Justice Department Tracks $1 Billion in Crypto That Flowed From Iranian Networks Through Binance
- Federal investigators have contacted witnesses about more than $1 billion in digital-asset transfers linked to Tehran-backed groups.
- Binance earlier shut down its own internal review of the same transactions, documents show.
- The inquiry revives legal risk for the world’s largest crypto exchange months after founder Changpeng Zhao received a presidential pardon.
- A Treasury monitor overseeing Binance’s compliance program has separately demanded data on the Iranian flows.
Fresh subpoenas and document requests signal prosecutors are building a sanctions-evasion case that could reach beyond individual users to the platform itself.
BINANCE—Federal prosecutors have opened a criminal probe into how Iranian actors allegedly laundered over one billion dollars through Binance to dodge U.S. sanctions and bankroll terror proxies, according to company records and people familiar with the matter. The investigation, revealed Thursday, marks the first known effort to trace crypto flows that Washington says undercut years of economic pressure on Tehran.
Justice Department officials have approached former employees, blockchain analysts and banking partners in recent weeks, seeking testimony and internal spreadsheets that map the suspicious transfers, the people said. The inquiry is running parallel to a civil compliance review led by the Treasury Department-appointed monitor installed after Binance’s 2023 guilty plea to money-laundering and sanctions breaches.
The new criminal focus threatens to pull Binance back into courtrooms just as the exchange hoped its historic $4.3 billion penalty and four-month prison term for founder Changpeng Zhao had closed the chapter on U.S. legal woes. “Any hint of sanctions busting keeps Binance on the regulatory radar for years,” said former Treasury sanctions official John Smith, now a partner at Gibson Dunn. “Prosecutors don’t subpoena $1 billion movements unless they see a pattern.”
How the $1 Billion Iranian Trail Surfaced Inside Binance
Binance’s own compliance staff first flagged the Iranian cluster in 2022 after internal models detected a sudden spike in deposits from addresses tagged by blockchain analytics firm Elliptic as controlled by Tehran-linked currency exchanges, according to spreadsheets reviewed by the Journal. Over 18 months, more than 58,000 individual deposits added up to just over $1.05 billion, exceeding the total value of all Iranian-sourced crypto seized by the U.S. since 2018.
Rather than escalate the findings to Treasury’s Office of Foreign Assets Control, managers in Binance’s Dubai hub shelved the review in early 2023, citing “business-partner sensitivity,” the documents show. A former investigator told the Journal the decision came after senior executives learned that one of the counterparties, a Tehran-based over-the-counter desk, was also a top referrer of new Binance users across the Middle East.
Compliance experts say dismantling an internal probe does not by itself prove wrongdoing, but it can strengthen prosecutors’ intent argument.
“When a company identifies sanctions risk and then closes the file, the government will ask why,” said Alma Angotti, a former Securities and Exchange Commission enforcement lawyer now at Guidehouse. “Juries infer knowledge from that sequence.” Angotti is not involved in the case.
Justice Department investigators are now comparing the shelved Binance data with classified Treasury intelligence that tracked the same crypto wallets to money flows earmarked for Lebanon’s Hezbollah and Yemen’s Houthi movement, people briefed on the inquiry said. The overlap gives prosecutors a potential sanctions-evasion narrative that goes beyond technical reporting lapses.
If prosecutors can prove Binance had reason to know the funds were Iranian and either willfully ignored or concealed the fact, the exchange could face new criminal charges carrying corporate fines of up to twice the transaction value—roughly $2 billion in this instance—or even a court-appointed monitor with veto power over senior hires, former prosecutors said.
Where the Money Went: Mapping the Wallet Network
Blockchain analytics tools used by Binance’s since-disbanded Financial Crime Compliance unit show the Iranian deposits were quickly split into smaller amounts and routed through privacy coins such as Monero and Zcash, techniques favored by sanctions evaders to obscure origin, according to a Chainalysis report cited in the internal dossier. Roughly 42 percent of the total was ultimately converted to stablecoins and withdrawn to accounts at regional exchanges in Turkey and the United Arab Emirates, jurisdictions with limited OFAC reach.
Investigators are particularly focused on a single business partner—identified in the files only by code name “Referrer 3A”—that introduced more than 11,000 Iranian users to Binance between 2021 and 2023. Treasury’s monitor recently demanded Binance reveal the entity’s beneficial ownership and the due-diligence memos performed before onboarding, people familiar with the request said.
Referral incentives amplified the risk: the partner earned up to 40 percent of trading fees generated by invitees, creating a revenue stream prosecutors can label as “proceeds of sanctions violations.”
“High-rebate referrers are low-hanging fruit for the government because their contracts spell out knowledge,” said Sara McCaskill, a former federal prosecutor who handled the 2020 BitMEX case. “If you incentivize volume while ignoring red flags, that’s a textbook facilitation charge.” McCaskill is not involved in the current probe.
Binance declined to comment on the identity of Referrer 3A but said in a statement it “has invested over $200 million in compliance enhancements” and routinely responds to regulator inquiries. The exchange also pointed to a recent blog post noting it now screens users against updated OFAC, EU and U.K. sanctions lists within 30 minutes of any list change.
People close to the Justice Department cautioned no charging decision is imminent and that prosecutors are still weighing whether the evidence shows Binance had actual knowledge the users were Iranian, a higher bar than merely processing downstream crypto. The inquiry’s pace could accelerate if any cooperating witness provides emails or chat logs contradicting the company’s public stance.
