Fired Binance Investigator Tells IRS the Exchange Ignored an Iran Probe, Is Subpoenaed by Grand Jury
Published November 10, 2026, 8:37 AM PKT. Based on Forbes reporting published November 9, 2026, as relayed by CoinLab, Finvestopia and PANews, with additional reporting from Unchained.
A former senior financial crime investigator at Binance told the U.S. Internal Revenue Service (IRS) in May 2026 that exchange management ignored calls to open an internal probe into roughly 2,000 accounts suspected of being used by people inside Iran, with about $1.2 billion in fund flows, Forbes reported on November 9. The investigator has now been subpoenaed to testify before a federal grand jury in Washington, D.C., turning a dispute the exchange has denied since February into a live federal criminal investigation.
The investigator was suspended along with colleagues after examining two accounts suspected of sending funds to Iran in violation of U.S. sanctions, and later left the company, according to Forbes. No charges have been filed against Binance or any individual in connection with the matter, and the exchange says it has not violated Iran sanctions.
Operation Loclock: the 2,000 accounts and $1.2 billion in flows
The internal inquiry was codenamed "Operation Loclock", according to Forbes, as relayed by PANews and ChainCatcher. The roughly 2,000 accounts at the center of the inquiry were suspected of being used by people inside Iran, and the flows under scrutiny totaled about $1.2 billion, Forbes reported. The investigator raised the matter with the IRS in May 2026, months after the internal dispute, and has since been subpoenaed to testify before the grand jury, according to the report.
For holders of Binance Coin ($BNB) and for Binance users, the development adds to regulatory risk around the world's largest crypto exchange, though the story as reported is one person's account against the exchange's denial, with no confirmed charges. Binance already operates under a $4.3 billion settlement with U.S. authorities reached in 2023, under which it admitted to anti-money-laundering and sanctions failures.
The February reports Binance denied
The broader story is not new. Reports that Binance pushed out investigators who examined flows to Iran surfaced in February 2026, when the exchange denied the claims. The Wall Street Journal and the New York Times reported at the time that internal investigators had identified about $1.7 billion in flows through two of the exchange's partners, Hexa Whale and Blessed Trust, to entities linked to Iran, including the Islamic Revolutionary Guard Corps. The reported transfers moved largely in Tether ($USDT), the dollar-pegged stablecoin.
The Wall Street Journal also reported that internal investigators had identified 2,000 accounts associated with Iranian entities on the exchange. Binance said it had "made no such determination", and in a March response it called the press reports "demonstrably false, unsupported by credible evidence, and defamatory in several material respects". Former chief executive Changpeng Zhao called the Fortune version of the report "self-contradictory" in a post on X. Binance said it investigated Hexa Whale and Blessed Trust after law enforcement requests, offboarding Hexa Whale in August 2025 and Blessed Trust in January 2026, and that to its knowledge no Binance account transacted directly with an Iran-based entity.
The Senate probe runs to a January 4 deadline
The Forbes report lands alongside a separate Senate inquiry that is also pressing Binance for records on the same Iran-linked activity. Senator Richard Blumenthal, the ranking Democrat on the Senate Permanent Subcommittee on Investigations and its incoming chair in January, wrote to Binance on February 24 and again on April 1, 2026, seeking records on Iran-linked money laundering through Hexa Whale and Blessed Trust and on alleged retaliation against compliance staff.
On November 5, Blumenthal gave Binance, Tether, World Liberty Financial and Fight Fight Fight LLC until January 4, 2027 to turn over documents voluntarily, with production to begin by November 30, according to Unchained. The letters say the subcommittee has run its inquiry for 18 months and that the companies have not produced any responsive records, and warn that missing the January date will leave the panel to consider alternative measures to obtain compliance. The letters do not themselves impose a subpoena.
What Binance says, and what has not been charged
Binance says it has not violated Iran sanctions. It argues the investigators were dismissed for breaching data privacy rules, that the account investigations were never closed, and that it will cooperate fully with law enforcement, according to Forbes as relayed by CoinLab. The exchange bars users residing in or located in Iran and requires identity verification for all customers, and says its compliance headcount now exceeds 1,500 people worldwide.
What is new in the November 9 report is the investigator's own account to the IRS and the grand jury subpoena, not a new finding of wrongdoing. A subpoena to testify is not a charge, and no charges have been filed. The next public markers are the grand jury testimony itself, which is secret under federal rules, and the Senate's January 4, 2027 records deadline, with production due to begin on November 30.
