Previously unreported document reveals how Iranian network used crypto exchange to move money
By Angus Berwick and Patricia Kowsmann
Binance dubbed him a "high-value customer," and he was making suspicious trades on the world's largest crypto exchange.
The first red flag was transactions with an Iranian money changer. Then U.S. and Swiss law-enforcement officials inquired with the exchange about one of the customer's accounts that had been repeatedly accessed from Tehran.
It turned out the high-value customer was the manager of a crypto firm run by Babak Zanjani, a longtime financier for Iran's regime who was directing a secret payment network for the powerful Islamic Revolutionary Guard Corps, according to U.S. and Israeli authorities.
Given the client's status, which entitled him to lower fees and personalized service, internal Binance investigators who looked into the accounts needed senior approvals to kick him out, internal records showed. Binance said it blocked the accounts in late 2025 and removed the last of his accounts in May this year.
The Wall Street Journal reported in May that Iran used Binance as a backdoor to evade America's financial sanctions. Zanjani spearheaded those efforts, using a network of accounts and shell companies to make $850 million in total transactions on Binance, mostly via his crypto firm's own corporate account.
A previously unreported Binance document, along with other internal records, reveal the nuts and bolts of how Zanjani's network used the exchange to move money against the wishes of Western governments.
They detail a tangle of 21 trading accounts owned by individuals and firms described by U.S. authorities and the Binance investigators as part of Zanjani's network, including a set of companies operating in the open in Turkey and the United Arab Emirates. At least $67 million flowed out of two of these accounts to digital wallets connected to the IRGC, the document said.
The 80-page report, viewed by the Journal, was prepared by Binance in April in response to a request from the U.A.E.'s financial intelligence unit.
Zanjani's network established its presence on the exchange after Binance pleaded guilty in 2023 to U.S. anti-money-laundering violations and sanctions breaches. Binance's owner, Changpeng Zhao, who spent four months in jail and resigned as chief executive, was pardoned by President Trump last October.
A Binance spokesperson said it identified this activity and took action months ago. "All accounts with any connection to sanctions violations were blocked from transacting, which mitigated the platform risk, and were subsequently offboarded."
"Binance continues to cooperate with law enforcement globally, and any suggestion that total account trading volume equals funds that reached the IRGC is materially misleading," the spokesperson added.
Binance has been addressing "some historical workflow issues, including approval requirements and timing gaps between recommendations and final administrative steps," the spokesperson said. "Where there were process delays, Binance has already taken action."
The April report was produced when Binance was under pressure over Iran links. A Journal article in February detailed how Binance investigators found $1.7 billion had passed through the exchange to an Iranian network.
The company had established a de facto base in the U.A.E., previously considered a haven for Iranian businesses. The country was cracking down on money links with Tehran after it absorbed a barrage of missiles and drones in the war.
A U.A.E. official said the government is "firmly committed to combating money laundering, terrorist financing and all forms of illicit finance. Safeguarding the integrity of its financial system is a national priority." U.A.E. authorities require that crypto-service providers meet a high level of compliance and comply with global standards, the official said.
Iran's money man
Zanjani holds legendary status in Iran, one of the country's richest men who has had a complicated relationship with power.
The U.S. blacklisted Zanjani in 2013 for helping the Iranian government move billions of dollars through a Malaysian bank. At the time, he said his job was "antisanction operations" for the IRGC, the military and economic force that dominates Iran.
He later ran afoul of the Iranian regime, which sentenced him to death in 2016 on corruption charges. After a stint in a Tehran prison, Iran's judiciary commuted his sentence two years ago, and Zanjani returned to the regime's service as their premier moneyman, the Journal previously reported.
He turned to crypto to launder money Iran earns from selling oil, according to U.S. and Israeli authorities, setting up a cluster of trading and payment firms around the Middle East in 2023, with flashy websites and active social-media accounts, that purported to serve everyday users.
In reality, they were likely "a cover up for sanctions evasions," the Binance report said.
