US Treasury Cuts Crypto Exchange MEXC Off From the American Financial System Over $16 Billion in Alleged Illicit Flows

The United States Treasury has cut one of the world’s largest cryptocurrency exchanges off from the American financial system, accusing it of moving at least $16 billion in illicit money for sanctioned actors in Iran, North Korea and Russia over five years.

According to the Treasury Department, its Financial Crimes Enforcement Network, known as FinCEN, issued a final order on Friday, 6 November, that will bar American financial institutions from processing any transfer of funds to or from MEXC Global, a convertible virtual currency exchanger founded in 2018. The ban takes effect 30 days after the order is published in the Federal Register, a step that had not yet happened by Friday evening.

The action is part of Operation Economic Outcast, the Treasury’s sweeping campaign against the Iranian regime’s finances, and it is the largest single exchange cut-off the department has ordered in that campaign. According to the Treasury, MEXC handled more than $1 billion in transactions every day as of September 2026 and held about $5 billion in reserves, making it one of the 20 largest crypto exchanges in the world.

“Financial institutions cannot have it both ways: Either you support the Iranian regime, or you have access to the U.S. financial system,” Treasury Secretary Scott Bessent said in the department’s announcement, according to the Treasury. “Treasury will continue to sever the Iranian regime’s economic lifelines and thwart its desperate attempts to circumvent U.S. sanctions using digital assets.”

The order does not accuse MEXC of being an Iranian company. It accuses the exchange of being a willing conduit: a platform whose anti-money-laundering controls were so weak, according to FinCEN, that sanctioned governments, ransomware gangs and darknet markets could move money through it at industrial scale, even though the exchange’s own terms formally banned users from Iran and North Korea.

What the order does — and when it bites

FinCEN’s order, signed by FinCEN Deputy Director Jimmy L. Kirby, was issued under section 9714(a) of the Combating Russian Money Laundering Act, a law that lets the Treasury declare a foreign financial institution a “primary money laundering concern” in connection with Russian illicit finance and then sever its access to American banks.

According to the Treasury, the order prohibits covered American financial institutions — banks, money transmitters and other firms — from engaging in any transmittal of funds from or to MEXC Global, including transfers of convertible virtual currency. Wilful violations can bring civil or criminal penalties, according to the Treasury.

The order covers MEXC Global and its named affiliates operating outside the United States, including the Seychelles-incorporated MEXC Global Ltd and MX Global Ltd, Estonia’s MEXC Estonia OÜ, Switzerland’s GIDA Technology AG and the United Kingdom’s MXC Global Ltd, plus their successors, according to reporting on the order.

There is an important limit to what Friday’s action does. According to the Treasury, it is not an OFAC sanctions designation, and it does not rewrite banks’ existing duties under the Bank Secrecy Act, including the requirement to file suspicious activity reports, or under sanctions administered by the Office of Foreign Assets Control. It is a funds-transmittal ban: a wall between MEXC and the American banking system, rather than a freezing of the exchange’s own assets.

Timing also matters. The 30-day clock does not start until the order appears in the Federal Register, and as of Friday evening the Register’s public index showed no MEXC document, according to Bitcoin Magazine, which first reported the details of the order. That gives banks, counterparties and MEXC itself a short window to unwind ties — and gives the exchange time to seek an exemption, challenge the finding, or simply reroute its business away from American institutions.

That delay is deliberate. Earlier cut-offs under the same law, such as the one imposed on the exchange Bitzlato, followed the same pattern: a final order, a publication window, and then a hard stop on dollar flows. The difference here is scale. MEXC is far larger than Bitzlato ever was, and the dollar figure attached to it — at least $16 billion — is among the largest illicit-finance findings FinCEN has ever published against a single exchange.

The $16 billion case, strand by strand

Between May 2021 and May 2026, MEXC Global facilitated the movement of at least $16 billion in funds connected to sanctions evasion, cybercrime and other illicit activity, according to the Treasury. FinCEN’s order puts the identified total slightly higher, at $16.7 billion, according to detailed reporting on the order’s figures.

The categories in the order overlap — a single transfer can be counted under more than one heading — so they should not simply be added together. But the breakdown FinCEN published is unusually specific, and it is worth setting out in full, because it shows how one exchange became a meeting point for three different sanctions-evasion networks and the cybercrime economy at the same time.

