this episode says about crypto enforcement

The picture that emerges is not of a single rogue transaction but of how easily sanctioned exposure can persist in a global crypto system built on layers of intermediaries, vendors and pseudonymous wallets. Even after fines, guilty pleas and public promises of reform, the line between compliance on paper and compliance in practice remains thin.

For regulators, the case reinforces a familiar problem: enforcement does not end with a settlement. For Binance, it raises a harder question. If $1.7 billion in Iran-linked flows can still surface internally years after admitting sanctions failures, how much confidence should anyone have that the problem is fully contained rather than merely better hidden.