Binance VIP File Puts Iran Flows Back on Regulators' Screen

A previously unreported internal Binance document lays out how an Iranian network treated as a high-value customer used the exchange to move money in defiance of Western sanctions, The Wall Street Journal reported on Oct. 9.

The Journal published the account under the title "How a Binance ‘High-Value Customer’ Established a Financial Lifeline for Iran" The Wall Street Journal. According to that reporting, the document details the mechanics of how the network routed funds through Binance against the wishes of Western governments. The paper describes the customer relationship in VIP terms, not as incidental retail flow.

That document is now the most recent data point in a sequence of disclosures that has widened over the past eight months. The prior anchor was a Justice Department account reported on Sept. 15. Prosecutors said several companies used Binance to relay payments for black-market Iranian oil bought by Chinese buyers as part of a scheme to finance Iran The Wall Street Journal. The structure alleged was not peer-to-peer trading in the colloquial sense. It was payments intermediation, with the exchange layer sitting between oil proceeds and onward transfer.

In that case, U.S. prosecutors put the value moved back to Iran at around $1.5 billion. The funds traveled through a series of interrelated digital wallets controlled by Binance customers. Clustering of that kind is familiar to blockchain analytics teams. Interrelated wallets, shared funding sources, synchronized peel chains and common destination exposure allow investigators to attribute nominally separate addresses to a single operator. The allegation here is that the cluster resolved to an Iran-directed repatriation flow.

Earlier reporting had already established two other tranches. In May, the Journal reported that a key Iran-regime financier conducted $850 million in transactions on Binance The Wall Street Journal. In February, it reported that Binance had dismantled an internal investigation into $1 billion moved to an Iran-backed terror network and had fired investigators who uncovered the flow The Wall Street Journal. The amounts are not directly additive. They refer to different customers, periods and alleged end-users. Together they describe persistent exposure rather than a single ledger entry.

The Justice Department is investigating Iran's use of Binance to evade U.S. sanctions, following the dismantling of that internal probe The Wall Street Journal. The timing matters for compliance liability. A criminal sanctions-evasion inquiry turns less on whether illicit deposits arrived, every large venue receives them, than on what the venue knew, when escalation occurred, and whether monitoring, investigation and suspicious activity reporting continued after internal flags.

Binance, for its part, has pointed to a reduction in sanctions-related exposure. The company stated that sanctions-related exposure as a share of total exchange volume fell 96.8% between January 2024 and July 2025 Binance. That metric is a ratio, not an absolute volume. It can decline because the numerator falls, because the denominator grows, or both. For risk officers, the relevant complements are absolute flagged value, time-to-detection, time-to-offboarding, and whether VIP or market-maker flows received enhanced due diligence commensurate with jurisdictional risk.

The broader context here is the collision between high-throughput crypto intermediation and oil-linked sanctions evasion. Iranian crude sold off-manifest to Chinese buyers creates a receivables problem. Dollar clearing is blocked. The workaround requires a non-correspondent settlement rail and a conversion point into usable currency. A deep, liquid spot and derivatives exchange with internal ledger transfers, rapid wallet turnover and OTC facilitation fits that requirement. The exchange does not need to touch the physical barrel. It only needs to settle the financial leg.

In my view, the VIP designation is the control point to watch. Tiered fee schedules, dedicated relationship coverage, higher API rate limits and elevated withdrawal thresholds are standard retention tools. Applied to a sanctions-adjacent network, those same tools compress execution costs and reduce friction at scale. The question for any venue is whether source-of-funds review, beneficial-ownership verification and adverse-media screening intensify as volume privileges increase, or whether commercial tiering outruns financial-crime tiering.

Looking at what this means for market infrastructure, the on-chain footprint cuts both ways. Interrelated wallets leave a durable graph. That aids post hoc attribution by prosecutors and chain-surveillance vendors. It does not equal real-time prevention. Prevention depends on deposit-risk scoring, exposure thresholds for direct and indirect sanctions nexus, and willingness to freeze and exit a fee-paying account. A 96.8% ratio decline is consistent with tightened screening. Whether it captures indirect exposure through nested accounts, sub-accounts and intermediaries that relayed oil proceeds will determine how regulators read the latest document alongside the $1.5 billion, $850 million and $1 billion figures already in the record.