A man with a 2016 federal conviction for sanctions violations and bank fraud moved $850 million through Binance accounts that compliance systems flagged multiple times.
Multiple times.
Babak Morteza Zanjani — newly designated by OFAC as the financial architect behind the Strait of Hormuz "insurance" scheme — should have been radioactive. His name should have triggered every watchlist in the industry. American courts convicted him nine years ago. And yet the money moved.
The flags existed. The transfers landed anyway.
I've built enough transaction monitoring pipelines to know one thing: flags don't fail on their own. Real people ignore them, disable them, or structure around them.
The US Treasury's Office of Foreign Assets Control designated Persian Gulf Marine Insurance Company, HormuzSafe Marine Services Authority, and Zanjani himself. The charge: operating a bitcoin-denominated "insurance" scheme for shipowners transiting the Strait of Hormuz, anchored by the Islamic Revolutionary Guard Corps. Shipowners pay premiums in crypto. The "coverage" is safe passage through one of the most strategically critical waterways on the planet. If they don't pay, the alternative is unpleasant.
The news cycle will frame this as "sanctions busting" or "crypto crime." I want to dig deeper because the data here tells a more uncomfortable story — one about centralized exchange compliance, the myth of crypto anonymity, and the gaping hole in traditional maritime insurance.
The Scheme: A Payment Rail Replacement
Let's get the technical assessment out of the way. This isn't a protocol story. There are no smart contracts, no governance tokens, no audits, no code to review. The "innovation" here is application-level: using Bitcoin as the payment channel for war-risk insurance in a conflict zone.
The structure is classic shadow-finance architecture:
- Persian Gulf Marine Insurance Company: the underwriting vehicle. Collects premiums, issues "policies" — essentially guarantees of safe passage coordinated with IRGC naval assets.
- HormuzSafe Marine Services Authority: the operational layer. Handles dispatch, claims adjudication, and coordination with patrol boats.
- Babak Morteza Zanjani: the money brain. An Iranian-Turkish financier with a 2016 conviction for sanctions violations and bank fraud in US federal court.
The payment flow is equally straightforward:
- Shipowner needs to transit the Strait of Hormuz during the 2026 conflict.
- Traditional marine insurers refuse war-risk coverage in the strait.
- Shipowner contacts intermediaries, agrees to pay a premium in Bitcoin or USDT.
- Funds convert into crypto, flow through intermediate wallets, and settle into accounts controlled by the IRGC network.
- The network executes a "safe passage" operation — or the shipowner faces the consequences.
The conflict timeline matters. The war began in February 2026. A memorandum of understanding was signed in June. Military strikes resumed on July 13. Ceasefire talks emerged in late July, then escalated again. By August, OFAC moved.
But here's what the enforcement announcement obscures: the scheme had been in preparation for months. The "insurance" book was being built while journalists debated whether the strait could be navigated at all. That's the mismatch to watch — enforcement lag. The US Treasury moves slow. The money moves fast.
From a pure technical lens, the design is simple. Too simple for the blockchain security industry to get excited about. The risks aren't in the code. They're in the chain.
The Money Trail: $850 Million Through a Compliance Sieve
Now let's talk about the numbers.
OFAC's announcement says Zanjani's network moved approximately $850 million through accounts at Binance. The accounts had been flagged multiple times by the exchange's compliance systems.
Eight hundred and fifty million dollars.
To put that in perspective: it's larger than the market cap of most DeFi tokens. It's roughly the annual GDP of a small country. And it flowed through accounts that someone, somewhere, had already identified as suspicious.
The question a forensic analyst asks isn't "why did the money move." It's "how did the money move without triggering a human response?"
There are three possible mechanisms, and none of them are comforting:
Mechanism One: Siloed Compliance Data. The flag was on one account. The network used a constellation of accounts, each below the threshold that would consolidate exposure. In traditional banking, this is called structuring. In crypto, it's trivially easy because a single operator can spin up dozens of wallets without meaningful friction.
Mechanism Two: Threshold Gaming. Automated systems trigger on size or velocity. But staged transfers across different time windows, paired with periodic sweeps into exchange addresses, keep individual transactions under the algorithmic radar. The data science here mimics distributed denial-of-service patterns; the volume is there, but the amplitude at any single moment stays low.
Mechanism Three: Human Discretion. The flags were visible. Someone with authority decided not to escalate, close the accounts, or freeze the funds. That could be negligence. It could be prioritization. It could be something worse.
I've spent years building ETL pipelines that track whale behavior, wash trading, and capital flows across Ethereum and Bitcoin. In my experience, the "flag was ignored" explanation is usually a combination of all three mechanisms. The compliance stack catches fragments, but if no one looks at the complete transaction graph, the fragments don't resolve into a picture.
