Crypto Sanctions Evasion: New Wallets, Same Business

Crypto exchange sanctions evasion keeps prohibited trading open by concealing who is using the platform, where they are, or which sanctioned business controls the receiving wallet. An exchange can announce that it has excluded U.S. customers while helping valuable accounts stay. A designated operator can replace its wallet addresses while continuing the same business. If you work in screening, onboarding or exchange operations, you may know how the customer got through and who decided to let the trading continue.

The public blockchain shows only part of that business. In its Binance enforcement notice, the Office of Foreign Assets Control described customer funds held in pooled wallets visible on the blockchain. Binance tracked each customer’s balance in its own ledger. Trades between Binance customers happened inside that ledger and did not appear on the blockchain. The exchange could see the customers on both sides of a trade that an outside wallet trace could not show.

How Do Crypto Exchanges Evade Sanctions?

Keeping U.S. customers trading with users in Iran and changing a designated exchange’s operational wallets to avoid blocking are examples of crypto sanctions evasion. Binance admitted the first practice in its criminal case. The indictment against Garantex’s administrators alleged the second.

These cases put the sanctions problem inside ordinary exchange work: opening an account, matching an order, approving an exception and assigning a wallet. The Office of Foreign Assets Control’s virtual-currency guidance applies sanctions restrictions to virtual currency as well as conventional money.

Did Binance Admit Sanctions Violations?

Yes. In its November 2023 criminal guilty plea, Binance admitted anti-money laundering failures, unregistered money transmission and sanctions violations. The Justice Department’s account of the plea shows how keeping U.S. business became part of the sanctions violation.

Binance announced in 2019 that it would block U.S. customers and launched Binance.US. In the conduct admitted in its plea, Binance nevertheless kept valuable U.S. customers on its international platform. Executives planned to help VIP customers open accounts for offshore entities and transfer their holdings. Employees encouraged U.S. customers to supply information suggesting they were elsewhere.

The reason for keeping them was commercial. These customers supplied trading volume, revenue and the liquidity needed to match other customers’ trades. The announced boundary cut through business Binance wanted to retain. Exchanges that honored the restrictions had to turn that business away.

The admitted account also describes years of email-only onboarding, without comprehensive customer verification or systematic transaction monitoring. Binance never filed a suspicious activity report with the Financial Crimes Enforcement Network during the conduct described. Requiring identity information in August 2021 still left customers who had not supplied it trading until May 2022.

Binance knew that its matching engine would bring U.S. users together with users in sanctioned jurisdictions. In its plea, the company admitted willfully causing more than $898 million in trades between U.S. users and users ordinarily resident in Iran from January 2018 through May 2022.

Binance agreed to a $968,618,825 civil sanctions settlement with the Office of Foreign Assets Control over apparent violations involving U.S. users trading with users in sanctioned jurisdictions or blocked persons.

The agency’s civil account makes the management choices unusually clear. It described a compliance program undermined from inside the company and quoted its then chief compliance officer:

The same notice described an engineer repeatedly raising concerns about sanctioned-jurisdiction users who remained on the platform. It also described screening that let a user change an IP address through a VPN and resume access after failing customer screening. The warnings had reached operations. The customers were still there.

Garantex Allegedly Changed Wallets After Designation

Garantex allegedly changed its operational wallet addresses daily after designation to make transactions harder for U.S. exchanges to identify and block. The Justice Department’s March 2025 account of the criminal indictment describes the alleged redesign to keep dealing with U.S. businesses after sanctions.

Treasury designated Garantex on April 5, 2022. According to the criminal case described by the department, the technical administrator and other participants knew about the sanctions and continued transactions with U.S.-based entities. The alleged daily wallet changes were intended to induce U.S. businesses to transact with Garantex without recognizing it.

According to the criminal case, the technical administrator maintained critical infrastructure and reviewed and approved transactions. A co-founder served as chief commercial officer. Those roles connect the customer business to the systems that moved the money.

