Author: Fortune

Translation: Deep Tide TechFlow

Deep Tide Introduction: This article is translated from Fortune's investigative report on March 12. Readers are reminded to note the following background:

Since February this year, Western media outlets such as Fortune, The Wall Street Journal, and The New York Times have successively reported that internal investigators at Binance discovered over 1 billion dollars flowing to entities associated with Iran and were subsequently fired.

Binance denies firing employees due to compliance whistleblowing, stating that the departures were due to violations of internal data protection regulations and has filed a defamation lawsuit against The Wall Street Journal on March 11, demanding retraction of related reports.

At the same time, Binance won in two civil lawsuits filed under the U.S. Anti-Terrorism Law—the Southern District of New York and Alabama federal courts dismissed all claims made by the plaintiffs, but these cases involved civil claims from victim's families and are in a different legal category from the sanctions compliance disputes discussed in this article.

This article was written by Fortune author Leo Schwartz, who disclosed specific details about two Chinese VIP accounts: one belonging to a 79-year-old man transferred 439 million dollars, and the two accounts are suspected of sharing the same device.

Binance's position is that platform accounts did not directly transact with sanctioned entities, that suspicious activities were independently discovered and reported to law enforcement by Binance, and that the accounts involved have been taken offline for processing. Currently, the U.S. Department of Justice is investigating whether Iran used Binance to evade sanctions, but it is unclear whether Binance itself is under investigation.

The following is the full translation of Fortune:

At the beginning of 2025, the embattled Iranian regime increasingly relied on cryptocurrency to evade economic sanctions. During this period, a VIP account on Binance registered in the name of a 79-year-old Chinese resident conducted a series of transfers, transferring digital tokens worth 439 million dollars from the exchange to an external wallet. This wallet subsequently transferred most of the funds to other wallets—Binance's internal investigators later determined that these wallets were associated with sanctioned entities in Iran, including the Islamic Revolutionary Guard Corps.

Investigators noted in documents reviewed by Fortune that it is highly suspicious for an elderly person to transfer hundreds of millions of dollars. Even more concerning is that the relevant transactions involved transferring Tether stablecoin on the Tron blockchain—preferred payment method of cybercriminals and money launderers.

However, surprisingly, these transfers did not raise any immediate alerts on Binance. Binance had already reached a 4.3 billion dollar plea agreement with the U.S. government by the end of 2023, committing to implement a series of strict compliance procedures.

Amanda Wick, head of VerifyVASP Americas and former federal prosecutor, stated after learning about these transaction details from Fortune: "This is not just a red flag; it is a trigger event that needs to be reported immediately."

The details of this VIP account had never been publicly disclosed before, and its timing is particularly sensitive for Binance. In February of this year, a series of media reports revealed that Binance had fired internal investigators who had reported to executives—these individuals had discovered over 1 billion dollars flowing into wallets associated with Iran through the platform, and one of Binance's close business partners—a Hong Kong entity responsible for arranging cryptocurrency and fiat conversions—was also involved in these transfers.

The aforementioned reports have triggered an investigation by the U.S. Senate. Binance responded by stating that the departure of investigators had nothing to do with the discovery of the Iran transfers, and that the company had always adhered to its compliance commitments in 2023. However, the new details involving Chinese accounts and Iranian accounts have once again raised doubts about the effectiveness of this compliance program.

Binance has not denied the specific methods investigators used to trace the flow of funds. The exchange defended its handling of the platform's non-compliant transactions, stating that its compliance program operates as usual. However, at the same time, according to The Wall Street Journal, the Department of Justice is investigating whether Iran used Binance to evade sanctions. A Binance spokesperson stated that the exchange is unaware of any ongoing investigation. The Department of Justice declined to comment.

Binance's chief compliance officer Noah Perlman stated in a statement provided to Fortune: "Binance's compliance program is continuously improving and evolving with the goal of strengthening and preventing problems from reoccurring."

Chinese Associated Network

Like traditional financial institutions, cryptocurrency exchanges also have dedicated compliance procedures to verify user identities and screen for illegal activities. Binance stated in a blog post in February this year that its compliance program has nearly 600 full-time employees, claiming it is "industry-leading."

As part of this procedure, Binance requires the 79-year-old Chinese male to upload identification documents to open a VIP account. (A Binance spokesperson stated that VIP status is automatically granted based on asset holdings and transaction volumes.) It was through this identification document that the exchange's internal investigators ultimately identified that he had indirectly transferred approximately 400 million dollars to a previously unrecognized group of Iranian associated wallets—referred to by investigators as "Entity A." Former prosecutor Wick stated that such activities should have been automatically flagged by the system.

"If nearly 500 million dollars transfers from a client account to a single non-custodial wallet, then quickly flows to wallets related to sanctioned jurisdictions... This is precisely the type of activity that compliance teams should capture," she said.

However, Binance allowed this VIP account to freely trade for months. These transactions, which began in January 2025, were not flagged by the compliance department until August 11 of that year, when Seychelles law enforcement submitted a request to Binance regarding "a serious terrorism financing case." A Binance spokesperson told Fortune that the 79-year-old VIP user's account was banned in September 2025 and was taken offline in January 2026.

Other compliance experts expressed surprise at Binance's failure to more swiftly handle the account. Robert Appleton, partner at the Olshan Law Firm and former DOJ official responsible for Iranian sanctions cases, told Fortune that especially considering Binance's troubled record and previous legal troubles due to sanction evasion issues, he expected the exchange to be more vigilant about any form of suspicious activity. "The agreement with the government changed everything because it heightened their obligations," he said.

