The clues started emerging in November 2024, a trail of evidence that pointed to possible financial crimes involving a vendor for Binance, the world’s largest cryptocurrency exchange.
Some clues were in plain sight, found in public business records in Singapore and Hong Kong, on a U.S. trade blacklist, and in Binance transaction logs that showed hundreds of millions of dollars flowing through the account of a 78-year-old Chinese man. They led to Blessed Trust, a little-known payment processing firm that handled back-office tasks for Binance while using the exchange to move $1.2 billion that ultimately went to Iranian entities, according to company records and other documents reviewed by The New York Times.
Binance has more than 1,500 employees to help monitor the platform for potential criminal activity, a crucial task for financial firms, especially when vast sums change hands. But the company did not end its relationship with Blessed Trust until January, about a year after warning signs showed up in public records, The Times found.
That was when Binance acted on findings from its compliance investigators that $1.7 billion had moved from Blessed Trust and another Binance account to a cluster of entities linked to Iran, a possible violation of U.S. sanctions. Last month, The Times and others reported that the company had fired or suspended the investigators who discovered the Blessed Trust transactions. Binance cited “unauthorized disclosure” of client data as the basis for the discipline.
The sequence of events offers a rare window into how Binance monitors possible misconduct on its platform, raising questions about whether the company has done enough to stop money-laundering and sanctions evasion.
Long before Binance stopped using Blessed Trust’s services, public business filings showed that the vendor’s chief executive shared a Singapore villa with a Chinese entrepreneur whose corporate office was placed on the U.S. blacklist. And in early 2025, large sums flowed through a Binance account controlled by the entrepreneur’s 78-year-old business partner, transfers that would ordinarily set off alarms at a financial institution, documents show.
Now Binance is under mounting scrutiny over the flow of money to Iran, which the United States attacked in February.
The Justice Department is investigating the transfers from Binance accounts to Iran, two people familiar with the matter said. A top Senate Democrat also opened an inquiry, while 11 other Democratic lawmakers sent a letter to Attorney General Pam Bondi and Treasury Secretary Scott Bessent demanding investigations into Binance.
The Justice Department did not respond to requests for comment. Its investigation was reported earlier by The Wall Street Journal.
Binance has a turbulent history with U.S. authorities. In 2023, the company pleaded guilty to breaking anti-money-laundering laws and admitted that it had violated sanctions against Iran. Binance paid $4.3 billion in penalties. Its founder, Changpeng Zhao, was sentenced to four months in prison.
At the time of the plea deal, Binance pledged to monitor its platform for evidence of lawbreaking and announced that it had hired hundreds of compliance employees, including former regulators and law enforcement officials.
Binance went on to forge ties with World Liberty Financial, the crypto firm founded by President Trump and his sons. In October, Mr. Trump pardoned Mr. Zhao, paving the way for Binance to operate in the United States, where it has been banned for years.
In a statement, Noah Perlman, Binance’s chief compliance officer, said that operating a large compliance program “requires risk-based decisions based on information reasonably known at the time.”
“While we stand by the decisions made in this case, we always look for ways to improve the program and have adopted additional controls based on lessons learned here,” he said.
A director for Blessed Trust, Leung Ka Kui, said last month that the company did not “knowingly facilitate transactions” that violated sanctions and that it never made payments to any Iranian entity.
Mr. Zhao founded Binance in 2017 and turned it into the world’s leading crypto platform, processing tens of billions of dollars in transactions a day. Customers use the exchange to convert traditional currencies into digital tokens, paying fees for each trade.
It’s unclear when Binance began working with Blessed Trust. But from at least 2024 to 2025, Blessed Trust was a vendor for Binance and operated a trading account on the exchange, according to the documents. Binance used Blessed Trust to make payments, including in the United States, records show.
Binance stopped working with Blessed Trust in January and removed its account from the exchange, the company said last month. A spokeswoman called it “evidence that our controls are working.”
Public records show, however, that a series of red flags emerged months before Binance cut ties with Blessed Trust.
It’s unclear exactly when Binance had access to each piece of the puzzle. But the clues started accumulating in company filings and internal trading records from November 2024 to March 2025.
Among them was a luxury villa in Singapore, with a balcony overlooking a row of hedges.
Zheng Qilong, Blessed Trust’s chief executive, used the villa as a business address, according to corporate records in Singapore and New Zealand. Wu Junliang, 45, a Chinese entrepreneur who owned a company called Porchoen Trade Pte., also listed the villa in Singapore company records.
In November 2024, the U.S. Department of Commerce added an address in Hong Kong used by another of Mr. Wu’s firms, Porchoen 2014 Co., to an export-restriction list. Six companies registered there were found to be at risk of violating sanctions against Iran.
