They Found $1.7 Billion Going to Iran. Then They Got Fired."

"They Found $1.7 Billion Going to Iran. Then They Got Fired."

**Published: February 24, 2026**

You ever have one of those days at work where you do exactly what you're supposed to do—find a problem, flag it, try to fix it—and then you're the one who gets in trouble?

Imagine that, but instead of a messed-up spreadsheet, the problem you found was **$1.7 billion flowing to entities linked to terrorist groups**. And instead of a slap on the wrist, you got fired.

That's the story unfolding right now at Binance, the world's biggest cryptocurrency exchange. And depending on who you believe, it's either a massive cover-up or a bunch of disgruntled ex-employees spreading lies.

Let me walk you through what we know, what we don't know, and why this matters for regular people who don't even own crypto.

---

## The Short Version

**What happened:** A group of internal investigators at Binance found evidence that about **$1.7 billion** had moved from the exchange to entities in Iran, including some with links to terrorist groups . They reported it to their bosses.

**What happened next:** Within weeks, at least four of those investigators were fired or suspended . The company says it was for "violations of company protocol" related to handling client data .

**What Binance says now:** No sanctions violations actually happened. The employees weren't fired for raising concerns. And the company's compliance program is stronger than ever .

**Why it's complicated:** Binance has a history here. They pleaded guilty in 2023 to breaking anti-money-laundering laws and paid **$4.3 billion** in fines . Their founder, Changpeng Zhao ("CZ"), spent four months in federal prison last year . And just this month, President Trump pardoned him . Oh, and CZ was just spotted at a Trump family crypto event at Mar-a-Lago .

So yeah. It's a lot.

---

## The Allegations: What the Investigators Found

Let's start with the actual findings, because the numbers here are staggering.

According to **The New York Times**, which reviewed company records and other documents, here's what the internal investigators uncovered last year :

**Table 1: What Investigators Found at Binance**

| **Finding** | **Details** |

| :--- | :--- |

| Compromised Accounts | People in Iran had gained access to more than **1,500 accounts** on Binance |

| Total Flow | About **$1.7 billion** flowed from two Binance accounts to Iranian entities |

| Who Received It | Some of those Iranian entities had **links to terrorist groups** |

| The Source | One of the accounts sending money belonged to a **Binance vendor** |

Think about that for a second. This isn't some random user doing shady stuff. One of the accounts involved belonged to a company that Binance itself was doing business with.

The investigators flagged all of this. They went through proper channels. They did their jobs.

And then they got fired .

---

## The Timing: When This All Went Down

The timeline here matters, because it puts everything in context.

**Table 2: Timeline of Key Events**

| **Date** | **Event** |

| :--- | :--- |

| March 2024 – August 2025 | Investigators trace $1.7 billion in flows to Iranian entities  |

| Late 2025 | At least five compliance team members depart Binance  |

| November 2023 | Binance pleads guilty, agrees to $4.3 billion fine  |

| 2024 | CZ serves four months in federal prison  |

| February 2026 | Trump pardons CZ |

| February 2026 | CZ appears at Trump family crypto event at Mar-a-Lago  |

| February 13, 2026 | Fortune publishes initial report on firings  |

| February 23, 2026 | NYT publishes detailed investigation with $1.7 billion figure  |

See the pattern? The investigators found this stuff while the company was still under a microscope from its 2023 settlement. And now, with a new administration and a presidential pardon, the landscape looks very different.

---

## What Binance Says

Okay, now let's hear the other side. Because Binance is pushing back hard on all of this.

**Richard Teng**, Binance's Co-CEO, put out a statement that was pretty direct: "The record must be clear. No sanctions violations were found, no investigators were fired for raising concerns, and Binance continues to meet its regulatory commitments" .

The company says a full internal review, done with outside lawyers, found no evidence of sanctions breaches related to this activity .

So what about those fired employees? Binance says they weren't let go for whistleblowing. They were fired because an internal review found they had **"violated company data-protection and confidentiality guidelines"** .

In other words: they snooped where they shouldn't have, or mishandled sensitive information, and that's why they're gone. Not because of what they found.