And that's the systemic problem: exchange compliance teams don't have the mandate to investigate crime. They have the mandate to demonstrate due diligence. Those are two different things. The former would stop the $850 million. The latter produces a PowerPoint for the next enforcement negotiation.
The uncomfortable implication is that Binance's 2023 settlement with the Department of Justice — $4.3 billion in penalties and a monitoring regime — did not prevent this flow. Nine years after Zanjani's conviction, nearly three years after Binance's historic settlement, the funds still moved.
I'm not singling out Binance. Every centralized exchange with global reach has this problem. But Binance is the one that got caught. Twice. And this pattern says something structural about the industry's compliance approach.
The Anonymity Myth: Bitcoin Is a Public Ledger
The second layer of this story is the technical assumption that made the scheme seem viable in the first place: that Bitcoin is anonymous.
It isn't. It's pseudonymous. The distinction is everything.
When Zanjani's network used BTC to settle "insurance premiums," every transaction got recorded on a public ledger that anyone can read. The blockchain doesn't know the name "Babak Morteza Zanjani." But it knows the addresses. And once an address is linked to a person, every interaction with that address becomes visible.
This is where the analytics industry becomes the enforcement backbone:
- Address clustering: Exchange deposits link to IP addresses, device fingerprints, and KYC data.
- Timing correlation: Transactions in similar sizes at similar times reveal entity structure.
- Network analysis: The graph of wallet interactions shows hierarchies — who funds whom, who sweeps to whom.
- Counterparty linkage: Whoever converts those BTC to fiat becomes a pivot point for identification.
The analytics firms — Chainalysis, Elliptic, TRM Labs — have mapped massive portions of the Bitcoin transaction graph. Their databases already contain flagged addresses associated with Iranian entities. The OFAC designation means those flags just got stronger.
The operational security of the HormuzSafe network collapses the moment the funds touch a centralized exchange. KYC data, login logs, and device identifiers are all stored, queryable, and subject to subpoena. The scheme's "financial anonymity" was a hypothesis that did not survive contact with the exchange layer.
In the wild, data doesn't lie, and neither does a sanctioned wallet's transaction graph.
Where the Anonymity Argument Breaks
There's a deeper technical irony worth unpacking.
The scheme's operators likely believed they were using crypto's pseudonymity to hide from global financial surveillance. But in doing so, they substituted one surveillance system for another — and arguably a more total one.
In the traditional banking system, a wire transfer between correspondent banks has some opacity. Messages pass through SWIFT with limited public visibility. Regulators must subpoena records. Time zones and legal barriers create friction.
On the Bitcoin blockchain, every payment is visible to everyone forever. No subpoena required. The network itself is a real-time surveillance apparatus. The US government doesn't need to hack Iran's servers to see the insurance payments; it just needs to identify one address and let graph analysis do the rest.
I saw this pattern during my NFT research in 2021, when I built a scraping bot to monitor wallet clustering across 1,000 high-value transactions. The methodology that exposed wash trading in BAYC sales is the same methodology that exposes sanctions evasion in the Hormuz network: cluster analysis, timing patterns, and exchange deposit tracking.
The technology that empowers the user is the same technology that exposes the criminal. Bitcoin doesn't discriminate.
The Enforcement Reach: What Sanctions Actually Do
The designation of Persian Gulf Marine Insurance Company and HormuzSafe Marine Services Authority places them on the Specially Designated Nationals list. The immediate consequences:
- US persons and entities cannot transact with them.
- Any exchange with US exposure must freeze their assets.
- Foreign entities that deal with them face secondary sanctions risk.
- The US financial system — including crypto on-ramps — becomes off-limits.
And because Zanjani is designated as an individual, his accounts are frozen wherever US jurisdiction reaches. That includes major exchanges with US operations.
But here's the catch for enforcement: the actual insurance operation runs on IRGC patrol boats in the Strait of Hormuz. OFAC can't freeze a speedboat. The sanctions only work if they prevent the payment flows — and if the payment flows are in Bitcoin, the enforcement burden shifts to the exchange layer.
This is why the Binance connection matters so much. The US government can't stop Iran from building a Bitcoin wallet. But it can pressure the exchanges that convert Bitcoin into usable fiat currency. The sanctions economics are that simple: deny the cash-out, strangle the operation.
In the years I spent analyzing the LUNA depeg crisis in 2022, I watched liquidity drain from Anchor Protocol in real time. The mechanics were different, but the principle is the same: when the flow of funds changes, the economics change with it. Sanctions are a liquidity event, not a legal event.
The Real Story: The Marine Insurance Void
Let me pause on the part of this story that no one in crypto will analyze: the underlying economic driver.
