US exchanges appear to be transacting directly with OFAC-sanctioned Iranian exchanges months after the sanctions were imposed. This is a problem. Maybe not today, maybe not tomorrow but some day and from then on.
Public blockchain data appears to show Coinbase, Kraken and Robinhood routinely sending funds directly to OFAC-sanctioned exchanges. Binance's US entity appears to be doing the same.
Here we are going to provide some proof using public sources and discuss a little bit about what this likely means. This is not reporting – it is just commenting on public data and statements that are already out there.
Context
OFAC sanctioned Bitpin, Nobitex, Ramzinex and Wallex on June 2, 2026 . OFAC sanctioned Aban Tether on August 7, 2026 . That blocked US entities from transacting directly with any of those entities from the dates of those sanctions.
OFAC violations can be a bit subtle sometimes where a front company is used or other subterfuge employed to trick financial institutions into transacting with a sanctioned party. In those cases the general expectation is that the institution will report the problems whenever they are, eventually, uncovered. Or, if some third party identifies the problem, then procedures will get upgraded to block whatever tricks were employed from working again. To some extent these efforts can suffer from a focus on solving only the precise problem from last time rather than dealing with the root cause. And when a financial institution is tricked too many times with fairly similar tricks regulators will generally take more serious action.
But that is all about trickery. There are zero – as in none at all – wire transfers directly between US bank retail customers and OFAC sanctioned entities outside of a narrow set of special circumstances which involve complex approvals. You cannot go to a US bank website or app and enter an OFAC sanctioned entity as the recipient and make a transfer. That does not happen. Yes, obviously some violations occur over time. But these are relatively rare and do not take the shape of direct transfers to SWIFT codes or similar directly associated with OFAC sanctioned entities. All the basic no-tricks routes for transfers are blocked. We are not claiming every conceivable route is blocked. But the brain-dead "this absolutely should not work" stuff is in fact reliably blocked.
So it is worth exploring briefly what violations actually look like. A bit over a decade ago BNP got in trouble for OFAC violations. What BNP did was route payments through correspondent banks while hiding the ultimate beneficiary of the funds from their US branches. The entities in question were mostly Sudanese, though the case also covered Iran, Cuba and Burma. And what BNP did was, roughly, processing payment instructions involving sanctioned Sudanese entities with accounts at non-sanctioned banks and then setting up wire transfer instructions which pretended those banks were the destination for the funds rather than the sanctioned accountholders.
This may be confusing for you as an end user. But if you are a bank and you have a sanctioned accountholder at branch X with account number 123 then you can pretend a wire transfer is to account 123 at branch X with whatever accountholder you want. You can even pretend account 123 belongs to the bank itself and is for some kind of fee or something. This works because you are the bank and if you hide what is happening from your US branches this can go on for a long time. The subterfuge here was at least in part inside the bank. People inside BNP knew what was happening and they hid it from other people inside BNP. So it is not like it was difficult for the bank as a whole to figure it out. But it probably was difficult for anyone in the parts of the bank that wanted to properly enforce sanctions to figure out because their colleagues designed a process to stifle their blocking efforts from the inside. This was all admitted in the eventual settlement.
The classic case is a bank onboarding some shell company without really knowing the owners, or where the owners are a sham and the thing is controlled by a sanctioned party. That is going to be difficult for the bank to figure out in direct proportion to how hard the real owners are trying to hide. And whether or not the real owners paid off people inside the bank to help this. Two former TD Bank employees went to prison in a related money-laundering and fraud case. Again, all the information exists somewhere but it may not be available to compliance people that care (or are not paid off, as the case may be).
But what we are looking at here are direct transfers from US entities to OFAC sanctioned entities which are visible in public. This should be easy. This does not happen in traditional finance.
Violations
We can see what appear to be these violations on, for example, Arkham Intelligence:
You can get that information for free.
The first thing to notice is that these are relatively small but they are not minuscule. These are not wholesale transactions for millions of dollars at a time. But they are for real amounts – tens to hundreds of dollars – and there are a lot of them. The entire point of public blockchains with respect to compliance was supposed to be transparency and how transparency makes automation easier and cheaper. Blocking these transactions should be quick, cheap and easy.
Actually it is quick, cheap and easy. These entities are just not doing it. Maybe the first transfer was hard to catch. Or not. But software to use the above feed and block transactions now is not hard to build.
Are these likely to be major state-sponsored parties or somehow linked to Iranian government or military groups? Who knows. Probably those folks are not interested in sending $500 worth of BNB from Robinhood. But that is not the point. The point is that this technology is supposed to make blocking all of this so cheap and quick and easy that compliance becomes faster, better and cheaper than traditional finance. What we have here is definitely less compliant behavior than traditional finance. There are no US banks making routine, daily, transfers directly to OFAC sanctioned entities like this. Zero. None. This compliance is slower and worse. We cannot say whether it is cheaper or more expensive. We can only say that any cost above 0 is bad value for money because it does not work.
WTF
So what do we think is happening here? The simplest explanations are either total incompetence or indifference. While we do not think those are good explanations, we will give a brief explanation of what they mean to us. And then we will give our guess.
