Fortune Deeply Investigates Binance’s Iran Funding Chain: $439 Million in Chinese VIP Accounts Emerges
TechFlow Selected TechFlow Selected
Fortune Deeply Investigates Binance’s Iran Funding Chain: $439 Million in Chinese VIP Accounts Emerges
Binance China VIP Transfers $439 Million to Iran; Internal Whistleblower Subsequently Fired
Navigating Web3 tides with focused insightsAuthor: Fortune
Translation & Editing: TechFlow
TechFlow Intro: This article is a translation of a Fortune investigative report published on March 12. Readers should note the following background:
Starting in February this year, Western media outlets—including Fortune, The Wall Street Journal, and The New York Times—reported that internal investigators at Binance had discovered over $1 billion in funds flowing to Iran-linked entities via the platform, and were subsequently fired.
Binance denied firing employees for raising compliance concerns, stating instead that their departures resulted from violations of internal data protection policies. On March 11, Binance filed a defamation lawsuit against The Wall Street Journal, demanding retraction of its reporting.
Concurrently, Binance prevailed in two civil lawsuits brought under U.S. anti-terrorism statutes—the U.S. District Courts for the Southern District of New York and for the Northern District of Alabama both dismissed plaintiffs’ claims in full. However, these cases involved civil claims by victims’ families and fall outside the scope of the sanctions-compliance controversy discussed herein.
This article was written by Fortune’s Leo Schwartz, who first disclosed specific details about two Chinese VIP accounts: one held by a 79-year-old man transferred $439 million; and both accounts appear to have been accessed from the same device.
Binance’s position is that its platform accounts did not transact directly with sanctioned entities; rather, suspicious activity was self-identified and reported to law enforcement by Binance itself, and the implicated accounts have since been taken offline. The U.S. Department of Justice is currently investigating whether Iran used Binance to evade sanctions—but it remains unclear whether Binance itself is a target of that investigation.
Below is the full Fortune translation:
In early 2025, as Iran’s embattled regime grew increasingly reliant on cryptocurrency to circumvent economic sanctions, a VIP account registered on Binance under the name of a 79-year-old Chinese resident executed a series of transfers moving $439 million worth of digital tokens from the exchange into an external wallet. That wallet then forwarded most of the funds to other wallets—later identified by Binance’s internal investigators (as documented in files reviewed by Fortune) as linked to Iranian sanctioned entities, including the Islamic Revolutionary Guard Corps (IRGC).
Investigators noted in documents reviewed by Fortune that transferring hundreds of millions of dollars by an elderly individual is inherently highly suspicious. Compounding concerns, the transactions involved transferring Tether stablecoins on the Tron blockchain—a payment method favored by cybercriminals and money launderers.
Yet surprisingly, these transfers triggered no immediate alerts within Binance—even though the exchange had already entered a $4.3 billion plea agreement with the U.S. government in late 2023, committing to implement stringent compliance procedures.
Amanda Wick, Head of Americas at VerifyVASP, a crypto-compliance software firm, and former federal prosecutor, told Fortune upon learning of these transaction details: “This isn’t just a red flag—it’s a trigger event requiring immediate escalation.”
The details of this VIP account have never before been publicly disclosed—and its emergence comes at an especially sensitive moment for Binance. In February, multiple media reports revealed that Binance had fired internal investigators who had reported to senior executives—these investigators had uncovered over $1 billion flowing through the platform into wallets linked to Iran, and also found that a close commercial partner of Binance—a Hong Kong–based entity responsible for facilitating crypto-to-fiat conversions—had participated in those transfers.
Those reports have prompted a U.S. Senate investigation. Binance responded that the investigators’ departures were unrelated to the discovery of Iran-linked flows and that the company has consistently upheld its 2023 compliance commitments. Yet these new details involving Chinese and Iranian accounts have once again raised questions about the effectiveness of Binance’s compliance program.
Binance does not dispute investigators’ specific methodology for tracing fund flows. The exchange defended the transactions occurring on its platform and stated its compliance program remains fully operational. At the same time, however, The Wall Street Journal reported that the Department of Justice is investigating whether Iran used Binance to evade sanctions. A Binance spokesperson said the exchange is unaware of any such investigation. A DOJ spokesperson declined to comment.
Noah Perlman, Binance’s Chief Compliance Officer, stated in a comment provided to Fortune: “Binance’s compliance program is continuously improving and evolving, with the goal of strengthening safeguards and preventing recurrence.”
