Iran Moved Billions Through Binance to Fund Regime—Continuing Into This Month

Until as recently as December, the network, run by Babak Zanjani, an Iranian who is a self-described “antisanction” operator, made $850 million in transactions over two years on the world’s largest cryptocurrency exchange, mostly on a single trading account, internal Binance compliance reports show.

Zanjani allies, including a sister, a romantic partner and a director of Zanjani’s company, ran additional accounts, all accessed from the same devices—a pattern the Binance investigators flagged in their reports as evidence the group was evading U.S. sanctions on Iran.

Even after multiple internal flags on the activity, the main account continued to operate over a period of at least 15 months and was open as of January, according to the Binance reports. Zanjani’s use of Binance hasn’t been previously reported.

The funds are part of billions in crypto transactions that have flowed through Binance to networks financing Iran’s Islamic Revolutionary Guard Corps in the two years preceding the current U.S.-Iran war, according to Binance compliance reports, blockchain data, foreign law-enforcement officials who track terrorism financing and other crypto researchers and nonpublic documents.

Foreign law-enforcement officials said they have continued to track money this year flowing through Binance accounts to Iranian entities associated with the regime—identifying transactions as recently as this month.

Binance’s founder, Changpeng Zhao, was pardoned by President Trump in October. He had pleaded guilty in 2023 and served a four-month prison sentence for an anti-money laundering violation.

The vast sums show how Binance has been used as a financial artery for the IRGC, the powerful political, military and economic force that dominates Iran, according to the Binance compliance reports, foreign law-enforcement officials and the nonpublic documents.

The Iranian force also supports proxy armies around the Middle East, including terrorist-designated groups Hamas, Hezbollah and Yemen’s Houthi militants.

A Binance spokesperson said the information was inaccurate, that Binance didn’t permit any transactions with individuals or digital wallets that were sanctioned at the time and that Binance took all appropriate actions once they were.

The spokesperson said that, according to Binance’s records, “it appears the overwhelming majority of these transactions have nothing to do with the Binance platform.”

Binance declined to answer specific questions about the transactions, including the amounts moved, or to clarify what it said was inaccurate.

“Binance has zero-tolerance for illicit activity on its platform, and since 2024, Binance has transformed and built a best-in-class compliance program,” reducing exposure to sanctioned entities and high-risk areas to near-zero levels, the spokesperson said. “We work closely with law enforcement authorities around the world to detect, prevent, and combat financial crime.”

Based on how terrorism-financing experts assess the purpose of trading accounts like Zanjani’s, the $850 million in Zanjani transactions, which included both deposits and withdrawals, likely means about $425 million moved through Binance to finance Iran’s military, according to foreign law-enforcement officials and other people familiar with the activity. Binance’s own investigators assessed the accounts were a money-laundering network to finance the regime, according to the compliance reports.

Other large fund transfers, previously unreported, have moved through Binance to or from Iran-linked entities in recent years.

Iran’s central bank moved $107 million in crypto through a series of transactions into Binance accounts last year, according to an analysis by a blockchain data firm. It couldn’t be determined if the funds were then transferred out of Binance.

Data compiled by a foreign law-enforcement agency recorded about $260 million in direct transactions during 2024 and 2025 between accounts on Binance and digital wallets associated with Iranian terrorist financiers and sanctioned Iranian entities.

In addition, Binance investigators flagged that a digital wallet held by an unknown user outside Binance received money through the exchange and sent $218 million to an Iranian-state financing network in 2023, a transfer confirmed by blockchain data. Digital wallets are like bank accounts for crypto.

These funds are on top of the roughly $1.7 billion that Binance investigators concluded moved through Binance to that same Iranian network, as previously reported by The Wall Street Journal in February. The Binance compliance reports said the Iranian actors moved funds using sophisticated techniques in an effort to evade detection. Binance forced out several internal investigators who raised concerns about accounts associated with a Binance business partner that they concluded moved around $1.2 billion of that amount through the platform in 2024 and ’25, according to the Journal’s article.

In response to the article, Binance said the investigators weren’t fired for raising compliance concerns but instead left “based on individual circumstances.” It said it didn’t knowingly permit sanctionable activity, that the identified entities were ultimately removed from Binance’s platform and that it managed the risk appropriately.

Binance filed a lawsuit against the Journal over its reporting. A Journal spokesperson said, “We stand by our reporting.”

The funds moving through Binance to Iran-linked groups largely corresponded to payments from Chinese buyers of Iranian oil, part of a sanctions-busting trade that is controlled by the IRGC and that is a significant revenue source for the regime, according to foreign law-enforcement officials, Binance compliance reports and the nonpublic documents.

The movement of funds to IRGC-connected entities continued after Binance pleaded guilty in 2023 to federal anti-money laundering and sanctions violations, according to the foreign law-enforcement officials, compliance reports and blockchain data. Binance was fined a record $4.3 billion, in addition to the charge against the founder, Zhao.