Zanjani didn't respond to requests for comment. He has said on social media that the sanctions against him indicate "the effectiveness of our economic activities." A spokesperson for Zanjani also previously told the Journal that the financier "has neither required nor relied upon any cryptocurrency exchange for the purpose of money laundering or sanction evasion."
High-value customer
The first member of the network discovered by Binance's investigators was the high-value customer, a Tajik man named Sukhrob Oimakhmadov. He was a longtime business associate of Zanjani who once managed an airline on his behalf in Tajikistan.
The 47-year-old was officially an employee of a Dubai-based diamond vendor called BZ Diamond, according to the U.A.E. residency card he used to open his Binance account, the Binance report showed. The vendor was run by Zanjani's sister, and Zanjani had promoted it online.
Starting in late 2023, Oimakhmadov's Binance account had received more than $10 million from digital wallets later identified by Israel's Defense Ministry as belonging to the IRGC. Oimakhmadov then relayed the funds on to other IRGC-connected wallets, the report said.
Binance had previously investigated Oimakhmadov for "sanctions exposure" over his transactions with an Iranian money exchange called Aban Tether, but kept him as a client "while applying a risk-based approach," according to the report. The report didn't specify when that earlier investigation took place.
After Israel identified the wallets in September 2025, Binance's investigators asked Oimakhmadov for information on his transactions. He first responded that he was sending money to a daughter abroad, then that they were for "face-to-face" purchases of African diamonds. But he said he had no documents to show proof of the payments.
Binance said it blocked Oimakhmadov's account that October, and removed him this May. Oimakhmadov didn't respond to emails and messages seeking comment.
Zanjani's wider network
The Oimakhmadov account led investigators to another part of Zanjani's network. The same device used to access his account was used to log in to another Binance account held by a U.A.E. subsidiary of a crypto firm called Zedcex. Oimakhmadov had opened that Binance account in 2023 and managed the subsidiary, according to corporate records.
Zedcex presented itself on social media as a trading platform for crypto enthusiasts operating from London. Its Binance account held special status as a corporate client with a custom online interface that allowed Zedcex customers to log in to Binance from Zedcex's website.
Between late 2024 and late 2025, Binance's systems detected over a dozen times that the Zedcex account was being accessed from Tehran, according to the internal records.
The Binance investigators traced other users linked to Zedcex and Oimakhmadov. These included accounts held by Zanjani's sister, as well as his romantic partner, whose account was accessed from an iPhone that also logged into Zedcex's.
More red flags began popping up in March 2025 when Swiss police requested information from Binance on Zedcex for a fraud case. Binance received a subpoena that June from the Drug Enforcement Administration for the account on suspicion of money laundering. And the Federal Bureau of Investigation sought data related to the account last November. Binance said it blocked the Zedcex account that month.
Then the Treasury Department sanctioned Zanjani and Zedcex in late January for moving funds for the IRGC.
Citing the measures, the Binance investigators filed an "escalation document" to address "the urgent need for enhanced risk mitigation strategies at Binance."
In total, the Zedcex account had made almost $830 million in transactions, including $56 million in withdrawals to wallets that Israel's defense ministry said last September belonged to the IRGC, the Binance report showed.
Turkey connection
Following the thread from one account to the next, the Binance investigators found more Zanjani linked accounts connected to a Turkish firm called ZedPay. Based in an Istanbul office tower, ZedPay offered a mobile payment app for international payments that advertised its partnerships with Turkish banks.
Its role in the Zanjani network was to help convert Iranian oil sales into cryptocurrency, which could be transferred internationally outside the traditional banking system, Israeli Defense Ministry officials said.
ZedPay likely enabled sanctioned entities to swap between traditional currencies and crypto, placing it within a "high-risk sanctions evasion network," Binance's investigators wrote. The report didn't disclose ZedPay's transaction volumes.
ZedPay's Iranian CEO, Mehdi Rezazadeh, who had a Turkish work permit, held a personal Binance account, as did 10 of his employees and associates. He told a public chat group on the Telegram messaging platform that ZedPay and Zedcex were partners.