Binance also published a detailed blog post on February 23 laying out their compliance numbers :

**Table 3: Binance's Compliance Stats (According to Binance)**

| **Metric** | **Number** |

| :--- | :--- |

| Compliance team size | 593 full-time + 978 contractors = ~1,500 total |

| Percentage of global staff in compliance | About 25% |

| Sanctions-related exposure (July 2025) | 0.009% of total volume |

| Reduction since January 2024 | 96.8% |

| Direct exposure to top Iranian exchanges (Jan 2026) | $110,000 (down from $4.19M) |

Their argument is pretty straightforward: look at all this money and people we've put into compliance. Look at how much we've reduced our exposure. The idea that we're covering up sanctions violations just doesn't fit with the data.

They also point out something that's actually pretty important: public blockchains let anyone send assets to exchange addresses without approval. So exchanges have to rely on monitoring *after* funds are received. You can't get risk to absolute zero .

---

## The $1 Billion vs. $1.7 Billion Confusion

Quick note on the numbers. You might see different figures floating around.

The initial Fortune report talked about **$1 billion** in USDT transactions routed through the Tron blockchain to Iran-linked entities between March 2024 and August 2025 .

The NYT investigation, which came out a week later, cited company records showing about **$1.7 billion** flowing from two Binance accounts to Iranian entities .

So which is it? Probably both, depending on what time period and what types of transactions you're counting. The Fortune report focused on USDT on Tron specifically. The NYT piece looked at broader flows. Neither number is small.

---

## The Political Angle: CZ, Trump, and Mar-a-Lago

Here's where this story gets even more interesting.

Just months after receiving that presidential pardon, **Changpeng Zhao (CZ)** showed up at Mar-a-Lago for a forum hosted by World Liberty Financial—the Trump family's crypto venture .

He was photographed there. He gave interviews. He talked about wanting to do "much more business in the US" .

CZ stepped down as Binance CEO in 2023 after pleading guilty, but he's still a majority shareholder of Binance.US . And now he's hanging out at the former president's club, talking about expansion plans.

**The obvious question:** Does any of this have anything to do with the timing of these investigations coming to light? Or the fact that the compliance team members were let go?

Binance says absolutely not. The employees were fired for cause, not for whistleblowing. The timing is coincidence.

But critics are raising eyebrows. As one Democratic lawmaker reportedly asked: what's the connection here?

CZ's response to all this? He told Bloomberg that he goes to dozens of events each year, and this was just another conference . "What's the issue for me to attend a conference?" he asked .

Fair point. But when you're a convicted felon who just got pardoned, and you're showing up at the pardoner's family business event, people are going to notice.

---

## What Crypto Twitter Is Saying

The crypto community, as always, has opinions.

Some users on X (formerly Twitter) are backing Binance hard. One person wrote: "In the application of Good Corporate Governance, responding in this way is ideal. We see that Binance has reached an excellent level of corporate maturity" .

Another added: "The gap between anonymous sources and actual audit results is getting wider every day. Good to see some firm pushback against the narrative" .

CZ himself reportedly called the Fortune report "paid FUD" (fear, uncertainty, and doubt) spread by unhappy former employees .

So there's a whole slice of the crypto world that sees this as ex-employees with axes to grind feeding stories to journalists who don't understand how compliance actually works.

That's one interpretation.

---

## The Other Side: What Former Investigators Say

But let's not dismiss the people who actually worked there.

The NYT report describes some of these investigators as having **law enforcement backgrounds in Europe and Asia**, with experience in financial crime and counter-terrorism financing .

These aren't kids straight out of college. These are professionals who spent careers tracking bad money.

One of the things they flagged: the accounts they traced weren't just random users. One belonged to a Binance vendor . So the money was moving through someone the company was actually doing business with.

Their argument, through the reporting, is that they did their jobs, found real problems, escalated them properly, and got pushed out for it.

Binance says that's not what happened. The terminations were for protocol violations, not whistleblowing.

Without seeing the internal personnel files, it's impossible to know who's telling the full truth.

