A group of internal investigators at the giant cryptocurrency exchange Binance made a series of startling discoveries last year.
People in Iran had gained access to more than 1,500 accounts on the Binance platform over the previous year. About $1.7 billion had flowed from two Binance accounts to Iranian entities with links to terrorist groups, a possible violation of global sanctions. And one of those accounts belonged to a Binance vendor.
After uncovering the transactions, the investigators reported them to top executives, according to company records and other documents reviewed by The New York Times.
Within weeks, Binance fired or suspended at least four employees involved in the investigation, according to the documents and three people with knowledge of the situation. The company cited issues such as “violations of company protocol” related to the handling of client data.
The sequence of events shows that Binance, the world’s largest venue for crypto trading, has continued to find evidence of potential legal violations on its platform, even after it pleaded guilty to breaking anti-money-laundering laws in 2023. At the time, the company pledged to crack down on bad actors who used its platform to move money, and said it had hired more than 60 employees with law enforcement or regulatory experience to address the problem.
But internal warnings about the Iranian transactions surfaced last year, in the months before President Trump granted a pardon to Binance’s founder, Changpeng Zhao, who had spent four months in federal prison in 2024 for his role in the firm’s crimes. The Trump family’s crypto start-up, World Liberty Financial, has forged close business ties with Binance, and Mr. Zhao was a guest this month at a conference at Mar-a-Lago, Mr. Trump’s club in Palm Beach, Fla.
“Learned a lot,” Mr. Zhao posted on social media on Wednesday, along with a photo from the event.
By analyzing crypto transactions, Binance investigators found that accounts on the exchange had moved funds to entities tied to Iran, a major foreign adversary that the Trump administration has been preparing to strike. When Binance pleaded guilty three years ago, it agreed to pay a $4.3 billion penalty and admitted that it had violated U.S. sanctions, including by allowing customers from Iran to use its platform. It also agreed to alert U.S. authorities to any lawbreaking detected on the exchange.
A Binance representative, Rachel Conlan, said in a statement that the exchange took action to address the issues raised by its investigators. The accounts linked to the $1.7 billion in Iranian transactions were removed, she said, and Binance notified the authorities.
“Any suggestion that Binance knowingly allowed sanctionable activity to continue unchecked is incorrect and defamatory,” Ms. Conlan said.
It’s unclear exactly why the investigators were disciplined. Over the last few months, more than half a dozen compliance officials have left Binance, including a sanctions manager and the leader of the enterprise compliance team. Binance’s chief compliance officer, Noah Perlman, has also discussed leaving, a person familiar with the matter said.
Ms. Conlan said the investigators who examined the Iranian transactions were not suspended or terminated for “raising compliance concerns.”
“Certain individuals” involved in the investigation were disciplined “in connection with the unauthorized disclosure of confidential client information,” she said.
But the timing of the discipline, not long after the Iranian transactions were reported last year, raised the question of whether it was connected to the team’s findings. All of the investigators declined to comment or did not respond to requests for comment. Their dismissals were reported earlier by Fortune.
Karoline Leavitt, the White House press secretary, said in a statement that Mr. Zhao’s prosecution was part of a “war on cryptocurrency” by the previous administration.
“These actions by the Biden administration severely damaged the United States’ reputation as a global leader in technology and innovation,” she said.
Mr. Zhao founded Binance in 2017 and built it into the world’s most influential platform for buying and selling cryptocurrencies like Bitcoin and Ether. As the industry boomed, Binance processed as much as two-thirds of all crypto transactions, generating revenue by collecting fees on those trades.
The exchange has at times served as an attractive destination for money laundering. In 2023, Binance pleaded guilty to allowing people in sanctioned countries to use the platform and conduct business with customers in the United States. In the case of Iran, U.S. prosecutors found at least 1.1 million transactions worth almost $900 million that violated federal law.
After his plea, Mr. Zhao stepped down as chief executive but retained his majority stake in the company. He is worth nearly $80 billion, according to Forbes, and remains one of the crypto industry’s most powerful figures.
