Binance Faces Second US Probe Over Iran-Linked Crypto Billions
US federal prosecutors have opened a second investigation into Binance, the Dubai-headquartered crypto exchange, over whether it knowingly facilitated transactions tied to Iran in violation of US sanctions law. The Manhattan US Attorney's office and the Justice Department's Washington division are jointly leading the inquiry, adding institutional weight to an enforcement picture that has been building since early 2026. For accounting firms, auditors, and CFOs with any client exposure to Binance, the development is a compliance inflection point that demands immediate attention.
What the Second Probe Covers
The new investigation sits on top of an existing DOJ inquiry that began in March 2026, itself triggered by earlier reporting that two Chinese companies had allegedly traded billions of dollars of crypto on Binance as part of a coordinated plan to allow Iran to monetise its oil exports and sidestep US sanctions. The scale alleged is not trivial: US authorities claim the broader enterprise generated approximately $1.5 billion in crypto proceeds destined for Iran's military and nuclear programme.
The $61 Million USDT Forfeiture Action
Alongside the criminal investigations, the US government has moved to forfeit around $61 million in frozen USDT that prosecutors say formed part of Iran's oil-trading proceeds routed through Binance. USDT, as a dollar-pegged stablecoin, is particularly significant here because it preserves purchasing power without touching the traditional banking system, making it an attractive instrument for sanctions evasion at scale. The forfeiture action gives investigators a concrete asset trail to work with and signals that the government is prepared to pursue civil remedies in parallel with criminal charges.
Binance's Position
Binance has stated publicly that it does not tolerate sanctions violations, that it cooperates fully with law enforcement, and that it remains committed to identifying and shutting down bad actors on its platform. The exchange also filed a defamation lawsuit in March 2026 in response to some of the underlying reporting. Those positions notwithstanding, the simultaneous involvement of two separate federal prosecutorial offices indicates that investigators see enough substance to pursue the matter from multiple angles at once.
Why a Second Concurrent Investigation Matters
It is unusual for two separate arms of the DOJ to run parallel investigations into the same subject. When it happens, it typically signals either jurisdictional competition over a high-profile target, or a deliberate strategy to cover different legal theories, such as criminal sanctions violations under IEEPA alongside separate money-laundering or conspiracy charges. Either way, the practical effect for the exchange and its counterparties is heightened legal risk and a longer shadow of uncertainty.
The Escalating Pattern of Enforcement
This is not Binance's first encounter with US regulators. The exchange has previously reached significant settlements with US authorities over AML and sanctions compliance failures. A second major federal probe, involving Iran specifically, a country subject to some of the most comprehensive US sanctions regimes in existence, compounds that history and raises the question of whether Binance's remediation from its earlier settlement was sufficient. Accounting firms advising clients who use the exchange need to factor that open question into their risk assessments.
The pattern also fits a broader enforcement trend. As detailed in our coverage of the Manhattan US Attorney's earlier Binance sanctions probe, US prosecutors have been sharpening their focus on crypto platforms that serve as conduits for sanctioned jurisdictions. The OFAC action against BitBank for Iran's Bitcoin oil tolls shows that Binance is not an isolated target: the US government is pursuing the full chain of intermediaries that enable sanctioned oil revenues to flow through crypto markets.
AML and Sanctions Implications for Accounting Firms
When a major exchange faces concurrent federal investigations for sanctions evasion, the compliance obligations of firms that interact with that exchange change in real time. Here is where accounting practices and CFOs need to focus.
Counterparty Risk Reclassification
Any client whose digital assets are held on, or whose transactions flow through, a platform under active federal investigation for sanctions violations should be reclassified to an elevated risk tier. That is not a punitive judgement about the client: it is a straightforward application of risk-based AML principles. Elevated classification triggers enhanced due diligence, more frequent transaction monitoring, and clearer documentation of the rationale for retaining the relationship.
Transaction Traceability and Record-Keeping
Prosecutors building a sanctions-evasion case will ultimately focus on the transaction ledger: who sent what, to whom, when, and through which intermediary. For accounting firms, that means client records need to be complete and auditable to a standard that would survive a DOJ subpoena. Gaps in transaction history, undocumented wallet addresses, or unreconciled exchange balances are not just bookkeeping problems at this point: they are potential liability exposures. Digital asset accounting software that captures a full, timestamped, counterparty-attributed record of every trade and transfer is no longer a nice-to-have; it is the baseline expectation of any regulator or investigator who comes knocking.
Correspondent Banking Analogies
The legal framework most applicable here draws on correspondent banking doctrine. When a US financial institution maintains a relationship with a foreign bank that is processing transactions for sanctioned entities, the US institution can face secondary liability under IEEPA and the Bank Secrecy Act. The same logic is increasingly being applied to crypto exchanges that serve as the effective "correspondent" for fiat off-ramps. If a client's crypto accounting trail leads back through Binance to Iran-linked counterparties, the firm's own records become relevant to any downstream investigation.
Practical Steps for Firms Right Now
The existence of an active, dual-arm federal probe is a trigger event. The following steps are not speculative best practice: they are the minimum defensible response.