The HormuzSafe scheme exists because traditional marine insurance cannot cover this risk. The International Group of P&I Clubs — the backbone of maritime third-party liability coverage — does not write war-risk policies in a contested strait protected by a sanctioned military force. War-risk underwriters in London, Bermuda, and elsewhere refuse to touch it. The exposure is unquantifiable. The counterparty is the IRGC.
So there's a coverage gap. Shipowners carrying oil through the strait face two options:
- Sail without insurance and bear the full risk of capture, damage, or destruction.
- Pay a parallel "protection" network that promises safe passage.
Option two is extortion. But it's extortion with a legitimate economic rationale: someone has to bear the risk, and the market has priced it at billions in war premiums. The IRGC just decided to capture that premium with an armed force.
Crypto enters the picture because the traditional payment infrastructure can't settle these transactions. The shipowner doesn't want the premium recorded in SWIFT messages that US regulators will eventually see. The IRGC doesn't want its revenue seized mid-wire. Bitcoin and stablecoins — accessible 24/7, cross-border, final in minutes — become the settlement layer of last resort.
The deeper irony is that this is a functioning market. The "HormuzSafe" network has a supply curve (IRGC protection capacity), a demand curve (shipowners who need transit), and a clearing mechanism (crypto). It's a textbook shadow market built on geopolitical friction.
The Contrarian Angle: Correlation, Not Causation
Now for the part that will annoy both sides of the crypto argument.
The mainstream framing will be: crypto facilitates sanctions evasion. The pro-crypto framing will be: Bitcoin works as apolitical money, proving its utility in extreme conditions.
Both takes are lazy misreadings of the data.
The Iranians didn't choose Bitcoin because Bitcoin is "freedom money." They chose it because it was the only remaining dollar-free settlement channel available after sanctions cut off the banking system. If they could use dollars through a compliant correspondent bank, they would. Every day of the year.
What this case actually demonstrates is the opposite of the "crypto is uncontrollable" thesis: US authorities identified the scheme, traced the principal operator, quantified the flow, and sanctioned every named entity with precision. The blockchain didn't protect the conspirators. It exposed them.
The crypto-anarchist dream runs aground on the same rock every time: the need to convert Bitcoin into fiat for real-world expenses. Insurance companies need to pay salaries, fund patrol boats, and buy fuel. Those operating expenses happen in local currencies. And converting crypto to local currency requires an exchange, an OTC desk, or a money service business — the exact choke points that sanctions enforcement is designed to squeeze.
But the contrarian story cuts both ways. The $850 million flow is also evidence of a deeper failure that regulators would rather not discuss: sanctions against a country that big, that strategically located, and that rich in oil don't work cleanly. They push risk into informal networks. They create underground markets. And they give state actors a powerful incentive to develop payment systems outside US jurisdiction — including crypto.
The yield didn't save DeFi in 2022, and compliance theater won't save exchanges from this exposure pattern. The structural question is whether the industry wants to be the enforcement arm of US foreign policy or the neutral settlement layer for global value transfer. That isn't a rhetorical question. There's no clean answer. But pretending the tension doesn't exist is how $850 million moves through flagged accounts.
What the Market Response Gets Wrong
Let me address the market narratives now.
The immediate reaction in crypto Twitter will be a mix of "See, Bitcoin is for criminals" and "See, Bitcoin is true Austrian money." The actual market impact will be closer to zero on both ends.
Look at the numbers: $850 million over potentially two years. Daily Bitcoin trading volume regularly exceeds $20 billion. The HormuzSafe flows are dust relative to global liquidity. No ETF rebalancing, no derivatives flow, no significant supply shock — this news doesn't move price.
What it does move is regulatory sentiment. And regulatory sentiment is a slow-moving tide that eventually touches everyone.
This designation adds another brick to the edifice of US crypto regulation. It will be cited in congressional hearings. It will appear in the next FinCEN rulemaking. It will lead to more sanctions screening requirements for exchanges. The actual insurance scheme is just the spark — the fire is the regulatory machinery it feeds.
And here's the twist: the regulatory response is likely to overshoot. OFAC designations of crypto addresses were once met with widespread exchange compliance. But the trend is moving toward requiring decentralized protocols to self-censor. If legislators get their way post-this-event, DeFi frontends will bear the same sanction screening burdens as centralized exchanges.
This is the classic cycle. A few actors abuse a technology. Regulators punish the entire category. The response profile is always worse than the violation.
Floor prices don't capture this kind of risk. No smart contract audit would surface it. This is infrastructure risk — the kind that comes from being a general-purpose settlement layer in a world with increasingly aggressive sanctions enforcement.
The Shipowner's Dilemma
There is one overlooked group in this story: the shipowners.
They are the ones actually paying the premiums. They face the hardest decision. If they don't pay the IRGC network, they risk capture, cargo loss, or worse. If they do pay, they knowingly transact with designated entities and become targets of US secondary sanctions.