Sources
- Forbes, "Fired Binance Investigator Tells IRS Crypto Giant Ignored Calls For Iran Probe", published November 9, 2026 (primary source: former senior financial crime investigator told the IRS in May 2026 that Binance management ignored calls to open an internal probe into roughly 2,000 accounts suspected of being used by people inside Iran, with about $1.2 billion in fund flows; inquiry codenamed "Operation Loclock"; investigator suspended with colleagues after examining two accounts suspected of sending funds to Iran in violation of U.S. sanctions, later left the company; subpoenaed to testify before a federal grand jury in Washington, D.C.; Binance says it has not violated Iran sanctions)
- CoinLab, Ex-Binance investigator: management ignored 2,000 Iran-linked accounts, published November 9, 2026 (secondary reporting: full relay of the Forbes account, including the May 2026 IRS conversation, the "Operation Loclock" codename via PANews and ChainCatcher, the suspension and departure, the grand jury subpoena, and Binance's position that the investigators were dismissed for breaching data privacy rules, that the investigations were never closed, and that it will cooperate fully with law enforcement; no charges filed)
- Finvestopia, Fired Binance Investigator Tells IRS Crypto Giant Ignored Calls For Iran Probe, published November 9, 2026 (secondary reporting: corroborates the Forbes report and its November 9 publication)
- Unchained, With Probe Gavel in Reach, Blumenthal Warns Binance and Tether of 'Alternative Measures', published November 9, 2026 (secondary reporting: Blumenthal's November 5 letters to Binance, Tether, World Liberty Financial and Fight Fight Fight LLC; January 4, 2027 deadline for voluntary production, production to begin November 30; 18-month inquiry with no responsive records produced; Blumenthal set to chair the Senate Permanent Subcommittee on Investigations in January; February 24 and April 1 letters to Binance on Iran-linked money laundering through Hexa Whale and Blessed Trust and alleged retaliation against compliance staff)
- Binance, official response to Senator Blumenthal's February 24 inquiry, published March 6, 2026, as reported by BitRss and CryptoNewsZ (secondary reporting: Binance called the Wall Street Journal, New York Times and Fortune reports "demonstrably false, unsupported by credible evidence, and defamatory in several material respects"; said it investigated Hexa Whale and Blessed Trust after law enforcement tips, offboarding Hexa Whale in August 2025 and Blessed Trust in January 2026; said it "made no such determination" that 2,000 accounts were associated with Iranian entities; said to its knowledge no Binance account transacted directly with an Iran-based entity)
This article is news reporting and is not investment advice.
MABOnChain Daily Brief
The key crypto and markets stories in one short, plain-language email. Free. Unsubscribe any time.
Prefer chat? Join us on Telegram Watch on YouTube
Keep reading
Securitize to Acquire River One, Pushing Tokenization Into the $6 Trillion Asset-Backed Lending Market
Securitize Corp. (NYSE: SECZ) signed a definitive agreement to acquire River Credit Labs, known as River One, an institutional asset-backed financing platform that connects stablecoin capital with traditional lending, the tokenization firm announced on November 9, 2026 alongside third-quarter results showing revenue of $18.6 million, up 13% from a year earlier, and a $50 million share buyback authorization. The deal, with terms undisclosed and closing expected in the fourth quarter of 2026, moves Securitize beyond issuing and servicing tokenized assets into financing the assets behind them, targeting a $6 trillion global private asset-backed finance market that KKR estimates could reach $9.2 trillion by 2029.
MARA Sells 13,597 Bitcoin ($BTC) for $1.1 Billion to Repay Debt, Approves $500 Million Buyback
MARA Holdings sold 13,597 Bitcoin ($BTC) for about $1.1 billion after September 30, 2026, using $750 million to fully repay its Bitcoin-backed term loans and freeing 17,477 coins pledged as collateral, the miner disclosed with its third-quarter results on November 9. The board also approved a buyback of up to $500 million in stock, while quarterly revenue fell 35% to $164.2 million and net income rose to $632.1 million on an $885.3 million unrealized gain on its Bitcoin ($BTC) holdings.
Avalanche ($AVAX) Climbs 7% as $13 Million Unlock Lands, Defying a Falling Market
Avalanche ($AVAX) rose about 7% to $8.79 on November 9, 2026, the day after the Avalanche Foundation released 1,666,800 AVAX worth about $13 million in a scheduled quarterly vesting step, according to Coinranking and Tokenomist data. The gain came as Bitcoin ($BTC) and Ether ($ETH) fell, while the unlock amounts to under 0.4% of the roughly 446 million AVAX in circulation and about 25 million AVAX stays locked until the final vesting step in July 2030.
Ankr Ethereum Bridge Loses $303,000 in Five-Transaction Exploit After Attacker Reuses Old Optimism Deposit
Ankr's ($ANKR) Ethereum ($ETH) cross-chain bridge lost more than $303,000 on November 9, 2026 after an attacker reused a tiny Optimism ($OP) deposit that had already been redeemed, submitting five forged withdrawal receipts in three minutes, according to blockchain security firm Blockaid. SlowMist put the loss at about $304,500 and said the source of the unauthorized signatures is still under investigation, while the bridge's pause flag still showed false nearly 40 minutes after the withdrawals and Ankr had not responded.