The largest single strand is Russia. According to the Treasury, MEXC handled nearly $1.5 billion in transactions linked to Russian sanctions evasion over the five-year period, including $232 million in direct transactions with entities sanctioned by the United States, the European Union or the United Kingdom. That finding is the legal foundation of the order: it is what makes MEXC, in FinCEN’s words, a financial institution of “primary money laundering concern in connection with Russian illicit finance”.

The most striking detail in the Russian strand is how recent it is. According to the Treasury, MEXC was still processing transactions with the sanctioned Russian exchange Garantex and its successor, Grinex, as recently as June 2026 — more than four years after the Treasury’s Office of Foreign Assets Control first designated Garantex in April 2022. In other words, the exchange kept doing business with a platform that had been publicly sanctioned, publicly seized and publicly indicted, long after every one of those facts was on the record.

FinCEN also cites at least $26 million in transactions benefiting the A7 sanctions-evasion network, a Russia-based operation designated by OFAC, and almost $200 million in transactions connected to the A7A5 stablecoin, a store of value the A7 network uses to help its clients evade sanctions, according to the Treasury.

The Iranian strand is, by the order’s own figures, the largest country-specific exposure after Russia. According to the Treasury, MEXC sent or received approximately $1 billion in direct transactions with more than 40 identified Iranian crypto exchangers between May 2021 and May 2026, some of which are subject to American and international sanctions. In the same period, the exchange facilitated approximately $22 million in transactions for the Central Bank of Iran and the Islamic Revolutionary Guard Corps and its Qods Force — all of them sanctioned by the United States, the European Union, the United Kingdom or a combination of the three.

The North Korean strand is smaller in dollars but pointed in its detail. According to reporting on the order, FinCEN cites about $350,000 that MEXC handled for a designated North Korean money launderer, Sim Hyon Sop, between June and September 2025 — more than two years after he was designated.

And then there is the cybercrime strand. According to the order, at least $1.99 billion linked to illicit cyber actors passed through MEXC over the five years, covering ransomware and scam payments and Russian and other darknet market activity, according to the Treasury. That figure matters because it shows the exchange was not only a sanctions-evasion channel for governments. It was also, according to FinCEN, a piece of everyday infrastructure for the criminal economy: the place where ransomware proceeds and darknet takings were converted, moved and cashed out.

A platform that banned the very users it served

MEXC’s own defences, as described by the Treasury, make the findings harder to explain away. According to the Treasury, the platform claims to maintain anti-money-laundering and customer identification policies, and it explicitly prohibits use by or on behalf of people in certain jurisdictions, including Iran and North Korea. Yet severe deficiencies in those controls allowed it to facilitate transactions for people and entities in precisely those prohibited jurisdictions, according to the Treasury.

That contradiction — a ban on paper, a free-for-all in practice — is the heart of FinCEN’s case. The order does not rest on a handful of transactions that slipped through. It rests on five years of flows, measured in billions, involving named sanctioned entities, and continuing, in the case of Garantex and Grinex, into the middle of 2026.

The exchange’s corporate structure helps explain how that could happen. MEXC Global was founded in 2018 and was formerly branded MXC. It is incorporated in the Seychelles and, according to FinCEN’s order, operates without a virtual asset service provider licence there. It offers trading in more than 50 currencies and access to more than 3,000 cryptocurrencies and tokenised assets, according to the Treasury, and claims users in more than 170 countries.

Regulators in several countries had already been circling. According to Bitcoin Magazine, the United Kingdom’s Financial Conduct Authority put MEXC Global Ltd on its warning list in March 2024 as an unauthorised firm, and Hong Kong’s Securities and Futures Commission warned in the same month that the platform was marketing to local investors without a licence. In May 2026, Seychelles’ Financial Services Authority said it had taken action against MX Global Ltd for unlicensed virtual-asset operations — a fact footnoted in FinCEN’s order.

As of Friday evening, MEXC had not issued a public response to the order, according to Bitcoin Magazine, and its main social media account kept posting marketing content through the afternoon. That silence is itself a data point. An exchange facing a cut-off from the world’s largest financial system would normally rush to reassure its users. MEXC, so far, has not.

