How a North Korean crypto heist, Iran’s central bank, and a Trump-linked stablecoin may all connect through Binance

Reports from the Wall Street Journal, New York Times, and Fortune allege that Binance maintained roughly 2,000 Iranian-linked accounts and allowed nearly $2 billion in transfers to flow to sanctioned entities despite internal warnings — and then fired the compliance staff who raised those concerns.

The WSJ and NYT specifically reported that $1.7 billion was transferred from Binance-registered Chinese clients to Iran-backed groups, including Yemen’s Houthi militants, through 2024 and 2025.

Hexa Whale and Blessed Trust: the Hong Kong accounts at the center of the Binance Iran probe

Two Hong Kong entities, Hexa Whale and Blessed Trust allegedly acted as intermediaries. Blessed Trust was a registered Binance vendor that repeatedly triggered internal compliance alerts. A Binance representative confirmed the exchange canceled both accounts in January around the time of accusations.

Blockchain evidence linking Iran, North Korea and USDT flows: Tanuki42’s January 2026 discovery

The story grows significantly darker when an anonymous blockchain investigator known as Tanuki42 has linked Iran’s $500 million USDT stash directly to North Korean Bybit hack proceeds.

The chain of evidence:

• Elliptic’s leaked documents revealed Iran’s central bank was moving $507 million in USDT through Nobitex, Iran’s largest crypto exchange.

• Inside those leaked letters were two key wallet addresses traced to Modex Co., a UAE dirham-to-USDT broker allegedly serving Iran’s central bank.
• Tanuki42 found that the same Modex-controlled wallet that sold USDT to Iran had also received $1.7 million in laundered proceeds from the $1.5 billion Bybit hack, attributed to North Korea’s Lazarus Group.

Tanuki42’s conclusion: “The same entity selling USDT to the Central Bank of Iran is also buying USDT from groups laundering on behalf of North Korea.”

Additional laundering mechanics uncovered:

• North Korean hackers allegedly created worthless tokens, converting them to jUSDT via the JustLend protocol on Tron to launder up to $24 million at a time.
• Nobitex itself was later hacked by a pro-Israeli group for $90 million, forcing Iran to scatter its USDT across multiple blockchains — creating the trail Tanuki42 followed.

The blockchain money trail: Elliptic leaks, Nobitex transfers and Modex Co. wallets):

North Korea (Lazarus / Bybit hack proceeds)
↓
Modex Co. (UAE-based USDT broker)
↓
Iran’s Central Bank (via Nobitex)
↓
Houthi militants / IRGC / Russian oil sales

Fired Binance investigators: internal whistleblowers and obstruction concerns

At least five internal Binance investigators, several with law enforcement backgrounds, were reportedly fired starting in late 2025 after escalating the Iran findings to top executives.

If accurate, this transforms a compliance failure into a potential obstruction narrative.

Senate investigation into Binance: Richard Blumenthal’s March 6 deadline and sanctions inquiry

Senator Richard Blumenthal (Ranking Member, Senate Subcommittee on Investigations) sent a formal letter to CEO Richard Teng, calling Binance a “repeat offender” and setting a March 6, 2026 deadline to produce:

• Records on Hexa Whale and Blessed Trust
• Internal compliance reports
• Iranian user activity documentation
• Use of Tether and USD1 by sanctioned entities
• Binance’s role in alleged illegal Iranian oil sales
• Details surrounding the investigator firings

Key quote:
“Instead of actually preventing illicit use, Binance has sought to evade accountability and influence the White House through lobbying and a financial partnership with World Liberty Financial.”

UAE investment in Binance and WLFI: Sheikh Tahnoon, USD1 stablecoin and Trump financial ties

Much of the financial narrative centers on Sheikh Tahnoon bin Zayed Al Nahyan — UAE national security adviser, brother of the UAE president, and controller of major sovereign wealth funds.

January 16, 2025 — Four days before Trump’s inauguration, Sheikh Tahnoon’s vehicle, Aryam Investment 1, acquired a 49% stake in World Liberty Financial (WLFI) for $500 million. Approximately $187 million reportedly went to Trump family entities.

March 2025 — Sheikh Tahnoon’s firm MGX announced a $2 billion investment in Binance, reportedly settled using USD1, WLFI’s stablecoin.

May 2025 — The U.S. greenlit UAE access to 500,000 advanced Nvidia AI chips, a deal the Biden administration had previously blocked over diversion concerns.

Structural relationship as described by critics:

Sheikh Tahnoon
├──► $500M → WLFI (49% stake) → $187M to Trump family
├──► $2B → Binance (settled in USD1)
│ ├──► Binance holds major USD1 reserves
│ ├──► Binance tied to alleged $2B Iran transfers
│ └──► CZ pardoned by Trump (Oct 2025)
└──► UAE receives 500K Nvidia AI chips (May 2025)

Senators Murphy, Khanna, Warren, and Reed have publicly questioned aspects of these transactions, with Representative Ro Khanna reportedly requesting documents related to potential Emoluments Clause concerns.

FBI agent firings and sanctions enforcement capacity: implications for DOJ and crypto investigations

During the same week the Senate Iran probe escalated:

• Approximately 10 FBI agents who worked on the Trump classified documents investigation were reportedly fired by FBI Director Kash Patel.
• Patel confirmed to Reuters that federal agents had subpoenaed his phone records during that investigation.
• Reports also indicate White House Chief of Staff Susie Wiles’ records were subpoenaed.
• No public evidence of wrongdoing by the fired agents was cited.
• The FBI Agents Association criticized the move, warning it could weaken the Bureau.

Why critics say this matters

The DOJ and FBI are the agencies that would normally investigate sanctions violations, pardon corruption allegations, and potential constitutional breaches. Critics argue that removing investigators during an active political and financial controversy could weaken enforcement capacity.

BINANCE & CZ’S RESPONSE

• CZ has described the reports as “paid FUD” from a disgruntled former employee.
• CEO Richard Teng called the WSJ article “defamatory,” demanded retraction, and threatened further action.

  

• Binance says sanctions exposure dropped approximately 97% between early 2024 and mid-2025.
• The company denies knowingly maintaining Iranian users.
• Binance confirmed it removed the flagged accounts after internal review.

Binance 2023 plea deal and DOJ compliance monitor: risk of federal agreement breach

In 2023, Binance pleaded guilty, paid $4.3 billion, and accepted a DOJ compliance monitor through 2027.

If the alleged transfers occurred during or after that agreement, the issue would not simply involve new violations — but a potential breach of an active federal plea deal.

Key dates in the Binance Iran investigation: Senate deadline, DOJ review and enforcement watch

The Binance–Iran–UAE mega-narrative: crypto sanctions, sovereign wealth and political power

A sanctioned nation (Iran) allegedly received laundered proceeds from a North Korean crypto heist, routed through a UAE broker and held on an exchange (Binance) that simultaneously received a $2 billion UAE investment paid in a stablecoin tied to a U.S. president’s family-linked business whose founder was later pardoned by that same president.

Internal investigators were reportedly fired. Senators are pressing for documents. Federal agents tied to related investigations have been dismissed.

Every thread, critics argue, converges within the same financial and political web.