Four Investigators, $1.7 Billion, and a Trail to Iran's Revolutionary Guards
Internal compliance investigators at Binance traced approximately $1.7 billion in cryptocurrency flowing from two accounts on the exchange to entities linked to Iran's Islamic Revolutionary Guards Corps, as of February 24, 2026, according to reporting from the New York Times. The transactions moved through two Hong Kong-based intermediaries, Blessed Trust and Hexa Whale Trading Limited, between March 2024 and August 2025, predominantly using Tether stablecoins on the Tron blockchain.
After the investigators surfaced their findings through internal reports, at least four were fired or suspended within weeks. Several held leadership roles and came from law enforcement backgrounds in Europe and Asia. Binance says they violated data-handling policies. The investigators say they were punished for doing their jobs.
The DOJ's independent compliance monitor, installed as part of Binance's 2023 plea deal, is expected to deliver a report on February 25.
$1.2 Billion Through Blessed Trust, $490 Million Through Hexa Whale
The money moved in two distinct streams. Blessed Trust, described as a Binance "fiat partner" based in Hong Kong, routed approximately $1.2 billion in cryptocurrency to entities that investigators connected to wallets controlled by Iran's Revolutionary Guards Corps. The IRGC has been designated a foreign terrorist organization by the United States since 2019.
The second channel ran through Hexa Whale Trading Limited, also Hong Kong-based, which sent roughly $490 million to Iranian crypto wallets. Officials suggested these funds may have financed groups including the Houthis.
Israeli law enforcement reportedly contacted Binance mid-2025 about terror-financing routes connected to Hexa Whale, which prompted the exchange to take action on that specific channel. Binance reported Hexa Whale to the Justice Department in October 2025 and discontinued Blessed Trust as a vendor in January 2026.
The investigators also discovered that individuals in Iran had gained access to more than 1,500 Binance accounts during the previous year.
The Compliance Team Purge
The timeline of firings raises the most pointed questions. In fall 2025, at least two investigators raised concerns to Binance executives about the Iranian transaction patterns. By November, both were suspended and locked out of internal systems.
Their replacements were subsequently also suspended. In total, at least four compliance employees involved in the investigation were disciplined. Additional departures followed, including the sanctions manager and the enterprise compliance team leader.
Binance spokesperson Rachel Conlan stated the investigators "were not suspended or terminated for raising compliance concerns." The company attributed the disciplinary actions to "unauthorized disclosure of confidential client information." Binance says a comprehensive internal review, supported by external legal advisors, found no evidence of sanctions violations tied to the transactions described.
Former sanctions prosecutor Robert Appleton offered a different read: "That's rather shocking that that happened under a monitorship."
CZ's Pardon and the Political Backdrop
The internal warnings about Iranian transactions surfaced in the months before President Trump granted a pardon to Binance founder Changpeng Zhao in October 2025. Zhao had spent four months in federal prison in 2024 following Binance's guilty plea to anti-money-laundering and sanctions violations, which carried a $4.3 billion settlement.
CZ dismissed the latest allegations as "paid FUD" from an unhappy former employee. Current CEO Richard Teng called the reporting "irresponsible" but acknowledged that compliance "requires constant effort."
The pardon does not shield Binance itself from further regulatory action. The DOJ's independent compliance monitor remains active through 2027 as a condition of the 2023 plea deal. The monitor's report, expected February 25, could determine whether the Justice Department escalates its oversight or initiates new proceedings.
Tether on Tron: The Sanctions Evasion Pipeline
The transaction infrastructure deserves scrutiny on its own. Most of the $1.7 billion reportedly moved as USDT on the Tron blockchain, a combination that has become the preferred channel for sanctions evasion globally. Tron transactions cost a fraction of a cent and settle in seconds, making them difficult to intercept in real time.
This is the same infrastructure that Elliptic recently identified as central to Russian sanctions evasion networks filling the void left by Garantex. The USDT-on-Tron pipeline is not a Binance-specific problem. It is the default rail for illicit cross-border value transfer, and every exchange with Tron USDT deposits faces the same screening challenge.
