Exodus Movement: The Exchange Blocked Iran and Support Explained the Workaround

Exodus Movement agreed to pay $3,103,360 in an OFAC settlement over 254 apparent Iran sanctions violations involving customer support and VPN advice. According to the Office of Foreign Assets Control, customers told support staff they were in Iran, an exchange partner blocked their access, and staff explained how a VPN could get them around the restriction. For someone who works in support, product or compliance, the telling evidence is familiar: what a customer said, what management understood and what the next reply told the customer to do.

The agency announced the civil settlement on December 16, 2025. The case reaches into a part of the digital-asset business that a transaction history does not explain: the help desk’s advice about keeping an exchange connection working.

A Free Wallet With Revenue From Exchange Access

Exodus Wallet gave customers software to generate and securely store private keys and use them to send or receive digital assets. Exodus began offering the free wallet in July 2016.

As the Office of Foreign Assets Control’s detailed enforcement release explains, Exodus did not hold customers’ digital assets or itself process their exchange transactions. It contracted with third-party exchanges to make their services available through the wallet. During the period covered by the case, Exodus collected fees each time customers used the wallet to transact through those exchanges.

That business model puts customer support close to the revenue. A connection problem could stop a customer from reaching the exchange service through which Exodus earned fees. The support unit generally handled inquiries by email, addressing problems with the wallet and access to exchange partners. Recommending VPNs for privacy and security was part of its standard approach.

The Customer Accepted Terms That Support Did Not Enforce

From October 17, 2017 through January 4, 2019, the Office of Foreign Assets Control said Exodus supplied technical and support services to users who identified themselves as located in Iran. Some explicitly asked whether U.S. sanctions would affect their ability to use the wallet. Their location was in the conversation. The agency treated the support itself as an apparent sanctions violation, even though Exodus did not hold customers’ assets or process their exchanges.

Exodus’s Terms of Use prohibited access from embargoed countries, including Iran. Users had to accept those terms before using the wallet. The agency nevertheless said employees had not been adequately notified or trained about the sanctions provisions and, for a significant part of the period, the terms had no practical mechanism behind them to prevent use from sanctioned jurisdictions.

The same gap extended to support. According to the agency, Exodus lacked policies and controls that would stop staff from assisting those users. A customer could accept a prohibition on access from Iran, identify Iran in a support request and receive help continuing to use the service. The company had put the restriction in front of the customer without making it govern the employee’s reply.

What Are Examples of Sanctions Evasion?

The Office of Foreign Assets Control described the Exodus VPN recommendations as a way to evade an exchange’s location controls: staff explained a sanctions-related restriction and then helped customers obscure the location that triggered it.

In April 2018, the partner identified by the agency as Exchange A announced changes based on customers’ jurisdictions and began using IP information to block users in Iran. Exodus support then received an influx of requests from customers who could no longer transact through that exchange.

By May, management understood that the block likely reflected U.S. sanctions. On May 16, the chief executive explained that likely reason in response to an inquiry about affected customers. The agency said management shared that understanding internally with customer-service staff.

On May 20, a representative told a customer in Iran that the exchange restriction followed U.S. laws or regulations, then reported that other Iranian customers had continued using the exchange feature with a VPN.

The next example is even clearer. On May 23, a representative explained that trade sanctions between the United States and Iran were the reason for the restriction. The customer asked about VPNs. The following day, another representative replied:

The reply explained both the information the exchange received and how to conceal it. The agency said the VPN recommendations enabled customers to keep accessing Exchange A through Exodus Wallet by changing the IP address and obscuring their location. The exchange was trying to enforce U.S. sanctions. Its own partner’s support desk explained the way around the block.

Why OFAC Treated Twelve Instances Differently

The Office of Foreign Assets Control classified twelve instances as egregious because staff understood the restrictions and recommended steps that circumvented the exchanges’ controls. The agency set a base civil penalty of $4,532,400 for those instances and $242,000 for the other 242 apparent violations. The base amount for those twelve instances alone exceeded the eventual settlement.

The agency treated the VPN advice, broader awareness of sanctions, the chief executive’s communication and customers’ identification of Iran as aggravating factors. It also said the assistance undermined the exchange partners’ efforts to comply with U.S. law.

The agency credited Exodus’s cooperation and changes that included a standalone sanctions policy, automated screening and mandatory staff training.

Exodus agreed to invest $630,000 in additional sanctions controls as partial satisfaction of the settlement amount.

What the Support Records Can Show

Support conversations can connect a customer’s location to the company’s knowledge and its response. Here, the agency’s examples put the Iran location, the reason for the block and the proposed workaround in the same exchanges. The chief executive’s message added a separate view of what management understood.

For a support lead, the relevant history may be in tickets and instructions to staff. For an engineer, it may be the IP information passed to a partner or the behavior of a location block. For someone in compliance, it may be the distance between written terms, training and what staff actually did. We examine those connections with insiders because a public blockchain transaction cannot explain what a manager knew or why a representative recommended a workaround.

The Office of Foreign Assets Control’s discussion of this case called for screening location information available through IP addresses and customers’ own statements. It also identified management commitment, risk assessment, internal controls, testing and auditing, and training as essential parts of a sanctions program.

The Location Information Was Already There

Other digital-asset settlements with the Office of Foreign Assets Control show how available location information can fail to become an effective restriction. In the agency’s Bittrex account, customer addresses and IP data were available but were not adequately screened for sanctioned locations. Its BitPay account described a failure to use available buyer-location information for sanctions screening.

In BitGo’s non-custodial hot-wallet case, the agency described IP data collected for security that were not adequately used for sanctions screening. In Kraken’s Iran settlement, onboarding checks did not prevent later access from sanctioned jurisdictions.

Exodus adds a particularly direct account of human decisions to that pattern. In the agency’s description, staff received the location, understood the partner’s restriction and explained how to get around it. The customer’s message and the employee’s answer show something an automated screening log alone would miss.

Does FinCEN Have a Whistleblower Program?

Yes. The Exodus announcement points to the Financial Crimes Enforcement Network’s whistleblower incentive program for sanctions and Bank Secrecy Act violations. The agency says information leading to successful enforcement with monetary penalties exceeding $1,000,000 may qualify for an award. Under the anti-money laundering whistleblower law, which also covers sanctions, qualifying whistleblowers can collectively receive 10% to 30% of qualifying collected monetary sanctions.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. That is a separate program. For information about sanctions workarounds inside a digital-asset business, we assess the facts and the applicable whistleblower program with you.

You Know What the Customer Was Told

If you saw a sanctions block turned into a support workaround, speak with our whistleblower experts about that workaround. We connect the product behavior, customer communications and management decisions to build your sanctions whistleblower case, bring in sanctions whistleblower lawyers who understand digital-asset services, and stay beside you throughout.