Fortune Deeply Investigates Binance’s Iran Funding Chain: $439 Million in Chinese VIP Accounts Emerges
TechFlow Selected TechFlow Selected
Fortune Deeply Investigates Binance’s Iran Funding Chain: $439 Million in Chinese VIP Accounts Emerges
Binance China VIP Transfers $439 Million to Iran; Internal Whistleblower Subsequently Fired
Navigating Web3 tides with focused insightsAuthor: Fortune
Translation & Editing: TechFlow
TechFlow Intro: This article is a translation of a Fortune investigative report published on March 12. Readers should note the following background:
Starting in February this year, Western media outlets—including Fortune, The Wall Street Journal, and The New York Times—reported that Binance’s internal investigators had discovered over $1 billion in funds flowing to Iran-linked entities, after which those investigators were dismissed.
Binance denies dismissing employees for raising compliance concerns, stating instead that their departures resulted from violations of internal data protection policies. On March 11, Binance filed a defamation lawsuit against The Wall Street Journal, demanding retraction of its reporting.
Concurrently, Binance prevailed in two civil lawsuits brought under U.S. anti-terrorism statutes—the U.S. District Court for the Southern District of New York and the U.S. District Court for the Northern District of Alabama both dismissed plaintiffs’ claims in full. However, these cases involved civil claims by victims’ families and fall outside the scope of the sanctions-compliance controversy discussed here.
This article was written by Fortune’s Leo Schwartz, who first disclosed specific details about two Chinese VIP accounts: one account, registered under the name of a 79-year-old man, transferred $439 million; and both accounts appear to have been accessed from the same device.
Binance’s position is that platform accounts did not transact directly with sanctioned entities; rather, suspicious activity was identified internally and reported to law enforcement, and the implicated accounts have since been taken offline. The U.S. Department of Justice is currently investigating whether Iran has used Binance to evade sanctions—but it remains unclear whether Binance itself is a target of that investigation.
Below is the full translation of the Fortune article:
In early 2025, the embattled Iranian regime grew increasingly reliant on cryptocurrency to circumvent economic sanctions. At precisely this time, a VIP account registered on Binance under the name of a 79-year-old Chinese resident executed a series of transfers, moving $439 million worth of digital tokens from the exchange into an external wallet. That wallet subsequently routed most of the funds to other wallets—later identified by Binance’s internal investigators as linked to Iranian sanctioned entities, including the Islamic Revolutionary Guard Corps (IRGC).
According to documents reviewed by Fortune, investigators noted that the mere fact that an elderly individual moved hundreds of millions of dollars was highly suspicious. Even more alarming was that the transactions involved transferring Tether (USDT) stablecoins on the Tron blockchain—a payment method favored by cybercriminals and money launderers.
Yet surprisingly, these transfers triggered no immediate alerts within Binance—even though the exchange had already entered into a $4.3 billion plea agreement with the U.S. government at the end of 2023, committing to implement rigorous compliance procedures.
Amanda Wick, Head of Americas at VerifyVASP—a crypto-compliance software firm—and former federal prosecutor, told Fortune upon learning the transaction details: “This isn’t just a red flag—it’s a trigger event requiring immediate escalation.”
The details of this VIP account have never before been publicly disclosed—and its emergence comes at an especially sensitive moment for Binance. In February, multiple media reports revealed that Binance had fired internal investigators who had reported to senior executives—individuals who uncovered over $1 billion flowing through the platform to Iran-linked wallets, and whose investigations also implicated a close Binance business partner: a Hong Kong–based entity responsible for arranging cryptocurrency-to-fiat conversions.
Those reports have prompted a U.S. Senate investigation. Binance responded by asserting that the investigators’ departures were unrelated to the Iran-related findings and that the company continues to uphold its 2023 compliance commitments. Yet these newly revealed details linking Chinese accounts to Iranian wallets have reignited doubts about the effectiveness of Binance’s compliance program.
Binance does not dispute the investigators’ methodology for tracing fund flows. The exchange defended the flagged transactions and stated its compliance program is operating as intended. At the same time, however, The Wall Street Journal reported that the Department of Justice is investigating whether Iran has used Binance to evade sanctions. A Binance spokesperson said the exchange is unaware of any such investigation. A DOJ spokesperson declined to comment.
Noah Perlman, Binance’s Chief Compliance Officer, stated in a message to Fortune: “Binance’s compliance program is continuously improving and evolving, with the goal of strengthening controls and preventing recurrence.”
