Key Takeaways
- • Binance internal investigators identified approximately $1 billion in cryptocurrency flowing through VIP accounts toward IRGC-linked entities between Hong Kong and Tehran, enabling sanctions circumvention through stablecoin transfers on the TRON blockchain.
- • Two primary accounts—Hexa (moved $500 million in tether) and Blessed Trust (bitumen/construction materials)—maintained VIP status at Binance despite incomplete documentation; internal communications linked Blessed Trust to a Binance executive referred to as "Rock" Davis.
- • US Treasury's Office of Foreign Assets Control (OFAC) sanctioned multiple crypto wallet addresses and froze $344 million in assets linked to the IRGC; the Justice Department launched investigations into Binance's facilitation of Iranian transactions totaling $7.8 billion, with the majority flowing through Binance's platform.
- • Binance terminated internal compliance staff who flagged the $1 billion suspicious activity corridor after founder Changpeng Zhao received a presidential pardon, effectively halting the internal investigation while accounts remained operational.
- • Iran's broader crypto operations span multiple platforms including UK-based exchanges and Zedcex (where IRGC-linked transactions represented 56–87% of platform volume), demonstrating systemic use of stablecoins for sanctions evasion funded by oil sales and military operations.
Summary
Between 2024 and mid-2026, Binance's internal investigation team uncovered a sophisticated sanctions evasion network moving nearly $1 billion in cryptocurrency to IRGC-linked financial intermediaries. The operation leveraged two VIP accounts—Hexa, a Hong Kong entity that transferred $500 million in tether stablecoin, and Blessed Trust, which claimed involvement in bitumen and construction materials trading. Both accounts were flagged internally for incomplete documentation, yet retained VIP status, which reduced trading fees and signaled institutional priority within Binance's operations.
The investigative findings revealed a shadow banking corridor connecting Hong Kong to Tehran that enabled Chinese companies to acquire Iranian oil while circumventing U.S. sanctions through layered cryptocurrency transactions. Internal Binance communications, including Telegram chats, directly linked Blessed Trust's representative to "Rock" Davis, a Binance executive, with VIP client managers confirming management awareness of the relationship. Investigators successfully traced the network architecture, mapped recipient wallet addresses designated by law enforcement as IRGC financial channels, and briefed senior leadership. However, after President Trump's pardon of Binance founder Changpeng Zhao—who had previously pleaded guilty to anti-money laundering violations and paid a $4.3 billion fine in November 2023—Binance dismantled its investigation team. The accounts remained open despite documented compliance violations.
Regulatory authorities responded with significant enforcement action. The U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned multiple cryptocurrency wallet addresses directly linked to the IRGC and froze $344 million in associated assets. The Justice Department opened investigations into Binance's broader facilitation of Iranian transactions, identifying $7.8 billion in flows, with the majority processed through Binance's platform. Additional OFAC action targeted a $600 million Iranian shadow banking network involved in laundering $100 million in oil proceeds for military purposes through front companies.
Iran's cryptocurrency operations extend beyond Binance across multiple platforms and blockchains. UK-based crypto exchanges conducted stablecoin transfers on the TRON blockchain, while TRM Labs identified approximately $1 billion in IRGC-linked transactions on the platform Zedcex, representing 56–87% of that exchange's trading volume. These operations reflect Iran's systematic reliance on stablecoins—particularly tether (USDT)—as the primary vehicle for circumventing sanctions, with proceeds derived from oil sales and military funding mechanisms.
The investigative findings revealed a shadow banking corridor connecting Hong Kong to Tehran that enabled Chinese companies to acquire Iranian oil while circumventing U.S. sanctions through layered cryptocurrency transactions. Internal Binance communications, including Telegram chats, directly linked Blessed Trust's representative to "Rock" Davis, a Binance executive, with VIP client managers confirming management awareness of the relationship. Investigators successfully traced the network architecture, mapped recipient wallet addresses designated by law enforcement as IRGC financial channels, and briefed senior leadership. However, after President Trump's pardon of Binance founder Changpeng Zhao—who had previously pleaded guilty to anti-money laundering violations and paid a $4.3 billion fine in November 2023—Binance dismantled its investigation team. The accounts remained open despite documented compliance violations.
Regulatory authorities responded with significant enforcement action. The U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned multiple cryptocurrency wallet addresses directly linked to the IRGC and froze $344 million in associated assets. The Justice Department opened investigations into Binance's broader facilitation of Iranian transactions, identifying $7.8 billion in flows, with the majority processed through Binance's platform. Additional OFAC action targeted a $600 million Iranian shadow banking network involved in laundering $100 million in oil proceeds for military purposes through front companies.
Iran's cryptocurrency operations extend beyond Binance across multiple platforms and blockchains. UK-based crypto exchanges conducted stablecoin transfers on the TRON blockchain, while TRM Labs identified approximately $1 billion in IRGC-linked transactions on the platform Zedcex, representing 56–87% of that exchange's trading volume. These operations reflect Iran's systematic reliance on stablecoins—particularly tether (USDT)—as the primary vehicle for circumventing sanctions, with proceeds derived from oil sales and military funding mechanisms.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.