The same-day Canadian designations

Friday’s FinCEN order was not the Treasury’s only move of the day. In a coordinated action, OFAC designated eight money services businesses based in Canada that it says enable the Iranian regime, sanctioned entities associated with the regime, and other illicit actors moving assets into and out of Iran, according to the Treasury.

The eight firms — Million Exchange, 1380079 BC Limited, Top PC Technician Inc, NIA Nations, Farah Exchange, CCC Inc, B Galaxy Inc and Darvish Exchange — facilitate the exchange of Iranian rials and other currencies for digital assets to enable international transactions involving Iran, according to the Treasury. One of them, Darvish Exchange, is an Ontario-based business that advertises the ability to exchange Bitcoin for Iranian rials, according to the Treasury, and a digital asset address associated with it has transacted with sanctioned Iranian exchanges including Nobitex, Wallex, Aban Tether Exchange and Shelbit.

The designations were imposed under Executive Order 13902, which targets Iran’s digital asset sector among other sectors of its economy, according to the Treasury, and the action was coordinated with FinCEN and with FINTRAC, Canada’s financial intelligence unit.

Taken together, the two Friday actions show the two halves of the Treasury’s current strategy. The MEXC order attacks the big, global, offshore exchange that moves the money. The Canadian designations attack the small, local, storefront-level businesses that convert rials into crypto in the first place. One without the other would leave the pipeline half open.

Operation Economic Outcast: the campaign behind the order

To understand why MEXC was cut off now, it helps to understand the campaign it was cut off under. Operation Economic Outcast was announced by Secretary Bessent on 24 August 2026 and dubbed “Economic D-Day”, according to the Treasury. It is a whole-of-government economic campaign against the Islamic Republic of Iran and its enablers, aimed at severing what the Treasury calls the regime’s remaining economic lifelines.

According to the Treasury, the campaign began with four coordinated moves: determinations bringing five sectors of the Iranian economy — digital assets, technology, gold, aviation and shipping — within the reach of secondary sanctions; the designation of nearly 60 entities, individuals and vessels; the suspension of general licences that had authorised certain remittance payments to Iran and Iranian access to the American cultural and academic system; and new guidance on the sanctions risks of acceding to Iranian demands over shipping through the Strait of Hormuz.

The crypto strand of the campaign has moved quickly since then. According to the Treasury, OFAC designated the Iranian exchanges Nobitex, Wallex, Bitpin and Ramzinex on 2 June 2026, and Aban Tether Exchange and Shelbit on 7 August 2026. On 17 September 2026, OFAC designated BitBank, a digital assets venture controlled by the Iranian financier Babak Zanjani, which the Treasury says was used to transfer hundreds of millions of dollars in Bitcoin to the Revolutionary Guards. In October, the Treasury sanctioned the International Development Bank for Investment and Finance in Iraq and several Iranian offshore banks, according to reporting on the campaign, and by late October Bessent was saying publicly that the United States would “probably” seize about $1 billion in Iran-linked crypto that week.

The campaign has also relied on private-sector cooperation. According to reporting on the effort, Tether, the issuer of the USDT stablecoin, has frozen approximately $550 million in USDT linked to Iranian addresses, mostly over the course of 2026. FinCEN has also pointed potential informants toward its whistleblower incentive programme, under which people who provide information about sanctions violations may be eligible for awards if their information leads to an enforcement action resulting in monetary penalties above $1 million, according to the Treasury.

The MEXC order is the largest single step in that campaign so far — not because MEXC is Iranian, but because it is the biggest pipe the Treasury has found carrying Iranian money. And it lands against the backdrop of the wider United States-Iran confrontation: a war that began in February 2026, the closure of the Strait of Hormuz, and an American blockade of Iranian ports. In that context, cutting off a $1-billion-a-day exchange is not a regulatory footnote. It is an economic operation in a live conflict.

The Garantex precedent: why this time may be different

The most instructive comparison for MEXC is Garantex, the Moscow-linked exchange that MEXC was still dealing with in June 2026. Garantex was founded in late 2019, originally registered in Estonia, and conducted most of its operations from Moscow and Saint Petersburg, according to the Treasury. It lost its Estonian licence in February 2022 after the country’s financial intelligence unit found critical anti-money-laundering deficiencies and links to criminal wallets. OFAC designated it on 5 April 2022 for facilitating ransomware actors and other cybercriminals.

