The most revealing detail in the latest reporting on Binance and an Iran-linked payment network is not the $850 million headline. It is the approval process investigators reportedly faced when they wanted to remove a valuable customer.
In an October 9 investigation, The Wall Street Journal described a Binance customer who received preferential service and lower fees while internal investigators were examining suspicious activity. The customer, identified as Sukhrob Oimakhmadov, was linked by the reporting to a cryptocurrency business associated with Babak Zanjani, an Iranian financier whom U.S. and Israeli authorities have connected to a sanctions-evasion network.
According to the Journal, red flags included transactions involving an Iranian money changer and an account repeatedly accessed from Tehran. U.S. and Swiss authorities also made inquiries. But the customer's high-value status meant internal investigators needed senior approval to remove him, the newspaper reported, citing Binance records.
That is a specific control-design problem. A risk team may be able to detect activity and still struggle to stop it if the authority to restrict a lucrative account is buried in a commercial escalation process.
What the $850 million actually describes
The scale of the network was reported before this latest account of its internal handling. An earlier Journal investigation described approximately $850 million in transactions over about two years, centered on an account associated with Zanjani's network. Subsequent accounts of the investigation describe 21 linked Binance accounts, while secondary reports cite at least $67 million sent to wallets identified by authorities as associated with Iran's Islamic Revolutionary Guard Corps.
These numbers answer different questions. The $850 million represents reported historical transaction activity; it is not a newly discovered pool of customer funds, an amount seized by authorities or a calculation of criminal proceeds. The smaller wallet-flow figure refers to particular attributed destinations and cannot automatically be applied to the network's entire turnover. The underlying internal report and full address-level reconciliation have not been independently reproduced here.
The new material is the account-management detail: the apparent tension between compliance alerts and a customer's privileged commercial status. Treating an old turnover figure as if it were a fresh October 9 transfer would obscure that development.
A customer tier should not determine the speed of a freeze
Premium accounts are common across financial markets. Large traders may have dedicated support, lower fees and additional service arrangements. Those benefits are not inherently suspicious. The trouble begins if a high-value designation changes how quickly compliance can impose restrictions once credible sanctions alerts emerge.
Consider two separate decisions. Whether a relationship should be permanently terminated may require careful investigation and senior review. Whether activity should be temporarily restricted while a sanctions alert is assessed is an immediate risk-control question. A system that treats both actions as part of the same slow approval process can expose an exchange to continued transfers during the investigation.
That distinction is an analytical lesson from the reported workflow, not proof that Binance deliberately enabled any particular illegal transaction. The record available publicly does not establish every account's beneficial owner, the precise legal jurisdiction of each transfer or what decision-makers knew at each moment.
The Journal says Binance blocked relevant accounts in late 2025 and removed the last of them by May 2026. Those closure dates matter. This is a report about historical controls and their effectiveness, not evidence that the named accounts were still actively trading on October 10. Binance has said it has strengthened sanctions compliance and cooperates with law enforcement; its account of the chronology should be assessed alongside the documents cited by reporters.
The strongest test for any exchange is whether sanctions alerts lead to timely, documented decisions regardless of the customer's revenue contribution. That requires clear authority for temporary holds, reliable linkage of related accounts, independent escalation and an audit trail showing when the platform first knew enough to act.
The Journal's reporting makes that governance problem concrete. The next important evidence would be a full account-level chronology or a formal regulator finding, not another repetition of the $850 million figure.
