Binance under fire again: Leaked files show suspicious crypto accounts stayed active after 2023 US plea deal

Binance under fire again: Leaked files show suspicious crypto accounts stayed active after 2023 US plea deal

Binance failed to halt hundreds of millions of dollars flowing through suspicious accounts even after signing a landmark $4.3-billion plea agreement with US authorities in 2023, according to a detailed investigation by the Financial Times based on leaked internal files.

The documents, which include transaction records, identity checks, device logs and internal compliance notes, show that a network of high-risk accounts continued trading despite indicators that experts say would normally trigger freezes or investigations at regulated financial institutions. These red flags included links to terror financing networks, failed know-your-customer checks, improbable log-in patterns and large pass-through transactions that appeared to lack economic logic.

Suspicious activity after the plea agreement

Under its November 2023 settlement with US authorities, Binance pleaded guilty to criminal charges related to money laundering, banking law violations and breaches of international sanctions. As part of the deal, the exchange committed to tightening transaction monitoring, sanctions controls and customer due diligence.

However, the FT’s review of internal data covering the period from 2021 to this year raises questions about how effective those reforms have been. Thirteen accounts examined by the newspaper were involved in transactions totalling $1.7 billion, with $144 milion occurring after the plea agreement was signed.

Several of these accounts continued to move eight- and nine-figure sums in patterns compliance specialists described as highly suspicious. In some cases, accounts were accessed from locations on opposite sides of the world within hours, a physical impossibility that would normally prompt immediate investigation.

Links to terror finance networks

The files show that all 13 accounts received funds that had passed through wallets later frozen by Israel under anti-terrorism laws. In total, about $29 million in the Tether stablecoin flowed into the network from February 2022 to March 2023 from wallets later linked to Tawfiq Al-Law, a Syrian accused by US authorities of moving money for Hizbollah, the Iran-backed Houthis in Yemen, and a company tied to the Assad regime.

Those wallets were seized by Israel in May 2023, and Al-Law was sanctioned by the US Office of Foreign Assets Control in March 2024. While Binance’s lawyers say the wallets were not designated at the time of the transfers, experts told the FT that interactions with later-sanctioned accounts should raise serious compliance concerns when combined with other warning signs.

Accounts that defied common sense

One account reviewed was registered to a young woman in Venezuela who received more than $177 million in crypto over two years. She changed the linked bank details 647 times in a 14-month period, cycling funds through nearly 500 different accounts across the Americas. Another account, held by a junior bank employee living in a low-income Caracas neighbourhood, moved $93 million despite showing log-ins from Caracas and Osaka within hours of each other.

Compliance specialists interviewed by the FT said such behaviour would normally trigger alarm bells at traditional banks. “That qualifies as suspicious,” said Stefan Cassella, a former federal prosecutor specialising in money laundering, who noted that the activity resembled an unlicensed money-transmitting business.

Binance’s response and the wider context

Binance said it maintains “strict compliance controls” and a “zero-tolerance approach to illicit activity”, adding that it has systems to flag and investigate suspicious transactions. Its lawyers said it would be inappropriate to comment on specific accounts and rejected suggestions that the company knowingly facilitated criminal activity.

The investigation lands at a politically sensitive moment. In October, President Donald Trump pardoned Binance founder Changpeng Zhao for his role in wilful violations of US anti-money-laundering laws. The Trump family has since expanded its business ties with Binance through a crypto venture, World Liberty Financial.

Critics say this has weakened incentives for strict compliance. Jessica Davis, a former Canadian intelligence official specialising in terrorist financing, told the FT that the pardon sent a signal that money laundering enforcement was no longer a top priority. With crypto platforms generating vast profits, she argued, even billion-dollar fines can lose their deterrent effect.

Questions for regulators

The US Department of Justice and Treasury appointed independent monitors in 2024 to oversee Binance’s compliance with the plea agreement. A significant share of the transactions reviewed by the FT occurred after those monitors were in place, raising questions about enforcement.

Andrew Weissmann, a former senior US prosecutor, said the reporting raised concerns about how seriously authorities were policing white-collar crime in the crypto sector. For an exchange used by about 300mn people worldwide and central to the global digital asset system, the stakes extend far beyond Binance itself.

The FT’s findings do not prove deliberate wrongdoing after the plea agreement. But they do suggest a persistent gap between formal compliance commitments and how suspicious activity was handled in practice — at a time when crypto is moving from the fringes into the financial mainstream.