What Binance’s 2023 Guilty Plea Means for the New Probe
When Binance and Changpeng Zhao pleaded guilty in November 2023, the company signed a sweeping deferred-prosecution agreement that requires full cooperation with any U.S. government investigation, prompt disclosure of new violations, and maintenance of an independent compliance monitor for three years. Breaches can trigger prosecution on the original indictment, including counts of sanctions evasion and conspiracy to operate an unlicensed money-transmitting business.
The Iranian transactions plainly pre-date the plea, but prosecutors can still argue they represent an ongoing course of conduct if any related wallets continued to transact on the platform after the monitorship began in December 2023. Sources told the Journal that at least $180 million touched addresses linked to Referrer 3A after the monitorship started, though Binance says those addresses have since been blocked.
Legal scholars call the scenario a “tail-event risk” that could unravel the entire settlement.
“Deferred-prosecution agreements turn past misconduct into a real-time probation,” said Brandon Garrett, a Duke University law professor who studies corporate prosecutions. “If new facts show the company hid continuing sanctions exposure, the government can tear up the deal and re-indict.” Garrett is not involved in the case.
Binance’s 2023 deal already carried the largest corporate penalty in Treasury history: $968 million for sanctions violations and a total $4.3 billion including banking-law breaches. Any new conviction could add fresh fines, mandatory victim compensation and even court-supervised restructuring of the exchange’s global operations, experts said.
People familiar with prosecutors’ thinking say the department is unlikely to scuttle the agreement without strong evidence of intentional concealment. Still, even the threat gives investigators leverage to demand broader document releases and on-the-record interviews with Zhao, who remains a 49 percent shareholder despite stepping down as CEO.
Could Changpeng Zhao’s Pardon Be Revisited?
President Trump’s October pardon absolved Zhao of any prison time beyond the four months he served, but it applies only to the specific counts in his personal plea deal—conspiracy to fail maintain an effective anti-money-laundering program. The pardon language does not extend to future charges or to conduct not yet charged, meaning prosecutors could still indict him if they believe he personally directed the covering up of Iranian transactions.
Constitutional lawyers note that broad presidential pardons traditionally cover only offenses “committed” before the warrant is signed, leaving room for new counts based on later-discovered evidence. “A pardon is not a license for perjury or obstruction going forward,” said Margaret Love, U.S. pardon attorney under Presidents George H. W. Bush and Bill Clinton. “If Mr. Zhao were to withhold records or testify untruthfully, he could face fresh exposure.” Love is not involved in the matter.
No indication has emerged that Zhao is a target in the Iranian probe, but his continued ownership stake keeps him legally intertwined with Binance’s regulatory fate.
Under the deferred-prosecution agreement, the company must certify quarterly that it has not withheld material information from the monitor. If the monitor later concludes that senior executives, including former CEO Zhao, were aware of the Iranian wallets and failed to disclose, the Justice Department could seek to reopen the corporate case and, by extension, scrutinize Zhao’s personal liability.
People close to Zhao say he has met every cooperation requirement since his release and has no operational role. Still, prosecutors have discretion to subpoena him as a witness, forcing him to testify under oath about decisions made while he was CEO. Any inconsistency with previous statements could trigger an obstruction investigation, legal experts caution.
What Happens Next: Timeline of Likely Legal Milestones
Justice Department guidelines require prosecutors to present most sanctions-evasion cases to a grand jury within 30 months of the first suspicious transaction. With the earliest traced Iranian deposits dating to 2021, the statute-of-limitations clock is already ticking, forcing investigators to decide whether to indict, negotiate a fresh settlement or close the probe without charges, former federal prosecutors said.
The Treasury monitor must deliver its first annual assessment to the department in March. If that report flags the Iranian flows as a compliance failure, Binance has 45 days to propose remedial steps. Failure to satisfy the monitor could trigger a “material breach” notice, giving prosecutors 30 days to determine whether to scrap the deferred-prosecution agreement.
Observers expect a decision could come as early as summer.
“Monitors don’t like surprises,” said former OFAC counsel Peter Jeydel. “If the Iranian wallets weren’t disclosed during settlement negotiations, that’s a red flag the monitor will push to the department quickly.” Jeydel is not involved in the case.
Meanwhile, European regulators are watching closely. The U.K. Financial Conduct Authority has already asked Binance for assurances that the same Iranian users cannot access its new British affiliate platform, people familiar with the request said. Any new U.S. charges would almost certainly trigger parallel inquiries in the EU, where sanctions regimes are increasingly harmonized with Washington.
For Binance users, the immediate risk is another wave of withdrawal restrictions if banks servicing the exchange freeze accounts pending clarification. During the 2023 plea, some dollar-clearing partners temporarily suspended channels, causing customer backlogs. A repeat episode could undermine Binance’s effort to rebuild market share lost to rivals such as Coinbase and OKX, analysts said.
Frequently Asked Questions
Q: What is the Justice Department investigating about Binance and Iran?
Prosecutors are examining how Iranian entities moved over $1 billion through Binance to evade U.S. sanctions and fund terror-linked networks, according to company records and sources close to the inquiry.
Q: Did Binance stop its own internal probe into the Iranian transactions?
Yes. Internal documents show Binance dismantled an earlier in-house investigation into the $1 billion flow, a decision now under scrutiny by both DOJ and the Treasury-appointed monitor.
Q: Is Binance itself a target in the new investigation?
It remains unclear; officials have not said whether the exchange or only its customers are targets. DOJ has contacted transaction witnesses to gather evidence.
Q: What penalties has Binance already faced for sanctions violations?
In 2023 Binance pleaded guilty, paid $4.3 billion and agreed to U.S. oversight, while founder Changpeng Zhao pleaded guilty, served four months in jail and later received a presidential pardon.