It was the first time the Commerce Department had placed an entire address on the export blacklist, effectively indicating that any company at that location was a potential national security concern.
“That was the brightest of the bright red flags,” said Kevin Wolf, who was an assistant secretary of commerce during the Obama administration.
Mr. Wolf and two other compliance experts said Binance should have noticed and investigated the web of connections linking Blessed Trust to Mr. Wu as soon as they emerged.
“Common addresses are and have been a standard sanctions evasion tool going back a generation,” said Jeremy Paner, a former U.S. sanctions official.
Blessed Trust said in a statement that Mr. Wu of Porchoen Trade had no role at Blessed Trust, and that he and Mr. Zheng listed separate entrances to the villa, which has two units. Porchoen Trade was a client until September, Blessed Trust said.
There were other red flags about Blessed Trust and Mr. Wu.
The same month that Mr. Wu’s Hong Kong address was placed on the U.S. blacklist, Porchoen Trade submitted a “know your business” application to Binance, which is required to gain access to certain services on the exchange, according to a person familiar with the matter. The application listed Mr. Wu as a director, and Binance denied the application, the person said.
Still, Binance processed large sums that flowed in and out of an account belonging to Wu Jintu, a 78-year-old Chinese man, according to the documents. Chinese corporate records show that Wu Jintu and Wu Junliang co-owned a logistics company for more than a decade.
From January to March 2025, Wu Jintu used Binance to move a total of $439 million to an intermediary that forwarded almost all the funds along to Iranian entities, the documents show. More than $300 million had flowed into Wu Jintu’s account from Blessed Trust, according to the documents.
Any account moving that much money generally faces scrutiny at a financial firm. But Binance’s internal investigators started looking into Blessed Trust only last summer after receiving alerts from law enforcement, the documents show.
They concluded that about $1.2 billion had flowed from Blessed Trust’s Binance account to Wu Jintu and other intermediaries, before reaching a cluster of crypto wallets tied to Iran. Another $500 million reached those entities from a second Binance account, registered to a now-defunct company called Hexa Whale. The investigators found links between the wallets and Iran’s Islamic Revolutionary Guards Corps, which is classified as a terrorist group by the United States and other countries.
The investigators recorded their findings in internal reports last year and uncovered other unusual activity. Hexa Whale was allowed to open its Binance account and move hundreds of millions of dollars, even after providing the exchange with a fraudulent bank statement that was flagged at the time, according to the documents.
Binance said it suspended Hexa Whale’s account in August and reported it to the Justice Department. Hexa Whale did not respond to requests for comment.
Wu Junliang and Wu Jintu did not respond to requests for comment. Blessed Trust said it had not found anything amiss when it started working with Porchoen Trade, and that it never transferred crypto to Wu Jintu or knew of him “in any capacity.”
Binance’s investigators also found unusual links between Blessed Trust and the exchange.
They learned that a trading account belonging to Blessed Trust’s Mr. Zheng and one controlled by a group of Binance employees had both been accessed from the same electronic device, the documents said. In the exchange’s internal systems, accounts belonging to Mr. Zheng and Blessed Trust were marked with a note: “Don’t block. Internal accounts.”
The investigators also reviewed a conversation on the Telegram chat app in which a Blessed Trust representative called himself a “friend of Rock,” referring to Rock He, an early Binance employee who has been a member of its board.
A Binance employee responded: “Boss Rock has mentioned you before.”
Blessed Trust said its representative and Mr. He may have become acquainted “through normal business interactions.” A Binance spokeswoman said last month that vendors often overstate their connection to executives “to try and get better treatment.”
Last fall, the warnings about Blessed Trust reached Binance’s top executives, the documents said. Within weeks, Binance suspended or fired four of the investigators involved in the investigation. They declined to comment or did not respond to messages.
Binance said the dismissals were unrelated to the investigation’s findings.
The company has responded aggressively to questions about funds flowing to Iran. This month, the company filed a defamation lawsuit against The Wall Street Journal for claims the publication made in a story about the Iranian transactions and the dismissals of the investigators.
On March 6, a lawyer for Binance sent a letter to Senator Richard Blumenthal, Democrat of Connecticut, after he opened an inquiry into the exchange.
“Binance appropriately investigated and addressed these issues,” the letter said.
Nicholas Yong and Yi Liu contributed reporting.
David Yaffe-Bellany writes about the crypto industry for The Times from New York. He can be reached at [email protected].
The post The Trail of Clues Leading to Iran That Binance Missed appeared first on New York Times.
