Binance Fired Staff Who Flagged $1 Billion Moving to Sanctioned Iran Entities
Weeks after Trump pardoned Binance’s founder, the company dismantled probe and suspended the investigators; Binance denied inquiry ended or staff fired for the concerns
Richard Teng, CEO of Binance, and Changpeng Zhao, the crypto exchange’s founder. Daisy Korpics/WSJ, Kent Nishimura/Bloomberg News, Abedin Taherkenareh/Shutterstock, Jason Redmond/AFP/Getty, Sepahnews/Zuma Press
By Patricia Kowsmann, Angus Berwick and Ben Foldy
Feb. 23, 2026 4:14 pm ET
Quick Summary
- After President Trump pardoned Binance founder Changpeng Zhao, Binance dismantled an investigation into $1 billion moved to an Iran-backed terror network.View more
Weeks after President Trump granted a pardon to convicted Binance founder Changpeng Zhao in October, executives at the crypto exchange dismantled a staff investigation into $1 billion that had recently moved through Binance to a network funding Iran-backed terror groups, according to company documents and people familiar with Binance’s operations.
A trading account belonging to a close Binance business partner was identified as a primary channel that moved cryptocurrency to the Iranian network.
Binance subsequently fired the investigators who had uncovered the transfers—and the network remained active.
A Binance spokeswoman said the investigators weren’t “suspended or terminated for raising compliance concerns” but instead left “based on individual circumstances.” The investigation continued, she said, and resulted in the entities identified being removed from Binance’s platform.
The episode echoed some of the same concerns that drew U.S. scrutiny in 2023, when prosecutors secured a plea deal with the world’s largest crypto exchange and a prison sentence for Zhao. Binance admitted to breaking sanctions and anti-money-laundering laws—violations that turned it into a money-laundering hub for criminals, terrorists and Iranian-sanction evaders.
Zhao was pardoned in October by President Trump. He had been sentenced to four months in prison for failing to maintain an effective anti-money-laundering program. deborah bloom/Reuters
The exchange paid a record $4.3 billion fine and pledged reform under U.S. oversight, including by expanding investigative staff to block illicit money. Its founder, Zhao, was sentenced to four months in prison for failing to maintain an effective anti-money-laundering program. The moves essentially shut Binance out of the giant U.S. market, although it continued to operate globally.
After Trump returned to office last year, Binance lobbied for Zhao’s pardon and pushed to remove U.S. monitors appointed as part of the plea agreement. It also took steps to boost the Trump family’s crypto business, World Liberty Financial, by providing crucial backing to its main product, a stablecoin whose market capitalization has surpassed $5 billion. After issuing the pardon, Trump said he had been told Zhao wasn’t “guilty of anything.”
Documents, foreign law-enforcement officials and the people familiar with Binance’s operations said the same conduct that broke the sanctions and anti-money-laundering laws has persisted at the exchange. And the law-enforcement officials said that, over the past year, Binance has started cooperating far less with their requests to obtain financial information about its hundreds of millions of users, such as by declining to provide customer details without a court order, or insisting requests are submitted via formal channels that can take months.
Internal reports submitted by Binance’s financial-crime investigations team connected accounts registered to Chinese clients to digital wallets that U.S. and Israeli authorities said were used by Iran to finance its proxies. In total, $1.7 billion flowed over 2024 and 2025 from the accounts, which funded Iran-backed groups including Yemen’s Houthi militants. The investigations team was composed of experts in sanctions and counterterrorist financing, many put in place as part of Binance’s pledges to reform.
The Greek-flagged oil tanker Sounion on the Red Sea after an attack by Yemen’s Houthi militants in 2024. houthi military media/Reuters
The documents said more than $1 billion of the total came from the account of the close business partner—a Hong Kong-based payments company called Blessed Trust.
Investigators shared their findings with Binance’s leadership, including Chief Executive Richard Teng and Chief Compliance Officer Noah Perlman, in October. The next month, Binance suspended the investigators and later fired them. Some elements of their dismissal and the transactions were first reported by Fortune and the New York Times.