China-Linked Network
Like traditional financial institutions, crypto exchanges maintain dedicated compliance programs to verify user identities and screen for illicit activity. In a February blog post, Binance claimed its compliance team comprises nearly 600 full-time staff—“industry-leading” in scale.
As part of that process, Binance required the 79-year-old Chinese man to upload identification documents to open his VIP account. (A Binance spokesperson clarified that VIP status is automatically assigned based on asset holdings and trading volume.) It was precisely via this ID document that Binance’s internal investigators ultimately traced how he indirectly funneled approximately $400 million to a previously unidentified group of Iran-linked wallets outside Binance—labeled “Entity A” by investigators. Former prosecutor Wick said such activity should have been automatically flagged by the system.
“If nearly half a billion dollars flows from a customer account into a single non-custodial wallet—and then rapidly moves to wallets associated with a sanctioned jurisdiction… that is exactly the type of activity a compliance team should detect,” she said.
Yet Binance permitted this VIP account to trade freely for several months. These transactions—which began in January 2025—were not flagged by the compliance department until August 11, 2025, when Seychelles law enforcement submitted a request to Binance concerning “a serious terrorism financing case.” A Binance spokesperson told Fortune the 79-year-old VIP’s account was suspended in September 2025 and fully taken offline in January 2026.
Other compliance experts expressed surprise that Binance failed to act more swiftly. Robert Appleton, a partner at Alston & Bird and former DOJ official who led Iran sanctions enforcement, told Fortune that given Binance’s prior misconduct and history of legal entanglements related to sanctions evasion, he expected the exchange to exercise heightened vigilance over any suspicious activity. “The government agreement changes everything—because it raises their obligations,” he said.
Meanwhile, the $439 million transfer conducted under the Chinese man’s name represents only part of the broader Iran-linked activity. Documents reviewed by Fortune show that former Binance employees, during their internal probe, found that Entity A—this cluster of Iran-linked wallets—received a total of $1.7 billion through corporate and individual Binance accounts. Entity A then routed portions of those funds to Nobitex, Iran’s largest crypto exchange, and to digital wallets linked to U.S.-designated terrorist organizations—including the IRGC and the Houthi movement. A Binance spokesperson said none of those wallets were listed on global sanctions lists at the time of the transactions, so no alerts were triggered.
Although wallets controlled by Entity A and other sanctioned entities do not reside on Binance’s platform, crypto compliance experts told Fortune that the nature of funds flowing out of Binance alone should have raised alarms.
After receiving the Seychelles request, Binance investigators launched a formal inquiry and classified this flow of funds as part of a “China-linked network”—which also included another VIP trader. This second VIP was a 38-year-old Chinese woman who, between November and December 2024, transferred nearly $200 million in USDT stablecoins to an intermediary wallet, which then forwarded the funds to Entity A. (A Binance spokesperson characterized the term “China-linked network” as “an informal internal label—not precise—and subject to change over time,” and confirmed this VIP account was taken offline in January 2026.)
Even more intriguingly, documents reviewed by Fortune indicate the two VIP accounts very likely accessed Binance from the same device—suggesting either a single individual or a third-party entity may control both accounts. Wick said: “If two ostensibly unrelated VIP customers are found accessing their accounts from the same device, that triggers serious questions about beneficial ownership.”
Regardless, investigators discovered via blockchain analysis that both accounts received funds from Blessed Trust—a Hong Kong–based firm that helps companies convert crypto into fiat currency and also handles payroll, tax, and other back-office functions for Binance. Investigators concluded that roughly half of the $1.2 billion flowing through Blessed Trust to Entity A originated from these two Chinese VIP traders.
Binance has sought to downplay any direct link between its platform accounts and Iran-linked wallets, stating in a recent blog post that multiple intermediaries separate Binance from sanctioned wallets. The post also states that $1.1 billion of the funds came from “a large, regulated stablecoin issuer.” Investigators wrote in their final report that most of the funds in the two Chinese VIP accounts likely originated from Circle-issued stablecoins—Circle being a U.S.-listed crypto company. A Circle spokesperson told Fortune: “We take our regulatory obligations seriously,” adding that Circle terminated Blessed Trust as a client in 2025.
Nonetheless, Binance’s blog posts and statements to Fortune and other media outlets have omitted all specifics regarding these two Chinese VIP accounts. Investigators also found that both accounts shared the same device with Blessed Services—an additional Hong Kong–based firm affiliated with Blessed Trust and positioned between the fund flows and Entity A. This evidence suggests the same group may operate all these accounts. A Binance spokesperson declined to comment on the device-sharing detail and stated that Blessed Services has no business relationship with the exchange.