Binance has been a crucial backer of the Trump family’s crypto venture, World Liberty Financial, which has earned the Trumps at least $1.2 billion since 2024. World Liberty declined to comment.

Longstanding U.S. and international sanctions block Iran from the global financial system in an effort to fight terrorist financing and nuclear-arms development. The use of Binance accounts to move funds benefiting Iran has drawn renewed attention because of the current effort by the Trump administration to crack down on regime financing.

The Justice Department is now investigating Iran’s use of Binance to evade U.S. sanctions after the exchange’s 2023 guilty plea. In response to the Justice probe, Binance said it “categorically did not directly transact with any sanctioned entities,” describing the money flows through it as indirect.

In March, Treasury Department officials met with Binance executives, according to people familiar with the meeting. The officials raised concerns about the company’s compliance with the monitorship agreed to under its 2023 plea deal, including transactions involving Iran, the people said.

In 2023, federal prosecutors said Binance had “critically undermined” U.S. sanctions on Iran by allowing hundreds of millions of dollars worth of transactions from Iranian clients. Binance pledged to overhaul its financial-crime controls as part of the plea deal, and the flow of Iranian funds ebbed. But Iranian money soon came flooding back, according to Binance compliance reports and people familiar with the activity.

Binance’s internal investigators and foreign law-enforcement officials warned last year that Iranian-linked funds were still passing through the platform. In many cases, the accounts remained open for months even after internal alerts flagged their Iranian links and law-enforcement agencies sought information from Binance about the accounts’ transactions on suspicion of terrorism financing, the Binance reports show.

Treasury officials last week highlighted the risk of the IRGC’s use of crypto, warning the group has exploited gaps in crypto exchanges’ anti-terrorism financing controls and other programs.

Treasury, as part of the Trump administration’s “Economic Fury” operation against Iran, also warned in April that financial institutions “are on notice” and could face consequences if they facilitate money transfers on behalf of Iran. Treasury said it froze $344 million of Iranian-owned cryptocurrency held in digital wallets to target the country’s lifelines.

The U.S. sanctioned Zanjani, the Iranian who moved crypto through Binance, again in January—more than a decade after previously blacklisting him—along with a crypto firm he controlled, accusing him of funneling money to the IRGC. The sanctions didn’t mention Binance.

Based in Iran, Zanjani responded on social media that the sanctions indicate “the effectiveness of our economic activities.”

A spokesperson for Zanjani denied the U.S. allegations and told the Journal, “He has neither required nor relied upon any cryptocurrency exchange for the purpose of money laundering or sanction evasion.” The spokesperson didn’t respond to questions on the Binance accounts.

This spring, as the war with the U.S. intensified, Iranian authorities began asking tankers passing through the Strait of Hormuz to pay a toll in either crypto or Chinese yuan.

Iranians have used Binance accounts to trade foreign currency for cryptocurrency that could then be transferred on to Tehran crypto brokerages, according to foreign law-enforcement officials and researchers. The illegal flows can be camouflaged amid the vast size of Binance, which has trillions of dollars in monthly transactions worldwide.

Binance has served as a primary gateway for Iranian crypto funds since its launch in 2017, law enforcement and other researchers say. Accounts that could be opened without any ID made the exchange a haven for money launderers and sanctions evaders in its early years, they say. Iran’s largest crypto exchange, Nobitex, was blunt about it: Binance was “the best option” for Iranians to buy crypto since it “causes less problems for Iranian users,” Nobitex’s website said in 2020. Binance began mandatory ID verification in 2021.

Binance said around that time it had taken proactive steps to limit its exposure to the Iranian marketplace. Binance, in its comment this week, said it was false that the exchange currently was a primary gateway for Iranian crypto funds.

By 2023, Binance’s U.S. customers had made transactions worth over $898 million with Iranian users, violating sanctions, and Binance users also sent funds to digital wallets associated with an IRGC-affiliated cybercriminal group that was hacking American companies for ransom, according to U.S. authorities in the 2023 case against Binance.

As part of the plea deal, Binance agreed to operate under the oversight of two U.S. government-appointed monitors tasked with scrutinizing the exchange’s compliance with U.S. laws. Executives worried that oversight would slow growth and took steps to shield some of its operations from the monitors, former compliance employees said.

A Binance compliance director messaged colleagues just before the plea deal that they would now need the permission of top executives to obtain information on certain sensitive accounts, including so-called internal accounts that typically belonged to Binance entities, according to an internal message reviewed by the Journal. That meant Binance’s own compliance staff, who were responsible for reporting suspicious activity to the monitors, faced new hurdles to be able to review some of the exchange’s accounts.

About $1.2 billion of the funds that later moved to an Iranian network would flow through an account belonging to the Binance business partner labeled as internal, the Journal previously reported. Binance said at the time of the Journal’s article that this was a “standard measure to preserve investigative integrity, not to bypass controls,” and that the account was mislabeled as “internal” by a junior employee. Binance said the account had been identified, closed and reported to law enforcement.