Over the years, Binance has taken steps to install safeguards against illicit commerce. It built a team of compliance executives, hiring former U.S. law enforcement officials who had investigated crypto crimes and other experts with experience in tracing digital currency transactions.
These experts use publicly available information and other forensic tools to identify the owners of crypto wallets, which are the anonymous online accounts where people store and trade digital coins. They also share tips with law enforcement agents around the world.
In the middle of last year, Binance’s compliance experts were contacted by law enforcement officials from Israel who wanted to discuss terror financing routes connected to Iran. Binance began an investigation that centered on a now-defunct business called Hexa Whale Trading Limited.
Hexa Whale, based in Hong Kong, had used Binance to send $490 million to crypto wallets tied to Iranian entities, according to the documents. At one point, the documents said, an Israeli official told the investigators that Hexa Whale was financing terrorist organizations such as the Houthis, an Iran-backed militia that controls Yemen’s north.
Around the same time, Binance’s investigators also learned that people in Iran had gained access to more than 1,500 accounts over the past year, the documents said. And they established that a fleet of Russian cargo ships, believed to be evading sanctions, was using Binance accounts to pay crew members.
Ms. Conlan said Binance notified the Justice Department about the Hexa Whale account in October and removed it from the exchange. The company complied with its “legal and reporting obligations,” she said.
She added that “detection of attempted logins from sanctioned jurisdictions does not equate to servicing sanctioned persons.” And she said the Russian vessels “were not sanctioned, and the transactional activity identified did not in itself constitute a sanctions violation.”
The most significant link the investigators discovered between Binance accounts and Iranian entities involved a Hong Kong business called Blessed Trust.
Blessed Trust is owned by five companies incorporated in the British Virgin Islands and the Cayman Islands, according to Hong Kong records. It also had a business relationship with Binance.
Crypto exchanges often work with banks and payment processors to help with currency conversions or other financial services. Blessed Trust operated as a so-called fiat partner to Binance, providing a range of services including payments, the documents said. In a message reviewed by The Times, Blessed Trust listed its top five customers by revenue. All of them were Binance entities.
Over roughly the past two years, the investigators discovered, $1.2 billion in crypto had flowed from Blessed Trust’s Binance account to Iranian-linked entities, according to the documents. The investigators found ties between those entities and crypto wallets controlled by Iran’s Revolutionary Guards Corps, which has been designated a terrorist group by the United States and other countries.
Ms. Conlan said that “there were multiple intermediary wallets with more than three degrees of separation” between Blessed Trust and the “wallets alleged to be associated with” the Revolutionary Guards.
She added that Blessed Trust was “one of several vendors for Binance” and that the exchange had no control over it. Binance stopped using it as a vendor in January, she said.
Leung Ka Kui, a director of Blessed Trust in Hong Kong, said the company did not “knowingly facilitate transactions in breach of applicable sanctions” and that it had never made payments to any Iranian entity. He said Blessed Trust’s work with Binance was “limited to routine operational disbursements” such as settling invoices and making payroll payments.
Mr. Leung said Blessed Trust could not comment on Binance’s decision making. “We categorically reject any suggestion that the discontinuation was due to involvement with sanctioned entities,” he said.
In the fall, two Binance internal investigators raised concerns about Blessed Trust and the Iran transactions, according to the documents. The warnings eventually reached Binance’s chief executive, Richard Teng, and Mr. Perlman, the documents said.
In November, the two investigators were suspended, according to the documents. Another two took over the investigation, the documents said. Within days, they were also suspended and shut out of Binance’s internal system.
Ms. Conlan said that none of the Binance employees were “suspended or terminated for raising compliance concerns.”
“The investigation was not shut down,” she said, and other Binance employees continued working on it.
Ms. Conlan said Binance has shared information about Blessed Trust with the Internal Revenue Service and the F.B.I. It plans to submit a report about Blessed Trust to the Justice Department on Feb. 25, she added.
David Yaffe-Bellany writes about the crypto industry for The Times from New York. He can be reached at [email protected].
The post Binance Employees Find $1.7 Billion in Crypto Was Sent to Iranian Entities appeared first on New York Times.