And yet Garantex kept operating for almost three more years. It shifted its operating wallets to new addresses every day so that American exchanges could not spot and block it, according to the Justice Department. It was added to the European Union’s 16th sanctions package on 24 February 2025. Only on 6 March 2025 did the end come: Tether blocked wallets holding more than 2.5 billion roubles, about $27 million to $28 million, and Garantex suspended all services. On 6 and 7 March, the United States Secret Service seized its domains and froze more than $26 million in cryptocurrency, while German and Finnish law enforcement took its servers offline, according to the Justice Department. The Justice Department unsealed indictments against its executives, Aleksej Besciokov and Aleksandr Mira Serda, and Besciokov was later arrested in India.

According to the Justice Department, Garantex had processed at least $96 billion in cryptocurrency transactions since 2019. Within weeks of the takedown, it had moved its customer base and funds to a successor exchange, Grinex, in an attempt to keep operating despite the sanctions and law enforcement action, according to the Treasury. OFAC designated Grinex in August 2025, and re-designated Garantex itself under its cyber authorities.

The Garantex story is a warning in both directions. It shows that even a sanctioned, seized and indicted exchange can be replaced within weeks by a successor with the same customers and the same money. But it also shows that the American enforcement machine, once it decides to act, can dismantle an exchange that processed nearly $100 billion. The question for MEXC is which half of that lesson applies.

There are reasons to think MEXC’s position is worse than Garantex’s was. Garantex was a Russian domestic exchange with a narrow customer base and no pretence of compliance. MEXC is a top-20 global exchange with $5 billion in reserves, users in more than 170 countries, and a public claim to have anti-money-laundering controls. The gap between that claim and FinCEN’s findings is precisely what makes the order so damaging: it is not only a legal problem, it is a credibility problem with every bank, payment processor and counterparty that still touches MEXC.

There are also reasons to think the effect will be slower. Unlike Garantex, MEXC has not had its domains seized or its executives indicted. The order gives it 30 days after Federal Register publication before the ban takes effect, and FinCEN reserves the right to attach conditions or grant exemptions later. The exchange already lists the United States as a prohibited jurisdiction in its user terms, according to Bitcoin Magazine, so Friday’s action mainly hits the remaining dollar rails, banking partners and counterparties that still touch American institutions — real damage, but not an instant shutdown.

Analysis: Why It Matters

The Treasury is now treating crypto exchanges as financial infrastructure, not tech companies

The most important thing about Friday’s order is not the $16 billion figure, impressive as it is. It is the legal theory behind it. By using section 9714(a) of the Combating Russian Money Laundering Act — a law written for banks — against a crypto exchange, the Treasury is saying plainly that a platform moving $1 billion a day is a financial institution, with a financial institution’s obligations, whether or not it holds a banking licence anywhere.

That matters because it closes the argument the crypto industry has made for a decade: that exchanges are technology platforms, not banks, and should be judged by a different standard. FinCEN’s order judges MEXC by the banking standard and finds it wanting. If that theory holds — and the Bitzlato precedent suggests it will — every large offshore exchange now has to ask itself whether its own anti-money-laundering controls would survive the same five-year forensic examination. Most, on the evidence of the last few years, would not.

Iran’s crypto lifeline is narrowing, but it is not closed

The second thing to notice is the sequencing. In five months, the Treasury has designated the big Iranian domestic exchanges, the Zanjani-linked BitBank, the Iraqi bank that moved Iranian money, and now the global exchange that carried the largest single volume of Iranian crypto traffic. The Canadian designations on the same day attacked the retail end of the same pipeline. This is a campaign with a map, not a series of one-off actions.

But the Garantex precedent is a warning against declaring victory. Sanctioned exchanges reappear as successors. Banned users open new accounts. Money finds new pipes. The $1 billion in direct Iranian traffic that FinCEN found on MEXC will not vanish; it will look for the next exchange willing to take it. The real test of Operation Economic Outcast is not whether it can cut off one exchange, but whether it can keep cutting them off faster than replacements appear — and whether the stablecoin issuers, banks and regulators in other countries cooperate. On that, the Tether freezes and the FINTRAC coordination are encouraging signs, but they are not yet a system.