The indictment also alleged a revealing discrepancy in account records. When Russian law enforcement requested information about an account registered to the commercial officer, Garantex allegedly supplied incomplete information and said the account was unverified. According to the indictment, the exchange had already associated that account with the officer’s personal identifying documents. The alleged concealment concerned an identity already recorded inside the business.

The department said Garantex had processed at least $96 billion in cryptocurrency transactions since April 2019. Authorities also obtained earlier copies of the exchange’s servers, including customer and accounting databases. Those databases could connect a public transfer to the customer credited inside the exchange.

New Wallets, Same Beneficial Control

Sanctioned crypto counterparties can use new wallets while retaining the same beneficial control. Establishing that connection means joining the address to the account, the operator and the business behind it.

The Office of Foreign Assets Control’s guidance describes why an unlisted address can still matter. It may share a wallet with a listed address or have a transaction history connecting it to one. The agency recommends examining those connections and reviewing earlier transactions after a designation. For an insider, the useful question is what the exchange knew about that connection when it allowed the next transaction.

Wallet permissions can identify who could move value. Customer files and corporate ownership records can identify the person or business behind the account. Screening results and escalation messages show how the platform dealt with that information.

The Financial Crimes Enforcement Network’s wallet guidance explains why custody matters: a hosted-wallet provider controls customer funds. Binance’s custody of pooled funds put its internal account records at the center of the trading story.

Tornado Cash’s changed sanctions status is covered separately.

How Does Blocked Ownership Affect an Unlisted Counterparty?

A company owned at least 50% by people or businesses whose assets are blocked is also blocked, even if it is not named on the sanctions list. Under OFAC’s ownership guidance, their combined stakes count, including ownership through other companies.

We connect the company documents, customer identity and wallet permissions so that the sanctions question follows the actual relationship.

Does Customer Information Travel With Covered Crypto Transfers?

Yes. The Travel Rule requires customer information to accompany covered crypto transfers between financial institutions. That information can travel separately from the funds and need not appear on the public blockchain.

That gives an exchange another source of counterparty information alongside its own account records. What the sending institution supplied and what the receiving platform recorded can explain who stood behind the transfer.

US Location Exception Records Show Who Kept the Account Open

US location exception records show who allowed an account past crypto exchange sanctions controls. The login history, onboarding documents, customer communications and exception approval can show how a supposedly excluded customer kept trading.

The Office of Foreign Assets Control’s Binance notice describes management inviting exceptions for high-volume U.S. customers. A public policy could say the customer belonged on the U.S. platform while the commercial decision kept that customer on the international exchange. An onboarding employee, screening analyst or operations manager may have seen both sides of that decision.

The same evidence crosses departments. Engineers may know which restriction the system actually enforced. Compliance staff may hold the alert and the explanation for closing it. Customer teams may know what they were told to ask a valuable account to change. Audit findings and management messages can connect repeated exceptions to people who had authority to correct them.

Anti-Money Laundering: Opportunities for Improvement, a 2024 Wharton Initiative on Financial Policy and Regulation paper, argues that enforcement should focus on the gaps that attract evasion:

The paper uses Binance to question how much illicit financing earlier attention to exchange weaknesses could have prevented. For the employee who saw a restriction repeatedly bypassed, the valuable evidence may be the repeated decision to leave that particular opening in place.

Whistleblower Rewards Follow the Conduct

The Financial Crimes Enforcement Network’s whistleblower program covers sanctions violations. Whistleblowers whose information leads to a successful enforcement action with penalties exceeding $1 million can receive awards totaling 10% to 30% of the monetary penalties collected. We work through that route with you.

The False Claims Act has a separate reward system. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers.

You Know Why the Trading Continued

If you saw a location exception approved, a designated service change wallets or a customer’s identity concealed, speak with our whistleblower experts about the decisions behind those transactions. We connect the wallet trail to the account records and management choices to build your strongest crypto sanctions whistleblower case. We bring in crypto sanctions whistleblower lawyers who understand exchange operations and stay alongside you through the process.