In brief

• Leaked internal data suggest that Binance failed to prevent 13 suspicious accounts from operating after its November 2023 settlement with the U.S.
• The suspicious accounts have moved funds worth $144 million since November 2023, and $1.7 billion since 2021.
• The settlement established a five-year FinCEN monitorship of Binance, with monitors responsible for ensuring that the exchange complies with its new obligations.

Suspicious accounts continued to operate on Binance even after the world’s largest exchange agreed to stricter AML controls as part of a 2023 settlement with the U.S., according to a report in the Financial Times.

In November 2023, Binance settled with FinCEN and OFAC for sanctions violations and violations of the Bank Secrecy Act, agreeing to pay a total penalty of $4.368 billion.

The settlement also resulted not only in the resignation of then-CEO Changpeng Zhao, but also an agreement on Binance’s part to undertake a five-year FinCEN monitorship and introduce stricter compliance measures.

However, leaked internal files seen by the FT suggest that Binance failed to prevent suspicious accounts from transacting after November of 2023, with some such accounts moving eight- or nine-figure sums.

$144 million in suspicious transfers

The leaked internal data concern 13 suspicious accounts, which were involved in transactions worth a total of $1.7 billion since 2021, and worth $144 million since the November 2023 settlement.

This includes one account registered to a 25-year-old Venezuelan woman, who received just over $177 million in crypto in the two years following April 2022.

This account also changed its payment details 647 times between January 2023 and March 2024, including 496 separate accounts at banks throughout the Americas.

Another suspicious account was registered to a 30-year-old junior bank employee residing in Caracas, an account which received $93 million between 2022 and May of this year, and which transferred out a comparable amount in crypto.

One red flag associated with this particular account was that IP logs revealed it was accessed in Caracas at 3.56pm on February 24 of this year, and then in Japan at 1.30am the next day.

The 13 accounts assessed by the FT were registered in nations such as Venezuela, Brazil, Syria, Niger and China.

Between February 2022 and March 2023, all 13 of them received a total of $29 million in the USDT from accounts that were later frozen by Israel for links to terrorism financing.