Binance claims it reduced direct exposure to the four largest Iranian crypto exchanges by 97.3% between January 2024 and January 2026, from $4.19 million to approximately $110,000. Critics note that figure measures direct exchange-to-exchange exposure, not the layered intermediary structures like Blessed Trust and Hexa Whale that the investigators flagged.
What This Means for Binance Card Holders and Exchange Users
For anyone holding funds on Binance or using the Binance Card, the immediate practical risk is regulatory, not operational. Binance is not at imminent risk of shutdown. But the pattern matters.
The 2023 settlement was supposed to mark a clean break. Binance paid $4.3 billion, accepted a compliance monitor, and CZ stepped down as CEO. The exchange positioned itself as reformed. If the DOJ monitor's February 25 report validates the investigators' findings, the consequences could range from extended monitoring to new enforcement actions that restrict Binance's ability to operate in certain jurisdictions.
Custodial exchange users bear this risk directly. If regulatory action freezes accounts or restricts withdrawals in specific regions, users with funds on the platform have limited recourse. This is the counterparty risk that self-custody card options eliminate by design, where your funds sit in your own wallet until the moment of a transaction.
For users in regions where Binance already faces restrictions, particularly in France and Singapore where the exchange has documented compliance issues, tomorrow's report could accelerate existing regulatory pressure.
FAQ
Did Binance violate US sanctions by allowing $1.7 billion to flow to Iran? That is what the investigators claim and what Binance denies. The exchange says its internal review with external legal counsel found no sanctions violations. The DOJ compliance monitor's report, expected February 25, 2026, may provide a more definitive answer.
Were the compliance investigators fired for whistleblowing? Binance says no, attributing the firings to unauthorized disclosure of confidential client information. The investigators and multiple media reports suggest the timing, weeks after they raised concerns about Iranian flows, indicates retaliation. At least four employees involved in the investigation were fired or suspended.
How does this affect Binance Card users? There is no immediate disruption to card services. The risk is regulatory: if new enforcement actions follow the DOJ monitor's report, they could restrict Binance operations in certain jurisdictions. Users holding significant balances on Binance may want to consider diversifying across platforms or moving to self-custody solutions.
What is the DOJ compliance monitor? As part of its 2023 $4.3 billion plea deal, Binance agreed to an independent compliance monitor appointed by the Department of Justice. The monitor has access to Binance's internal systems and reports to the DOJ on the exchange's compliance efforts. The monitorship is scheduled to run through 2027.
What role did Tether and Tron play? The $1.7 billion reportedly moved primarily as USDT on the Tron blockchain. This combination offers near-zero transaction fees and fast settlement, making it the preferred rail for sanctions evasion globally. The infrastructure challenge is industry-wide, not unique to Binance.
Overview
Binance's internal compliance investigators traced $1.7 billion in cryptocurrency flowing to entities linked to Iran's Revolutionary Guards Corps through two Hong Kong intermediaries: Blessed Trust ($1.2 billion) and Hexa Whale Trading ($490 million). At least four investigators were fired or suspended after raising concerns, with Binance claiming they violated data policies rather than being punished for whistleblowing. The story arrives at a critical moment: CZ received a presidential pardon in October 2025, the DOJ's independent compliance monitor is due to report on February 25, and the exchange is still operating under the terms of its 2023 $4.3 billion settlement. For exchange users, the practical question is whether tomorrow's DOJ report validates the investigators or Binance's version of events, and what enforcement actions might follow.
Recommended Reading
- Elliptic Names Five Crypto Exchanges Filling Garantex's Void as Russia's Sanctions Evasion Network Rebuilds
- Austria Bans KuCoin EU From Onboarding New Customers After AML Officers Vanish Three Months Into Its MiCA License
- JPMorgan Admits It Shut More Than 50 Trump Accounts After Jan. 6 as $5 Billion Debanking Lawsuit Exposes the Playbook That Pushed a President Into Crypto
Sources
- The Block: Binance denies firing investigators over reported $1.7 billion crypto flows to Iran
- New York Times via DNYUZ: Binance Employees Find $1.7 Billion in Crypto Was Sent to Iranian Entities
- Fortune: Binance fires top investigators who claim to have uncovered evidence of Iranian sanctions violations