Meanwhile, the 439 million dollar transaction conducted in the name of this Chinese elderly person is only part of the Iranian-related activities. Documents reviewed by Fortune show that former Binance employees discovered that a wallet group associated with Iran, called "Entity A," generated a total of 1.7 billion dollars through companies and individuals holding Binance accounts. "Entity A" subsequently transferred some of these funds to Nobitex, Iran's largest cryptocurrency exchange, as well as digital wallets associated with U.S.-designated terrorist organizations (such as the Islamic Revolutionary Guard Corps and the Houthi movement). A Binance spokesperson stated that at the time of the transactions, the aforementioned wallets were not on the sanctions list of global law enforcement agencies, thus did not trigger any alerts.

Although the wallets controlled by "Entity A" and associated sanctioned entities are not on the Binance platform, cryptocurrency compliance experts told Fortune that the nature of the funds flowing out from Binance should have triggered alarm bells.

After receiving requests from Seychelles, Binance investigators initiated an investigation and subsequently classified this series of fund flows as part of a "Chinese associated network"—which also involved another VIP trader. This VIP client is a 38-year-old Chinese woman who transferred nearly 200 million dollars of Tether stablecoin to an intermediary wallet between November and December 2024, and then from that wallet to "Entity A." (A Binance spokesperson stated that the term "Chinese associated network" is "an informal internal designation and not precise, and it may have changed over time," adding that the VIP account has been taken offline in January 2026.)

More intriguingly, documents reviewed by Fortune indicate that these two VIP accounts likely accessed Binance through the same device—meaning that the same individual or a third-party entity may have controlled both accounts. Wick stated: "If two ostensibly unrelated VIP clients are found accessing accounts from the same device, it would raise serious questions about actual ownership."

In any case, investigators discovered from blockchain data that both accounts had received funds from Blessed Trust. Blessed Trust is a Hong Kong-based company that helps companies convert crypto funds into fiat, while also managing payroll, tax, and other back-office matters for Binance. Investigators ultimately concluded that out of the total 1.2 billion dollars flowing from Blessed Trust to "Entity A," about half came from these two Chinese VIP traders.

Binance attempted to downplay the connection between platform accounts and Iranian associated wallets, stating in a recent blog post that there are multiple intermediaries between the exchange and sanctioned wallets. The blog also pointed out that 1.1 billion dollars of the funds originated from "a regulated large stablecoin issuer." Investigators wrote in their conclusions that most of the funds from the two Chinese VIP accounts likely came from stablecoins issued by Circle—a publicly traded U.S. cryptocurrency company. A Circle spokesperson told Fortune: "We take regulatory obligations seriously," and added that Circle terminated its relationship with Blessed Trust in 2025.

However, Binance has not addressed the specific details of these two Chinese VIP accounts in the blog post or in responses to Fortune and other media. Additionally, investigators found that these two accounts also shared the same device with Blessed Services (another entity related to Blessed Trust that is involved in the fund flows to "Entity A"). The evidence suggests that the same group of individuals may have operated all of these accounts. A Binance spokesperson declined to comment on the details of device sharing and stated that Blessed Services had no business relationship with the exchange.

Email addresses associated with Blessed Trust and Blessed Services did not respond to Fortune's requests for comment.

The "Chinese associated network" also involves one final link: a Hong Kong-registered company Hexa Whale Trading Limited, which operates on the Binance platform and transferred about 500 million dollars to "Entity A." When Binance investigators discovered Hexa Whale's activities, other compliance team members had already taken the account offline. The Wall Street Journal and The New York Times had previously reported details related to Hexa Whale and Blessed Trust.

Fortune's attempts to reach Hexa Whale and the two Chinese VIP users have been unsuccessful.

Investigators involved in the preliminary report were fired by Binance weeks after submitting their initial findings. Binance denies that the aforementioned employees were fired for raising compliance issues, stating in a blog post that some departures were decisions "made after internal reviews discovered violations of company data protection and confidentiality regulations." The exchange insists that the company continues to advance related investigations and completed the offline processing of Blessed Trust in January 2026.

Investigators declined to comment.

Iran-Related Clues

Furthermore, there is another independent transaction record that is smaller in scale but has also caught investigators' attention. These transactions were conducted by two individuals suspected of being Iranian nationals. Compliance experts indicated that the very fact that these two were able to successfully open accounts and complete transactions on Binance raises questions about the strictness of the company's screening procedures.

The first account was opened in 2021, with the holder being a 44-year-old man whose Dominican ID indicates a birthplace in Iran, and his name appeared in a UN Security Council report from 2020—involving a smuggling network of gold and cash serving Iran and North Korea. The second account was similarly opened in 2021, with the holder being a 37-year-old man whose uploaded Iraqi ID also indicates a birthplace in Iran. By the time Binance investigators discovered these two accounts, they had been restricted.

Related transactions include each of the two accounts transferring about 100 dollars of TRX cryptocurrency to Iranian associated wallet groups in 2024—TRX is the only currency used on the Tron blockchain for paying transaction fees. Although the total amount is negligible, this TRX transfer is significant, as it likely paid the crucial transfer fees between "Entity A" wallet groups. This situation is akin to tracking credit card records used for purchasing car fuel: While the card itself cannot reveal who is driving, it can indicate who is footing the bill for the journey.

Lex Fisun, co-founder and CEO of blockchain analysis firm Global Ledger, stated: "Most people focus only on large transactions, but small transactions are equally important. On the blockchain, you typically cannot link a wallet to a real identity. However, when one address repeatedly transfers TRX to another wallet to pay fees, this indicates a connection between the two."

Moreover, Wick pointed out that the ties of these accounts to Iran should have triggered more immediate scrutiny. After all, Binance has already pleaded guilty for similar transactions and pledged to eradicate such behavior from the platform.