Audit Client Exchange Exposure
Pull a current inventory of which clients hold balances on Binance and the approximate size of those positions. Cross-reference against any flagged transaction patterns: large USDT movements, frequent transfers to unhosted wallets, or counterparties in high-risk jurisdictions. This does not require a forensic blockchain investigation at this stage, but it does require that your crypto bookkeeping software can generate the data quickly if regulators ask.
Review and Update Risk Assessments
If your firm's AML risk assessment was last updated before the first DOJ probe in March 2026, it needs refreshing now. The risk profile of Binance as a counterparty has materially changed. Document the updated assessment, the rationale, and any enhanced monitoring measures you are putting in place. That documentation is your first line of defence if your firm's own procedures are ever scrutinised.
Brief Client Contacts on Disclosure Risk
CFOs and finance directors at companies holding crypto on Binance need to understand that an active federal investigation can affect asset accessibility: exchanges facing enforcement action can see accounts frozen or assets restrained, sometimes with limited notice. If material amounts are at stake, that risk may need to be disclosed in financial statements or board reporting. Your digital asset accounting software should be able to generate the position data needed for any such disclosure on short notice.
Check OFAC Screening Protocols
The specific allegation at the heart of this probe is that Binance processed trades involving Iran-linked counterparties, meaning entities that should have been caught by OFAC screening. Firms should verify that their own OFAC screening tools are current, that the SDN list version in use is no more than a few days old, and that any automated flags are being reviewed by a qualified compliance officer rather than cleared by an algorithm alone.
What to Watch as the Investigation Develops
Federal investigations of this type tend to move through several observable stages. Prosecutors will likely seek records from Binance through grand jury subpoena, request cooperation from international partners where Binance's operational footprint overlaps with allied jurisdictions, and potentially approach former employees. Any of those steps can generate public reporting that shifts the risk picture further.
The forfeiture of the $61 million in USDT is already a concrete enforcement action, not a threat. If prosecutors succeed in establishing that these funds represented Iran-linked oil proceeds, it strengthens the evidentiary foundation for criminal charges. Watch for any superseding indictment, any guilty plea by a related entity, or any OFAC designation of Binance-linked individuals, all of which would escalate the compliance response required of firms maintaining Binance exposure.
Firms using crypto compliance reporting workflows should also watch for any FinCEN guidance or OFAC advisory that explicitly addresses exchange-level sanctions risk in the crypto context: such guidance has preceded more aggressive enforcement in previous cycles.
Accounting Treatment Considerations
Beyond AML, there is a pure accounting question that firms need to address for clients with significant Binance holdings. Under ASC 350-60 (the US GAAP intangible asset framework now applied to crypto assets held by corporate entities) and the equivalent IFRS treatments, assets held on an exchange under active federal investigation may carry impairment indicators. If there is a realistic possibility that access to those assets could be restricted as a consequence of the investigation, whether through a court-ordered freeze, a regulatory hold, or the exchange's own operational disruption, that possibility needs to be assessed against the relevant impairment or fair-value measurement criteria.
The practical implication: auditors reviewing year-end crypto positions need to ask explicitly whether any holdings are on platforms under active regulatory or law enforcement scrutiny, and document the client's response. That question should now be a standard item on the digital asset section of the audit checklist.
Frequently Asked Questions
Does the DOJ probe mean Binance clients' assets are at immediate risk?
Not automatically. An investigation is not a finding of liability, and exchanges generally continue to operate during federal probes. The risk is that if charges are brought and the court issues asset-restraint orders, client funds on the platform could become inaccessible temporarily. Firms should assess exposure proportionally and document that assessment.
Does holding assets on Binance make a firm liable for sanctions violations?
Not by itself. OFAC sanctions liability generally requires a nexus between the US person and the sanctioned party, either through a direct transaction or through constructive knowledge of the underlying violation. Passively holding assets on an exchange is not that nexus. The risk rises sharply if a firm's own transactions can be connected to Iran-linked counterparties through the exchange's order flow.
What records should our firm be retaining about client Binance activity?
At minimum: full transaction histories with timestamps and counterparty identifiers, wallet addresses used for deposits and withdrawals, any KYC documentation the exchange has provided, and records of OFAC screening performed at the time of onboarding. BSA record-keeping rules require a five-year retention period for most relevant records.
How does the $61 million USDT forfeiture affect stablecoin accounting for clients?
The forfeiture itself only directly affects the specific frozen wallets named in the government's action. For clients holding USDT on Binance generally, the accounting impact is indirect: it may constitute an impairment indicator under US GAAP or IFRS depending on the materiality of the holding and the assessed probability of access restrictions. Auditors should document their evaluation explicitly.
Should we be advising clients to move assets off Binance now?
That is ultimately a business decision for the client, and firms should be careful not to create the impression that they are providing investment or custodial advice outside their mandate. What firms can and should do is ensure clients have current, accurate information about the risk environment, document that they have done so, and flag any material exposure in relevant financial reporting. The decision to reallocate is the client's to make.
Source: Protos