---

## Why This Matters for Regular People

Okay, so why should you care about this if you don't own crypto and have never used Binance?

**Reason 1: Sanctions matter.** When the U.S. puts sanctions on Iran, it's not just political theater. It's meant to cut off funding to regimes that support terrorism. If crypto exchanges are letting billions slip through, that undermines the whole system.

**Reason 2: Whistleblowers matter.** Companies that fire people for raising red flags create a culture where nobody speaks up. And when nobody speaks up, problems get bigger.

**Reason 3: Political connections matter.** When a convicted felon gets pardoned and then shows up at the pardoner's family business events, it raises questions about whether justice is applied equally. That's not a left or right thing. That's a basic fairness thing.

**Reason 4: Your money might be in crypto someday.** Even if you're not in crypto now, more and more of the financial system is moving this direction. Understanding which players follow the rules and which don't matters for where you put your money.

---

## What Happens Next

A few things to watch:

**The monitors.** Binance is still under oversight from its 2023 settlement. External monitors are supposed to be keeping an eye on things . Their next report could be interesting.

**More reporting.** The NYT piece dropped on February 23. Other outlets are likely digging. There may be more to come.

**Regulatory response.** With a new administration in place, the regulatory landscape has shifted. But sanctions enforcement is one area where there's usually bipartisan agreement. We'll see if anyone in Washington picks this up.

**Binance's response.** The company has put out detailed numbers and pushback. They're not hiding. Whether that convinces anyone is another story.

---

## Frequently Asked Questions

**Q: Did Binance actually violate sanctions?**

A: Binance says no. An internal review with external lawyers found no violations . Investigators who worked there say they found evidence of $1.7 billion flowing to Iranian entities . Someone is wrong, but we don't have enough information to know who.

**Q: Were employees fired for raising concerns?**

A: Binance says no. They say the terminations were for violating company policies on data handling . The fired employees, through the reporting, say they were pushed out for doing their jobs.

**Q: How much money are we talking about?**

A: The Fortune report cited $1 billion in USDT on Tron . The NYT reported $1.7 billion in broader flows from two accounts . Both are huge numbers.

**Q: What's CZ's role now?**

A: He stepped down as CEO in 2023 but remains a majority shareholder of Binance.US . He lives in the UAE with his partner, who is now co-CEO of Binance .

**Q: Why was he at Mar-a-Lago?**

A: He attended a forum hosted by World Liberty Financial, the Trump family's crypto venture. He says it was just another conference .

**Q: Is Binance in trouble again?**

A: Not yet. No new enforcement actions have been announced. But the reporting has put them back in the spotlight at a sensitive time.

**Q: What about Binance.US?**

A: Binance.US is a separate entity with its own management. CZ emphasized his comments about US expansion were about Binance.US, not the global exchange .

**Q: Should I be worried if I use Binance?**

A: That's a personal decision. The exchange continues to operate. Billions in volume still flow through it every day. But these allegations, if true, suggest compliance problems persist.

---

## The Bottom Line

Here's what I keep coming back to.

Either a bunch of experienced financial crime investigators with law enforcement backgrounds are lying about what they found and why they left.

Or a company with a documented history of compliance failures is still having compliance failures and pushing out the people who find them.

Binance's numbers look good on paper. They've hired hundreds of compliance people. They've spent hundreds of millions. Their exposure numbers are way down .

But numbers on paper don't always match reality on the ground.

And the timing here—with a presidential pardon, a Mar-a-Lago appearance, and a new regulatory landscape—makes everything harder to parse.

The truth is probably somewhere in the middle. Maybe the investigators found something real, but also violated protocols in how they handled it. Maybe Binance has improved, but old habits die hard. Maybe CZ is just doing business in a new political environment, and this is all coincidence.

What we know for sure: $1.7 billion is a lot of money. Iran is a sanctioned country. And the people who flagged it aren't there anymore.

Everything else is still being sorted out.

---

*Got thoughts on this? Drop them in the comments. And if you're a current or former crypto compliance person, I'd love to hear your take—anonymously if you need it.*