Binance’s internal investigators discovered last year that about $1.7 billion in cryptocurrency flowed from two accounts on the exchange to Iranian entities with links to terrorist groups, raising potential violations of global sanctions, according to company records and other documents reviewed by The New York Times.

The investigators also concluded that people in Iran had gained access to more than 1,500 Binance accounts over the prior year and that one of the accounts involved in the Iranian-linked flows belonged to a Binance vendor, the newspaper said. 

The investigators escalated their findings to senior executives, but within weeks Binance fired or suspended at least four employees involved in the investigation, citing alleged “violations of company protocol” tied to the handling of client data, according to the documents and people familiar with the situation, the Times reported. 

While it’s not clear why the investigators were disciplined, more than half a dozen compliance staffers have left Binance in recent months, including a sanctions manager and the leader of the enterprise compliance team, according to the NYT. Binance chief compliance officer Noah Perlman has also discussed leaving, a person familiar with the matter told the Times.

The newspaper’s reporting confirms and builds upon a news story published earlier this month by Fortune that Binance vigorously denied. In an X post citing the Fortune article, Binance Co-CEO Richard Teng wrote “The record must be clear. No sanctions violations were found, no investigators were fired for raising comments, and Binance continues to meet its regulatory commitments.” 

Teng included a letter sent to Fortune editors in the X post requesting “corrections to recent reporting.” 

In response to the latest story, Binance spokesperson Rachel Conlan told the Times that the exchange addressed the issues flagged by investigators, removed the accounts tied to the $1.7 billion in Iranian transactions, and notified authorities. 

“Any suggestion that Binance knowingly allowed sanctionable activity to continue unchecked is incorrect and defamatory,” Conlan said in report. 

Conlan also told the Times that compliance investigators were not suspended or terminated for “raising compliance concerns,” but that “certain individuals” were disciplined “in connection with the unauthorized disclosure of confidential client information.” 

The internal warnings emerged months before President Donald Trump granted a pardon to Binance founder Changpeng Zhao, who served four months in federal prison in 2024 for his role in the firm’s crimes, the newspaper said. The Trump family’s crypto start-up, World Liberty Financial, has developed close business ties with Binance, and Zhao attended a conference this month at Trump’s Mar-a-Lago club in Florida.

The investigation into Iranian-linked activity began after Binance compliance experts were contacted in mid-2025 by Israeli law enforcement officials seeking to discuss terror-financing routes connected to Iran, the newspaper said. 

That inquiry focused on a now-defunct Hong Kong business, Hexa Whale Trading Limited. Records reviewed by the Times indicate that Hexa Whale used Binance to send $490 million to crypto wallets tied to Iranian entities. An Israeli official told investigators that the Hong Kong firm was financing terrorist organizations, including the Houthis. 

Around the same period, Binance investigators found evidence that people in Iran had gained access to more than 1,500 accounts on the exchange, and they identified Binance accounts used by a fleet of Russian cargo ships believed to be evading sanctions to pay crew members, the Times said. 

The most consequential link to Iran involved a Hong Kong company called Blessed Trust, the Times said. Blessed Trust, owned by five companies incorporated in the British Virgin Islands and the Cayman Islands, had a business relationship with Binance and operated as a “fiat partner,” providing payments and other services. 

Over roughly the past two years, investigators found that $1.2 billion in crypto flowed from Blessed Trust’s Binance account to Iranian-linked entities, according to the Times. The investigators also identified ties between those entities and crypto wallets controlled by Iran’s Revolutionary Guards Corps. 

Two compliance investigators raised concerns about Blessed Trust and the Iran-linked transactions last fall, and the warnings reached Binance Co-CEO Richard Teng. In November, the two investigators were suspended, and the two others who took over the work were also suspended days later and cut off from internal systems, according to the report. 

Read more at The New York Times