Under US law, providing material support to a designated entity — even through a crypto payment — can trigger SDN listing. The shipping company's vessels could be detained. Its bank accounts frozen. Its crew subject to scrutiny. The secondary sanctions reach is that broad.
Based on my experience analyzing institutional behavior during the 2022 depeg crisis, I recognize this decision pattern. Institutions faced with asymmetric legal risk usually choose caution. In this case, the asymmetry is extreme. The cost of non-payment is potential loss of vessel. The cost of payment is potential loss of business access to the US market. For most legitimate shipping companies, the second cost dominates.
The practical implication: the HormuzSafe scheme can only grow if its customer base is limited to shadow-flagged operators, sanctions-immune entities, or desperate businesses with nothing to lose. That's a smaller total addressable market than the initial reports of "insurance premiums" suggest.
What Comes Next: The DEX Shift
The biggest regulatory blind spot in this case is what happens after the exchange layer is sealed.
If Binance and other centralized entities fully block Iran-linked accounts after this designation, the network's options narrow. It can't simply move to another CEX; US sanctions have long jurisdictional reach, and any major exchange with US market access will comply.
So where does the money go?
- Decentralized exchanges: Uniswap, dYdX, and similar protocols have no KYC layer. But they also have poor fiat on-ramps. The challenge isn't swapping — it's converting crypto to usable currency.
- Cross-chain bridges: Moving assets across Ethereum, BSC, and alternative networks adds hops, complicating tracking but increasing the attack surface for surveillance.
- Privacy coins: Monero, in theory, breaks blockchain analysis. But liquidity is thinner, and exchanges are increasingly delisting privacy assets for compliance reasons.
- OTC desks: Peer-to-peer settlement with cash used to be the default. It still exists, but at lower scale.
From a data perspective, the interesting result of sanctions enforcement is that it pushes illicit networks toward the most technically complex rails — which are also the least scalable and the most operationally fragile. Sanctions work not by making evasion impossible, but by making it inefficient and risky to the point where the cost of non-compliance exceeds the value of the scheme.
That's the model to watch. The HormuzSafe network might survive in diminished form. Or it might pivot to OTC cash markets. Either way, the $850 million Binance-era chapter is closing.
What to Watch: Five Signals
Here's my forward-looking signal dashboard, from most to least urgent.
Signal One: OFAC SDN list updates. The designation of Persian Gulf Marine Insurance and HormuzSafe Marine Services Authority is likely the first tranche. Follow-up designations will name subsidiary entities, individual facilitators, and possibly crypto addresses. When a crypto address gets added to the SDN list, every exchange operating in the US must freeze it within hours.
Signal Two: Binance's response. The $850 million claim is explosive. If Binance contests the numbers, that tells you one thing. If it acknowledges the flag failures and announces remediation, that tells you another. If the DOJ opens a new investigation into the exchange's sanctions compliance, the market positioning changes entirely.
Signal Three: Oil prices and the strait. The HormuzSafe scheme is a function of war risk. If the strait becomes fully closed to commercial traffic, the insurance scheme shifts from collecting premiums to collecting ransom — a different beast entirely. If the conflict de-escalates, the scheme loses relevance. Watch Brent crude. The macro tells will arrive through the oil market first.
Signal Four: On-chain analytics reports. With OFAC having published the identities, blockchain forensics firms will now compete to publish the most comprehensive tracing of the HormuzSafe network. Those reports will name addresses, cluster entities, and map the money flow. They're operational intelligence masquerading as marketing material, and they'll be the most transparent data source available.
Signal Five: Marine insurance policy innovation. The long-term resolution to this shadow insurance market isn't more sanctions. It's a legitimate war-risk product that covers strait transit. If Lloyd's or the P&I clubs develop a government-backed war-risk facility, the IRGC's market share collapses. If they don't, the shadow insurance racket grows.
Takeaway: The Ledger Remembers
A federal criminal moved $850 million through the most scrutinized crypto exchange in the world, nine years after his conviction, through accounts with active compliance flags.
That fact should embarrass the industry more than any regulatory fine. It demonstrates that compliance systems still cannot connect an account's pattern of behavior with publicly available criminal history.
The blockchain did its job. The transactions are permanent. The evidence is immutable. OFAC and its partner agencies will follow the money trail, write reports, and issue further sanctions. The analysis firms will map the network until it becomes the most thoroughly documented illicit finance case in the chain's history.
Babak Morteza Zanjani's wallet history tells the real story. And the story is not about Bitcoin's anonymity. It's about the gap between what compliance is supposed to do and what it actually achieves.
The Strait of Hormuz insurance book is open. The invoices are on the ledger. The records are permanent.
Follow the BTC. It always leads somewhere.