In February 2025, Trump ordered a campaign of “maximum pressure” to deny Iran and its proxies access to cash, which violates sanctions levied over decades for its nuclear program, terrorism financing and other issues. Iran-backed militia groups have carried out attacks on American forces in Iraq and Syria, and Tehran supports multiple U.S.-designated terrorist groups such as Hezbollah in Lebanon.
The U.S. has been amassing power in the Middle East in preparation for a possible new strike on Iran related to its nuclear program and other security issues.
The U.S. Navy on the Arabian Sea on Jan. 30. US NAVY/Afp/Getty Images
Crypto has become a key channel Iran uses to circumvent sanctions and finance its activities, and the Treasury Department recently began targeting Iranian crypto networks financing cybercrime operations.
At Binance, investigators last year also uncovered 2,000 accounts that had been accessed from Iran using software that masks users’ locations. The investigators recommended asking users for additional information, according to documents. Teng, the CEO, rejected that plan, the documents said.
Binance’s leaders also declined to take action after its intelligence team found sailors of the Russian shadow fleet—ships used to transport sanctioned cargo, including oil from Russia, Iran and elsewhere—were being paid salaries through Binance accounts, according to documents.
An oil tanker seized by the U.S. for allegedly being part of the ‘shadow fleet.’ Andy Buchanan/AFP/Getty Images
Binance said it was confident it complied with legal and reporting obligations and didn’t knowingly permit sanctionable activity. The spokeswoman said the investigation didn’t establish that any Binance user transacted directly with a sanctioned entity, instead transmitting funds over several steps. She also said Teng didn’t reject a proposal to request more information from users, and added that Binance cooperates with law enforcement and regulators.
The fired Binance investigators declined to comment.
Blessed Trust, the Hong Kong company, said it operated in accordance with laws and regulatory requirements, and carried out sanctions-screening procedures and appropriate compliance and risk management controls.
It said it doesn’t provide services to sanctioned jurisdictions or sanctioned persons and doesn’t knowingly maintain business relationships with sanctioned entities. It said it hasn’t directly made payments to any sanctioned Iranian entity.
A World Liberty spokesman said the company had no comment.
Finding ‘Entity A’
When Binance pleaded guilty in 2023, U.S. authorities laid out a long list of bad actors that received money through the trading platform, including al Qaeda, Islamic State and Iranian cybercriminals.
Authorities said Binance critically undermined the U.S. blockade on Iran’s economy, allowing U.S. users to make transactions worth over $898 million with Iranian users despite sanctions that bar financial institutions from transacting there.
As part of the settlement, Binance agreed to replace Zhao with a new CEO with “a strong commitment to and experience in compliance,” and to closely track customers and block any transactions that violated U.S. sanctions. Binance also agreed to give access to and cooperate with two independent monitors appointed by the Treasury and Justice departments.
Teng, a former Singaporean regulator, was appointed CEO. He said Binance would invest heavily in its internal systems to detect and prevent money laundering, and staff up a compliance team of dedicated financial-crime investigators. The foreign law-enforcement officials said that after the plea deal Binance became far more cooperative with their requests for help.
In the summer of last year, the Federal Bureau of Investigation and Israel’s National Bureau for Counter Terror Financing sent Binance requests for information about a customer suspected of financing Iran-backed terror groups, including the Houthis, according to law-enforcement officials and documents.
The internal investigation this launched would eventually lead the Binance staff to inquiries about Blessed Trust. But it first revealed another company that they said was moving funds to Iran-backed groups.
Teng, the Binance CEO, at a crypto event in November. Brent Lewin/Bloomberg News
In August, Binance’s investigators submitted an internal report on the customer, a company called Hexa Whale Trading, registered in Hong Kong in 2024. Hexa had provided false documentation to open an account at Binance, which was flagged internally at the time, according to documents. Still, Binance allowed Hexa to open an account and gave it VIP client status, which reduces a user’s trading fees.
Binance said it doesn’t knowingly register customers with incomplete documentation, and VIP status doesn’t alter its compliance standards.