Incompetence. About a year ago the Central Bank of Ireland fined Coinbase Europe €21.5 million for serious transaction-monitoring failings. In the Central Bank's public statements on the matter we learned that Coinbase's transaction monitoring checked activity against a set of 21 rules, which the regulator calls scenarios, and that configuration problems left more than 30 million transactions without proper monitoring. The Central Bank described Coinbase Europe's oversight of its parent as ineffective and called Coinbase's delay in notifying it of the problem an aggravating feature (we wrote about it here ). It is certainly possible no rule was added for these entities and that Coinbase is not the only company with this sort of problem.
Indifference. There are unquestionably people in web3 that do not believe in the idea of sanctions. And there are some, admittedly fewer, who do not believe in following laws with which they disagree. It is possible that these companies have a sufficient number of executives with those views that these violations are due to intentional indifference to recent OFAC actions. We do not think this is the case, but it is possible. Given the ideological bent of many people in web3 and the size of these companies it is likely there are more than zero employees with these views at some or all of these companies. We are not saying those people can influence policy or let their personal views impact how they do their jobs. But it is certainly possible this is part of the problem.
Note that two of the four companies in this discussion are publicly traded and one wants to IPO. So it is exceptionally unlikely substantially all of senior management at those companies is interested in willfully violating OFAC sanctions. But stranger things have happened.
Benign neglect. It feels more likely what we are looking at is a situation where everyone has a vague aspiration to follow the law and respect OFAC sanctions but nobody feels particularly strongly about it. Again, look at the Coinbase Ireland issue. Why was Coinbase's EU transaction monitoring built on a set of 21 rules? That sounds like a company making the minimum effort they felt was credible rather than a company trying to be compliant.
The simplest answer here is that compliance is "taken seriously" in so far as nobody advocates for outright outlaw behavior. But then doing a better job at compliance never gets much priority. We have more detailed information about Coinbase than the other three companies because of the Irish problem so we are generalizing a little bit. But these are competitors and it is reasonable to expect they all have vaguely similar postures in this area.
Listing Addresses
And we can go one further than guessing this is a result of neglect. We can even guess what defenses will eventually be raised when these problems finally come to the fore. Sometimes OFAC lists specific addresses in sanctions. OFAC press releases can include specific blockchain addresses. OFAC even has a sanctions search engine that supports blockchain addresses. When OFAC lists an address explicitly our experience is that people take note and block it. Sometimes this is a bit slow . But slow measured in days, not months.
For the five Iranian exchanges discussed here, OFAC did not list addresses. And the resulting problem is twofold. First, this means service providers need to source addresses themselves. Maybe that is doable. Surely the four large exchanges discussed above have contracts with analytics companies and investigators and can get these addresses.
But these are OFAC sanctioned exchanges so there is a second problem. Investigators can provide exchange hot and cold wallet addresses. And maybe a handful of deposit addresses they themselves used. But adding a rule to your system to block an exchange hot wallet is useless because users do not send funds directly to hot or cold wallets. In addition to sourcing exchange wallet addresses themselves, compliance needs to run (or buy) some analytics to identify deposit addresses dynamically.
This is not complicated technology. But these are two steps that need to be done. Maybe if the internal system does not already support deposit address identification there are actually three steps. And if we want to be super pedantic about things and run our compliance as slowly as possible here is one possible list of the implementation steps needed:
- Identify providers of sanctioned exchange addresses
- Select a provider or providers
- Integrate that provider or providers
- Specify the deposit address identification algorithm
- Have internal developers build the deposit address identifier
- Test the system
- Iterate, run QA, etc
- Deploy this screening to production
If the goal is to drag this out and compliance has little by way of resources, this could take a long time. And if you are the compliance chief and you keep asking at every weekly meeting if the plan is still on track you may well feel safe even if progress is incredibly slow.
Obviously this is all absurd at a high level. There is nothing particularly complicated here and these companies all have access to plenty of resources to build these tools. But they are evidently not using such tools in production so...something strange is happening.
We expect when US lawmakers start to ask questions the industry is going to push back with claims the sanctions were not sufficiently precisely specified and that requiring all of this expensive and tricky development work is unfair.
In effect, we expect the industry to tell the government the transparency means government can go do all the extra work and just feed explicit lists of banned addresses to web3 companies. This turns many arguments in favor of web3 on their head of course. The idea is not to make it easier for governments to impose ever more discrete and explicit rules on entities. That is the literal opposite of increasing freedom. And someone would need to pay for the government to build out such tools. It would be pretty shocking if these exchanges were offering to fund that effort.
But there is no good explanation for what is happening here. And there is no good defense for these compliance failures. So if the companies involved are called to account they are going to try to find a way to blame somebody else. It will be interesting to see how that goes. Notably the entire traditional finance industry is used to spending huge amounts every year on these kinds of compliance efforts and has done so for decades. So their lobbyists and executives will make an awful lot of noise if anyone tries to shirk responsibility for what is happening here.