China-Linked Network
Like traditional financial institutions, cryptocurrency exchanges maintain dedicated compliance programs to verify user identities and screen for illicit activity. In a February blog post, Binance claimed its compliance program employs nearly 600 full-time staff—“industry-leading” in scale.
As part of this program, Binance required the 79-year-old Chinese man to upload identification documents to open his VIP account. (A Binance spokesperson clarified that VIP status is automatically granted based on asset holdings and trading volume.) It was precisely through this ID document that Binance’s internal investigators ultimately traced approximately $400 million he indirectly routed—via unregistered Iranian-linked wallets outside Binance—to what investigators termed “Entity A.” Former prosecutor Wick said such activity should have been automatically flagged by the system.
“If nearly half a billion dollars moves from a customer account into a single non-custodial wallet, and then rapidly flows to wallets associated with a sanctioned jurisdiction… this is exactly the type of activity a compliance team should be designed to catch,” she said.
Nonetheless, Binance allowed this VIP account to trade freely for several months. These transactions—beginning in January 2025—were not flagged by the compliance team until August 11, 2025, when Seychelles law enforcement submitted a request to Binance concerning “a serious terrorism financing case.” A Binance spokesperson told Fortune the 79-year-old VIP user’s account was suspended in September 2025 and fully taken offline in January 2026.
Other compliance experts expressed surprise at Binance’s failure to act more swiftly. Robert Appleton, a partner at Alston & Bird and former DOJ official who led Iran sanctions enforcement, told Fortune that given Binance’s prior misconduct and previous legal entanglements over sanctions evasion, he expected the exchange to exercise heightened vigilance toward any suspicious activity. “The government agreement changes everything, because it raises their obligations,” he said.
Meanwhile, the $439 million transfer conducted under the Chinese elder’s name represents only part of the broader Iran-linked activity. Documents reviewed by Fortune show that former Binance employees, during their investigation, found that Entity A—a cluster of Iranian-linked wallets—received a total of $1.7 billion from corporate and individual Binance account holders. Entity A then funneled portions of those funds to Nobitex, Iran’s largest cryptocurrency exchange, and to digital wallets linked to U.S.-designated terrorist organizations—including the IRGC and the Houthi movement. A Binance spokesperson said none of those wallets appeared on global law enforcement sanctions lists at the time of the transactions—and therefore did not trigger any alerts.
Although wallets controlled by Entity A and related sanctioned entities do not reside on Binance’s platform, crypto compliance experts told Fortune that the nature of funds flowing out of Binance alone should have raised alarms.
After receiving the Seychelles request, Binance investigators launched a formal probe and classified this series of fund movements as part of a “China-linked network”—which also involved another VIP trader. This second VIP was a 38-year-old Chinese woman who, between November and December 2024, transferred nearly $200 million in Tether stablecoins into an intermediary wallet, which then forwarded the funds to Entity A. (A Binance spokesperson said the term “China-linked network” is “an informal internal label—not precise—and may have evolved over time,” and confirmed the VIP account was fully taken offline in January 2026.)
Even more intriguingly, documents reviewed by Fortune indicate the two VIP accounts were very likely accessed via the same device—suggesting either a single individual or a third-party entity may control both accounts. Wick said: “If two nominally unrelated VIP customers are found accessing their accounts from the same device, that triggers serious questions about beneficial ownership.”
Regardless, investigators discovered via blockchain data that both accounts had received funds from Blessed Trust—a Hong Kong–based firm that helps companies convert crypto funds into fiat currency, and also handles payroll, tax, and back-office functions for Binance. Investigators concluded that roughly half of the $1.2 billion flowing through Blessed Trust into Entity A originated from these two Chinese VIP traders.
Binance has sought to downplay connections between its platform accounts and Iranian-linked wallets, stating in a recent blog post that multiple intermediaries separate Binance from sanctioned wallets. The blog also notes that $1.1 billion of the funds came from “a large, regulated stablecoin issuer.” Investigators wrote in their findings that most funds in the two Chinese VIP accounts likely originated from Circle-issued stablecoins—Circle being a U.S.-listed crypto company. A Circle spokesperson told Fortune: “We take our regulatory obligations seriously,” adding that Circle terminated Blessed Trust as a client in 2025.
Yet Binance’s blog post—and its responses to Fortune and other media—have omitted any mention of the specific details surrounding these two Chinese VIP accounts. Additionally, investigators found that both accounts shared the same device with Blessed Services—a separate Hong Kong–based entity linked to Blessed Trust and positioned between Binance and Entity A in the flow of funds. This evidence suggests the same group may operate all these accounts. A Binance spokesperson declined to comment on device-sharing specifics and stated Blessed Services has no business relationship with the exchange.