Investigators found Hexa used the account to move about $500 million worth of the stablecoin tether over several months since 2024 to what investigators referred to as “Entity A.” Entity A was a group of seven digital wallet addresses that the Binance investigators concluded were linked to an Iranian network.
The law-enforcement officials said the network is part of a shadow-banking corridor run by Iran’s Islamic Revolutionary Guard Corps between Hong Kong and Tehran, enabling Chinese companies to quietly pay for Iranian oil.
The IRGC is an elite branch of Iran’s armed forces that also runs swaths of its economy. It has been designated a terrorist organization by the U.S., which says it uses money it raises to purchase foreign military equipment and pay for its proxy military forces.
The Binance investigators submitted the report with their findings to Binance’s internal criminal conduct committee, chaired by Perlman, the compliance chief. The committee then took the information to the Justice Department. Under its plea deal with the DOJ, Binance had committed to file reports to U.S. authorities on any suspicious transactions.
Binance removed Hexa as a client. The company said it managed the risk appropriately by offboarding the user and cooperating with law enforcement.
Iran’s Islamic Revolutionary Guard Corps in a parade in 2024. abedin taherkenareh/epa/Shutterstock
Efforts to reach Hexa, which went dormant last year according to Hong Kong corporate filings, for comment weren’t successful.
As the investigators kept looking into money flowing into Entity A, they discovered another account that had transferred even more funds to the Iranian network. This time, the probe hit an internal roadblock.
Suspicious account
Unlike the majority of accounts held by customers, the suspicious account was labeled as “internal” and access was tightly restricted. It required special approval from a Binance department called Internal Audit, whose leader reported to Teng, the CEO.
Binance said this was a “standard measure to preserve investigative integrity, not to bypass controls,” and that the account was mislabeled as “internal” by a junior employee.
Months earlier, the account had been the subject of inquiries from the FBI, which didn’t give a reason, and the Internal Revenue Service, which said the query was related to money laundering. The account also triggered 14 internal alerts of suspicious activity in 2025. Most were closed after an automated system found no illicit activity or they didn’t meet escalation criteria, according to documents. Binance said the alerts were handled in accordance with standard compliance procedures.
Investigators discovered that the account belonged to Blessed Trust, the Hong Kong-based company, which helps clients convert traditional currency, such as yuan, into cryptocurrency and vice versa.
Binance’s investigators found that Blessed had transferred more than $1 billion in tether to the IRGC-run Entity A network between November 2024 and August 2025, directly or through other Binance account holders, according to documents. The investigators referred to the accounts collectively as the “Chinese Nexus.”
Binance said that appropriate compliance measures were taken and the account was offboarded last month.
The exchange and four other Binance corporate entities were Blessed’s top clients by revenue, according to a Blessed company email.
Blessed also had a close relationship with Jukai He, who is nicknamed Rock, one of the founding members of Binance, which was launched by Zhao in Shanghai in 2017. Rock leads Binance’s so-called fiat business, which turns crypto into regular money.
In a Telegram chat between Blessed and Binance, the name of one of Blessed’s representatives appeared in Chinese characters as “Karry…friend of Rock,” according to a screenshot of the chat group reviewed by The Wall Street Journal. Later in the chat, a Binance VIP client manager said: “Karry the big shot, haha. Boss Rock has mentioned you before.”
The Binance spokeswoman said Rock didn’t have any supervisory or operational role in Blessed Trust, and the Telegram chat didn’t establish “governance ties, influence, or preferential treatment.”
Investigators also found evidence that Binance employees were logging into Blessed’s trading account, implying Binance to some degree was involved in the payment firm’s crypto operations. The Blessed account had been accessed from the same device, likely a phone or computer, as an account operated by one of Rock’s Binance teams, according to documents.
Blessed said it is independently operated and has no ownership, control or management relationship with any of its clients.
Zhao departed federal court in Seattle in 2024. Jason Redmond/AFP/Getty Images
Binance said none of its employees logged into Blessed’s account, and the claim relied on “incorrect investigation records,” adding that, “Any suggestion that Blessed Trust was operated, directed, or controlled by Binance is false.”
Dismantling the investigation
On Sept. 24, one of the investigators contacted Blessed and asked about its relationship with digital wallets that were sending money to the Iranian illicit-financing network, according to documents.
