Internal Binance report details $850 million IRGC sanctions-evasion network

Zanjani network opened 21 accounts after exchange’s 2023 guilty plea

An 80-page internal Binance report prepared in April for the United Arab Emirates’ financial intelligence unit details how a network of 21 trading accounts moved $850 million on the world’s largest cryptocurrency exchange to help Iran’s Islamic Revolutionary Guard Corps evade U.S. sanctions, according to documents reviewed by the Wall Street Journal. The network was directed by Babak Zanjani, an Iranian financier the U.S. blacklisted in 2013 for helping Tehran move billions of dollars through a Malaysian bank.

The report identifies specific accounts, shell companies, and at least $67 million that flowed directly to IRGC-linked digital wallets, according to the Journal. The accounts operated in the open from Turkey and the United Arab Emirates.

Binance dubbed the first member of the network discovered by its investigators a “high-value customer” — a status that entitled him to lower fees and personalized service and that required internal investigators to obtain senior approvals to remove his accounts, according to internal records reviewed by the Journal. The customer was a 47-year-old Tajik man named Sukhrob Oimakhmadov, a longtime business associate of Zanjani who once managed an airline on his behalf in Tajikistan, the Journal reported.

Oimakhmadov was officially an employee of a Dubai-based diamond vendor called BZ Diamond run by Zanjani’s sister, the report said, citing a UAE residency card he used to open his Binance account. Starting in late 2023, Oimakhmadov’s Binance account received more than $10 million from digital wallets that Israel’s Defense Ministry later identified as belonging to the IRGC; he then relayed the funds to other IRGC-connected wallets, the report said.

Binance had previously investigated Oimakhmadov for “sanctions exposure” over transactions with an Iranian money exchange called Aban Tether, but kept him as a client “while applying a risk-based approach,” the report said, without specifying when that earlier investigation took place. After Israel identified the wallets in September 2025, Binance’s investigators asked Oimakhmadov to explain his transactions. He first said the money was for a daughter abroad, then said it was for “face-to-face” purchases of African diamonds, but produced no documents to support either explanation, the Journal reported. Binance said it blocked Oimakhmadov’s account in October 2025 and removed him in May 2026. Oimakhmadov did not respond to emails and messages seeking comment, the Journal reported.

The same device used to access Oimakhmadov’s account was also used to log in to a Binance account held by a UAE subsidiary of a crypto firm called Zedcex, which Oimakhmadov had opened in 2023 and managed, according to corporate records. Zedcex presented itself on social media as a trading platform for crypto enthusiasts operating from London, with a custom online interface that allowed Zedcex customers to log in to Binance from Zedcex’s website, according to the report. Between late 2024 and late 2025, Binance’s systems detected more than a dozen times that the Zedcex account was being accessed from Tehran, the internal records show. Binance investigators traced additional users linked to Zedcex and Oimakhmadov, including accounts held by Zanjani’s sister and his romantic partner, whose account was accessed from an iPhone that also logged into Zedcex’s systems, the Journal reported.

Swiss police requested information from Binance on Zedcex for a fraud case in March 2025; Binance received a Drug Enforcement Administration subpoena for the account in June on suspicion of money laundering; and the Federal Bureau of Investigation sought data related to the account in November, the Journal reported. Binance said it blocked the Zedcex account that month. The Zedcex account made almost $830 million in transactions, including $56 million in withdrawals to wallets that Israel’s Defense Ministry said belonged to the IRGC, the report said.

The Treasury Department sanctioned Zanjani and Zedcex in late January, citing their role in moving funds for the IRGC. Citing those measures, Binance investigators filed an “escalation document” to address “the urgent need for enhanced risk mitigation strategies at Binance,” the Journal reported.

Following the thread further, investigators found additional Zanjani-linked accounts connected to a Turkish firm called ZedPay. Based in an Istanbul office tower, the firm offered a mobile payment app for international payments that advertised its partnerships with Turkish banks, the report said. Israeli Defense Ministry officials said ZedPay helped convert Iranian oil sales into cryptocurrency transferable internationally outside the traditional banking system. Binance investigators characterized ZedPay as part of a “high-risk sanctions evasion network,” though the report did not disclose its transaction volumes. Treasury sanctioned ZedPay and its Iranian CEO, Mehdi Rezazadeh, who had a Turkish work permit and held a personal Binance account along with 10 of his employees and associates, in July, along with Oimakhmadov and Zanjani’s sister and romantic partner, the Journal reported. When the Journal contacted Rezazadeh on Telegram, a person identifying themselves as a former ZedPay employee said the company had closed down because of the sanctions and that Binance had also shuttered its account.

The investigators also identified an account held by a director at a Tehran oil-and-gas firm they suspected was a Zanjani relative, Mohamad Hoseinpour, who used Binance to create a range of cryptocurrencies that traded on Zedcex’s own platform and accumulated hundreds of millions of dollars in transactions, the report said. Treasury cited one of the tokens, called USDZ, in a May alert about how Iran was using crypto to circumvent sanctions; another was named NIOC, the same initials as the National Iranian Oil Company. “The user’s activities pose a significant risk to Binance’s compliance,” the investigators wrote.

Zanjani’s network established its presence on Binance after the exchange pleaded guilty in 2023 to U.S. anti-money-laundering violations and sanctions breaches, the Journal reported. Binance’s owner, Changpeng Zhao, spent four months in jail and resigned as chief executive; he was pardoned by President Trump last October. The Journal first reported in May that Iran had used Binance as a backdoor to evade U.S. sanctions, and a Journal article in February detailed how Binance investigators found $1.7 billion had passed through the exchange to an Iranian network.

Zanjani, once described as one of Iran’s richest men, has a complicated relationship with the Iranian government, the Journal reported. He turned to crypto to launder money Iran earns from selling oil, according to U.S. and Israeli authorities, setting up a cluster of trading and payment firms around the Middle East in 2023, with flashy websites and active social-media accounts, that purported to serve everyday users. In reality, the firms were likely “a cover up for sanctions evasions,” the Binance report said. He was sentenced to death in 2016 on corruption charges after the Iranian government turned on him. After a stint in a Tehran prison, Iran’s judiciary commuted his sentence about two years ago, and Zanjani returned to the Iranian government’s service as its “premier moneyman,” the Journal previously reported. At the time of his 2013 blacklisting, Zanjani said his job was “antisanction operations” for the IRGC. He did not respond to requests for comment for the Journal’s latest article. He has said on social media that U.S. sanctions against him indicate “the effectiveness of our economic activities,” and a spokesperson previously told the Journal that Zanjani “has neither required nor relied upon any cryptocurrency exchange for the purpose of money laundering or sanction evasion.”

A Binance spokesperson said the company identified the activity and took action “months ago,” adding: “All accounts with any connection to sanctions violations were blocked from transacting, which mitigated the platform risk, and were subsequently offboarded.” The spokesperson also said Binance continues to cooperate with law enforcement and that “any suggestion that total account trading volume equals funds that reached the IRGC is materially misleading.” Binance acknowledged “some historical workflow issues, including approval requirements and timing gaps between recommendations and final administrative steps” and said, “Where there were process delays, Binance has already taken action.”

A UAE official said the government is “firmly committed to combating money laundering, terrorist financing and all forms of illicit finance” and that safeguarding the integrity of its financial system “is a national priority,” according to the Journal. The official said UAE authorities require crypto-service providers to meet high compliance standards and comply with global standards. The Wall Street Journal reported the company had established a de facto base in the UAE — previously considered a haven for Iranian businesses — and that the country was cracking down on money links with Tehran after absorbing a barrage of missiles and drones in the war.