Email addresses associated with Blessed Trust and Blessed Services did not respond to Fortune’s requests for comment.
The “China-linked network” includes one final actor: Hexa Whale Trading Limited, a Hong Kong–registered firm operating on Binance’s platform and having transferred approximately $500 million to Entity A. When Binance investigators identified Hexa Whale’s activity, other members of the exchange’s compliance team had already taken the account offline. The Wall Street Journal and The New York Times previously reported details about Hexa Whale and Blessed Trust.
Fortune’s attempts to contact Hexa Whale and the two Chinese VIP users were unsuccessful.
The investigators who authored the initial report were dismissed by Binance weeks after submitting their preliminary findings. Binance denies they were fired for raising compliance issues, stating in its blog post that some departures followed an internal review that uncovered violations of company data-protection and confidentiality policies. The exchange insists it continued the investigation and completed the delisting of Blessed Trust in January 2026.
The investigators declined to comment.
Iran-Linked Clues
Another set of transactions—smaller in scale but equally notable—also drew investigators’ attention. These transfers were conducted by two individuals suspected of Iranian nationality. Compliance experts say the fact that both individuals successfully opened accounts and executed transfers on Binance already casts doubt on the rigor of the exchange’s screening protocols.
The first account was opened in 2021 by a 44-year-old man whose Dominica-issued ID lists his birthplace as Iran—and whose name appears in a 2020 United Nations Security Council report detailing a gold-and-cash smuggling network serving Iran and North Korea. The second account, also opened in 2021, belongs to a 37-year-old man whose Iraqi-issued ID likewise lists Iran as his birthplace. By the time Binance investigators identified these accounts, both had already been restricted.
The relevant transactions include each account sending approximately $100 worth of TRX tokens—Tron’s native utility token used to pay transaction fees—to wallets linked to Iran in 2024. Though trivial in dollar value, these TRX transfers hold significance: they likely covered critical transaction fees among Entity A’s wallets. This is analogous to tracking credit card purchases used to fuel a vehicle—if the same card repeatedly fills the tank, it won’t reveal who’s driving, but it will identify who’s paying for the journey.
Lex Fisun, Co-Founder and CEO of blockchain analytics firm Global Ledger, said: “Most people focus only on large-value transactions—but small ones matter too. On-chain, you usually can’t link wallets to real-world identities. Yet when one address repeatedly sends TRX to another address to cover fees, that signals a functional relationship.”
Wick added that the Iran nexus alone should have triggered immediate scrutiny—especially given Binance’s prior guilty plea related to similar conduct and its pledge to eradicate such behavior on its platform.
“When multiple high-risk indicators converge—particularly involving a jurisdiction like Iran, under strict sanctions, or individuals named in UN Security Council reports—a properly functioning compliance program should escalate in real time,” she said. “Account restrictions, enhanced due diligence, blockchain tracing, and sanctions risk assessments—all should activate immediately upon detection, not months later.”
A Binance spokesperson said one of the Iranian-linked accounts has been fully taken offline, while the other has been restricted and is undergoing delisting. The exchange did not clarify whether these accounts were already restricted at the time the transactions occurred.
Fortune’s attempts to contact the two individuals were unsuccessful.
For any financial institution, exposure to sanctioned entities poses grave risk—and Binance has paid dearly for it. In 2023, it entered a $4.3 billion plea agreement with the U.S. government, citing failures to establish effective anti-money laundering (AML) and sanctions compliance programs.
Under the agreement, co-founder Changpeng Zhao stepped down as CEO and served four months in federal prison. Binance also agreed to cooperate with a court-appointed monitor reporting to the Department of Justice and Treasury Department on internal operations.
Yet the recent dismissals of investigators—and potential ongoing exposure to Iran—have raised alarm among lawmakers. At the end of February, Senator Richard Blumenthal (D-CT) launched a preliminary inquiry into Binance and sent a letter to co-CEO Richard Teng requesting information on the dismissed investigators’ findings and other Iran-related activities.
Blumenthal specifically referenced President Trump’s October pardon of Zhao—a move that sparked conflict-of-interest allegations amid growing ties between Binance and the Trump family’s cryptocurrency ventures.
A White House spokesperson told Fortune: “President Trump’s assets are held in a trust managed by his children—there is no conflict of interest.”
Still, Blumenthal told Fortune that the Binance–White House connection poses persistent ethical risks: “My greatest concern is that Binance’s relationship with the government could deter or prevent compliance monitors from uncovering and reporting violations—or hinder the Department of Justice from pursuing enforcement actions.”
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
@FortuneMagazine