Email addresses associated with Blessed Trust and Blessed Services did not respond to Fortune’s requests for comment.
The “China-linked network” includes one final piece: Hexa Whale Trading Limited, a Hong Kong–registered company operating on Binance’s platform and having sent approximately $500 million to Entity A. When Binance investigators identified Hexa Whale’s activity, other members of the exchange’s compliance team had already taken the account offline. The Wall Street Journal and The New York Times previously reported details about Hexa Whale and Blessed Trust.
Fortune’s attempts to contact Hexa Whale and the two Chinese VIP users were unsuccessful.
The investigators who authored the preliminary report were fired by Binance weeks after submitting their initial findings. Binance denies they were dismissed for raising compliance concerns and states in its blog post that some personnel departures followed an internal review that uncovered violations of company data protection and confidentiality policies. The exchange insists it continued the investigation and completed the delisting of Blessed Trust in January 2026.
The investigators declined to comment.
Iran-Linked Clues
Another set of transactions—smaller in scale but equally notable to investigators—also drew scrutiny. These were executed by two individuals suspected of Iranian nationality. Compliance experts say the fact that both were able to successfully open accounts and execute transfers on Binance already calls into question the rigor of the exchange’s screening procedures.
The first account was opened in 2021 by a 44-year-old man whose Dominica ID lists his birthplace as Iran—and whose name appears in a 2020 United Nations Security Council report detailing a gold-and-cash smuggling network serving Iran and North Korea. The second account, also opened in 2021, belongs to a 37-year-old man whose uploaded Iraqi ID likewise lists his birthplace as Iran. By the time Binance investigators identified these accounts, both had already been restricted.
The relevant transactions include each account sending approximately $100 in TRX cryptocurrency—Tron’s native token used exclusively to pay transaction fees—to Iranian-linked wallet clusters in 2024. Though trivial in amount, this TRX transfer holds significance: it likely covered critical transaction fees for transfers among Entity A’s wallets. This is analogous to tracking credit card purchases for gasoline: repeated refills won’t tell you who’s driving—but they reveal who’s paying for the trip.
Lex Fisun, Co-Founder and CEO of blockchain analytics firm Global Ledger, said: “Most people focus only on large-value transactions—but small-value ones matter just as much. On-chain, you typically can’t link wallets to real-world identities. But when one address repeatedly sends TRX to another wallet to cover fees, that strongly signals a relationship between them.”
Wick further noted that these accounts’ Iran links should have triggered immediate review—especially given Binance’s prior guilty plea related to similar conduct and its pledge to eradicate such behavior on its platform.
“When multiple high-risk indicators converge—particularly involving a jurisdiction like Iran, subject to strict sanctions, or individuals named in UN Security Council reports—a properly functioning compliance program must escalate in real time,” she said. “Account restrictions, enhanced due diligence, blockchain tracing, and sanctions risk assessments—all should activate immediately upon detection—not months later.”
A Binance spokesperson said one Iranian-linked account has been fully taken offline, while the other has been restricted and is undergoing delisting. The exchange did not clarify whether these accounts were already restricted at the time the transactions occurred.
Fortune’s attempts to contact the two individuals were unsuccessful.
For any financial institution, exposure to sanctioned entities constitutes a major risk—and Binance has already paid a steep price. In 2023, it entered a $4.3 billion plea agreement with the U.S. government, citing failures to establish effective anti-money laundering and sanctions compliance programs.
Under that agreement, co-founder Changpeng Zhao stepped down as CEO and served four months in federal prison. Binance also agreed to cooperate with a court-appointed monitor reporting to the Department of Justice and the Treasury Department on internal operations.
Yet recent firings of investigators—and potential ongoing exposure to Iran—have drawn concern from U.S. lawmakers. At the end of February, Senator Richard Blumenthal (D-CT) launched a preliminary inquiry into Binance and wrote to co-CEO Richard Teng requesting information on the fired investigators’ findings and other Iran-related activities.
Blumenthal also specifically referenced President Trump’s October pardon of Zhao—prompting conflict-of-interest allegations amid growing ties between Binance and the Trump family’s cryptocurrency ventures.
A White House spokesperson told Fortune: “President Trump’s assets are held in a trust managed by his children—there is no conflict of interest.”
Yet Blumenthal told Fortune that Binance’s proximity to the White House poses persistent ethical risks: “My greatest concern is that Binance’s relationship with the government could deter or prevent the compliance monitor from uncovering and reporting violations—or impede the Department of Justice from pursuing enforcement action.”
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
@FortuneMagazine