Blessed told Binance the funds sent to Entity A originated from its clients that processed bitumen, an oil product used to pave roads, as well as others in the construction industry—both sectors that Binance knew participated in the illicit China-Iran oil trade, according to documents.
The investigators’ findings on Blessed reached Binance’s senior leadership, including Teng and Perlman, in October.
On Nov. 13, Binance suspended the main investigator on Blessed and a second person, the head of sanctions and counterterrorist financing investigations, and fired them in the following weeks.
Before leaving, the sanctions head submitted an internal report summarizing the investigators’ findings. It couldn’t be determined who received the report.
On Nov. 24, other members of the investigations team told a Binance executive they would continue to investigate Blessed. Two days later, they were locked out of Binance’s systems, suspended—and fired soon after.
The Latest on Crypto
Coverage of bitcoin and other cryptocurrencies, selected by the editors
Get WSJ’s Markets A.M. Newsletter
Banks Cry Foul Over High-Yielding Tokens
Crypto Investors Celebrated for Most of 2025. Then Came the Hangover.
Trump Regulators Say They Are Ready to Lay Out Crypto Rules
World Liberty Seeks a U.S. Banking License
Copyright ©2026 Dow Jones & Company, Inc. All Rights Reserved. 87990cbe856818d5eddac44c7b1cdeb8
Appeared in the February 24, 2026, print edition as ‘Binance Fired Staff Who Said $1 Billion Moved to Iran Entities’.
Patricia Kowsmann is a senior reporter for The Wall Street Journal based in Singapore. She covers all things touching money, including financial scandals, economic sanctions, banks and crypto.
Along with WSJ colleagues, she won a 2022 Best in Business award from the Society for Advancing Business Editing and Writing for their coverage of crypto exchange FTX. Her work on an investigative series into Brazil’s deadly dam collapse won a 2019 Sabew and received an Overseas Press Club of America honorable mention.
She was a finalist in the 2014 Sabew Awards and the British Press Awards for uncovering a financial scandal at Portuguese lender Banco Espírito Santo, which ended up collapsing.
She previously covered finance from Frankfurt, the eurozone crisis from Portugal and banks in London. She occasionally jumps to other areas, particularly if it relates to her native country, Brazil. She started her career at the Journal covering corporate filings in Washington.Follow
Angus Berwick is a reporter with The Wall Street Journal in London, covering cryptocurrencies, financial crime, and markets.
He joined the Journal in mid-2023 from Reuters, where he worked as an investigative reporter focused on white-collar crime and as a correspondent in Venezuela and Spain. His work has been recognized with a Gerald Loeb Award, two Overseas Press Club awards and an award from the Society for Advancing Business Editing and Writing.
His reporting on the largest players in crypto revealed Binance’s use for wide-scale money-laundering and sanctions evasion, and he led Reuters’ coverage of FTX’s collapse, first disclosing how founder Sam Bankman-Fried secretly siphoned off client money.
He covered Venezuela’s economic collapse and investigated President Nicolás Maduro’s efforts to retain power, exposing his use of police death squads and Cuban-trained agents to suppress dissent. In Spain, he unraveled Chinese organized crime’s ties to China’s largest bank. Angus joined Reuters in 2015 after graduating from University College London.Follow
Ben Foldy is a reporter on The Wall Street Journal’s investigations team, based in New York City. He often writes about fraud, financial crime, cryptocurrency and corporate malfeasance.
In 2022, Ben reported and hosted the second season of The Journal’s “Bad Bets” podcast, focused on the rise and fall of Nikola founder Trevor Milton.
Ben worked at Bloomberg News and the Financial Times before joining the Journal in 2019. He studied journalism at the City University of New York and also holds a B.A. and M.A. from McGill University. Separately from the Journal, Ben is writing a book on short selling research firm Hindenburg Resarch, set to be published in 2027.
He can be reached at 313-330-4323, and uses the same number on messaging apps like Signal and Telegram.
View this Wall Street Journal article CLICK HERE
Media Air Base, LLC 
Leave a comment