After the plea deal, some Binance compliance directors also grew alarmed by company leaders’ requests to loosen anti-money-laundering controls for high-risk clients, and also what they viewed as a reluctance to remove Russian clients, despite a previous commitment to exit the sanctioned country, the former compliance employees said. Amid the frustrations, several compliance executives left Binance after mid-2024.

Zanjani—a former sheepskin trader who became one of Iran’s wealthiest men and most famous sanctions busters—ratcheted up activity on Binance through his crypto firm, Zedcex, in 2024, Binance compliance reports show.

The U.S. had first sanctioned Zanjani in 2013 for using a Malaysian bank to help the Iranian government move billions of dollars. Afterward, he told Iranian media outlets that his job was “antisanction operations” and cast himself as an “economic Basij soldier,” referring to the IRGC’s voluntary militia. He touted his profits, posing with Rolex watches, luxury cars and a private jet.

The sanction was lifted in 2016 as part of the U.S.-Iran nuclear deal that took effect that year.

Zedcex, registered to a central London office, presented itself on social media as a trading platform for crypto traders. In reality, Zedcex’s main client was the IRGC, according to Treasury and foreign law-enforcement officials.

Money from Iranian oil sales entered Zedcex through banks in Turkey, the foreign law-enforcement officials said. Zedcex’s corporate Binance account, registered to a Dubai subsidiary, then relayed funds to digital wallets associated with the IRGC, according to the Binance reports, which didn’t specify the value of those transfers. The account made about $830 million in total transactions, which included both deposits and withdrawals, in 2024 and ’25.

The crypto funds could then move to Iranian exchanges such as Nobitex, where the money could be converted into local rials. Or the crypto could be transferred to pay suppliers and buy weapons out of view of authorities, foreign law-enforcement officials said.

Binance’s systems detected that the Zedcex account was being accessed from Tehran in late 2024, which triggered an internal alert, a Binance compliance report shows. The account remained open for more than another year, triggering a dozen further internal alerts about its use by devices in Tehran, most recently in November 2025, the compliance report shows.

Zanjani’s sister and his romantic partner held at least three additional accounts on Binance, including one for a Dubai-based diamond vendor they managed, according to a Binance compliance report.

Experts in Iran’s use of crypto for terrorism financing say these accounts aren’t typically used as investment accounts, with multiple transactions in and out of various cryptocurrencies. Instead, they are mainly vehicles to transfer funds, with one incoming transaction and one outgoing transaction of an equivalent value, they say.

That assessment fits with the transactions in a separate account belonging to the director of Zedcex’s Dubai subsidiary, which made a total of $21 million in crypto transactions. A Binance compliance report showed that the amount deposited into the account was half that amount—$10 million from an IRGC-linked digital wallet between late 2023 and mid-2024, as well as almost $700,000 from Zedcex itself. That indicates the outgoing amount was equivalent, to result in the $21 million in total transactions. The director couldn’t be reached for comment.

The same devices accessed all five of these accounts, implying they formed part of the same Zedcex network, Binance’s investigators wrote in internal compliance reports filed this January and February.

The reports flagged the accounts’ connection to the 52-year-old Zanjani, noting he had been sanctioned for financing the IRGC. One report recommended the users be removed from Binance due to “the high-risk nature of these associations and the potential for sanctions evasion and terrorist financing.” It also recommended Binance report the users to authorities.

Zedcex also issued its own cryptocurrency, a dollar-based stablecoin called USDZ, which the company directed its customers to buy on Binance, according to Telegram messages viewed by the Journal. Binance’s website said USDZ wasn’t officially available on the main exchange but users could buy it on other exchanges and transfer the tokens to Binance, according to a screenshot of the site this month.

Treasury cited USDZ in its warning last week about the IRGC’s use of crypto, saying Iran had created its own stablecoins to move money outside the banking system, in violation of sanctions.

About $107 million in crypto moved over several steps from the Iranian central bank’s digital wallets to eventually reach Binance accounts in 2025, according to the analysis by the blockchain data firm.

The U.N. office representing Iran didn’t respond to requests for comment.

Another blockchain data firm, TRM Labs, which works with U.S. authorities and exchanges, including Binance, to trace crypto transactions, also identified transactions linking Iran’s central bank to Binance accounts but couldn’t trace any further movement, according to a nonpublic document and a person familiar with the matter. TRM approached Binance executives this January and asked if they would jointly investigate the funds and share findings with the U.S. to support sanctions, the sources said.

The companies, including TRM’s head of policy, Ari Redbord, and Binance’s chief compliance officer, Noah Perlman, discussed it, but Binance declined to participate, the document and the person said.

Write to Angus Berwick at angus.berwick@wsj.com, Patricia Kowsmann at patricia.kowsmann@wsj.com and Ben Foldy at ben.foldy@wsj.com