The Russia finding is the legal hook — and the geopolitical signal

It is worth pausing on the fact that the order is formally built on the Russian strand, not the Iranian one. Section 9714(a) requires a finding of primary money laundering concern “in connection with Russian illicit finance”, and the $1.5 billion in Russian sanctions evasion — including $232 million in direct dealings with sanctioned entities — is what supplies it.

That is partly a legal convenience. But it is also a signal. The Treasury is telling Moscow, in the same week that it is squeezing Tehran, that the financial plumbing Russia uses to evade sanctions is being dismantled piece by piece, and that an exchange still trading with Garantex and Grinex in June 2026 cannot expect to be treated as a neutral marketplace. With the war in Ukraine in its fifth year and Russia pushing to put bitcoin trading on the Moscow Exchange, according to Bitcoin Magazine, the MEXC order lands as a message to any exchange thinking of becoming the next Garantex.

Ordinary crypto users are the collateral

Lost in the billion-dollar figures is the question of what happens to MEXC’s legitimate users. The exchange claims customers in more than 170 countries, holds about $5 billion in reserves, and, according to Cointelegraph, held about $4.48 billion in total assets as of Friday. Many of those users have nothing to do with sanctions evasion or cybercrime; they are traders, savers and small businesses in countries where crypto is a practical alternative to a broken banking system.

When a big exchange is cut off from the dollar system, those users face frozen withdrawals, collapsing liquidity and, in the worst case, the loss of their funds. Garantex’s customers learned that lesson in March 2025. MEXC’s customers may be about to learn it again. That is the unavoidable cost of enforcement at this scale — and it is also the reason the 30-day window and the possibility of exemptions matter. How FinCEN handles the wind-down will determine whether this is a surgical strike on illicit finance or a blunt blow that punishes the innocent alongside the guilty.

The precedent now extends beyond crypto

Finally, the MEXC order should be read alongside the rest of the Treasury’s week. The same campaign has already reached shipping, aviation, gold and technology. The same legal tools — sector determinations, secondary sanctions, funds-transmittal bans — are now being aimed at crypto exchanges with the same confidence they were once aimed at banks and shipping companies.

That is a structural shift. For years, crypto’s defence was that it was too decentralised, too borderless and too fast to regulate. The MEXC order is the Treasury’s answer: the pipes may be borderless, but the dollars are not, and the moment a platform touches the American financial system, it can be cut off from it. Every exchange, stablecoin issuer and payment processor in the world has just been given a very expensive lesson in where the real border is.

What to Watch Next

1. Federal Register publication: the 30-day clock starts only when the order is published. Watch for the notice — and for any last-minute challenge, exemption request or negotiated settlement from MEXC before it takes effect.
2. MEXC’s response: the exchange has said nothing publicly so far. Whether it contests the findings, promises reforms, or quietly moves its business will shape how much of its $1-billion-a-day volume survives.
3. The Garantex test: watch for a successor exchange absorbing MEXC’s users and liquidity, as Grinex did for Garantex — and for how quickly the Treasury moves against it if one appears.
4. Stablecoin and banking fallout: watch whether major stablecoin issuers freeze MEXC-linked wallets, as Tether did with Garantex, and whether banks and payment processors publicly sever ties before the deadline.
5. The next Operation Economic Outcast round: with MEXC cut off and eight Canadian firms designated, the campaign’s next targets — and whether it turns to other large offshore exchanges — will show how far the Treasury intends to take this.

Sources

• U.S. Department of the Treasury — “Operation Economic Outcast Severs MEXC Global’s Access to the U.S. Financial System” (press release, 6 November 2026)
• U.S. Department of the Treasury — “Operation Economic Outcast Sanctions Eight Canadian Money Services Businesses Enabling Iranian Regime” (press release, 6 November 2026)
• Bitcoin Magazine — “FinCEN Cuts Off MEXC From U.S. Financial System Over Alleged $16B Illicit Flows” (6 November 2026)
• Cointelegraph — “Today in crypto: MEXC US ban, Binance hack and exchange security” (6 November 2026)
• U.S. Department of the Treasury — “Treasury Sanctions Cryptocurrency Exchange and Network Enabling Sanctions Evasion and Cyber Criminals” (Garantex and Grinex designations)
• MyToken — “FinCEN Bars U.S. Financial Institutions From Moving Funds for MEXC After $16.7 Billion Finding” (6 November 2026)