US Treasury Bans MEXC Global Crypto Exchange Over Sanctions Evasion and Cybercrime Links

The US Department of the Treasury has issued a ban prohibiting MEXC Global from accessing the US financial system due to its role in facilitating at least $16 billion in illicit transactions. The Seychelles-based exchange, founded in 2018 and serving over 40 million users across 170 countries, was found to have processed transactions linked to ransomware, scams, and sanctions evasion involving Iran, North Korea, and Russia between May 2021 and May 2026. FinCEN highlighted ongoing dealings with sanctioned entities such as Garantex and Grinex as recently as June 2026, along with $226 million tied to the A7 sanctions evasion network. Deficiencies in MEXC's AML and customer verification controls allowed direct transactions worth approximately $1 billion with over 40 Iranian CVC exchangers. The order exposes US institutions and individuals to secondary sanctions for any dealings with MEXC. In response, MEXC stated it is conducting an independent review of its sanctions and AML controls while maintaining normal operations and secure user assets.

BleepingComputerNovember 9, 2026Translated from English

Read at source

The US Department of the Treasury has cut off the MEXC Global crypto exchange from the US financial system over sanctions evasion and links with cybercrime gangs.

Founded in 2018, the Seychelles-based MEXC is one of the world's largest crypto exchanges, giving more than 40 million users from more than 170 countries access to 3,000 cryptocurrencies and tokenized assets.

According to a Financial Crimes Enforcement Network (FinCEN) order, MEXC has allowed illicit transactions of at least $16 billion linked to cybercrime operations and Iranian, North Korean, and Russian sanctions evasion between May 2021 and May 2026.

The Treasury Department said that, as recently as June 2026, MEXC was still processing transactions with sanctioned Russian entities Garantex and Grinex, and it also facilitated or processed at least $226 million in transactions benefiting or connected to the Russia-based, OFAC-sanctioned A7 sanctions evasion network.

"MEXC Global has not only facilitated Russian illicit finance but has also served as a hub for other types of illicit financial activity, including Iranian and DPRK sanctions evasion, ransomware and scam payments, and Russian and other darknet market activity," the Treasury Department said.

"Between May 2021 and May 2026, MEXC Global had sent or received approximately $1 billion in direct transactions with more than 40 identified Iranian CVC exchangers, some of which are subject to U.S. and international sanctions."

FinCEN has blamed this on deficiencies in the crypto exchange's anti-money laundering (AML) and customer identification and verification policies.

The ban exposes US financial institutions and individuals to secondary sanctions or enforcement actions for transfers of funds to or from the MEXC Global crypto exchange.

In response to FinCEN's ban order, MEXC said that its legal and compliance teams have launched a review of its sanctions and AML controls. "MEXC is aware of the order issued by the U.S. Financial Crimes Enforcement Network (FinCEN) on November 6, 2026, and is reviewing it closely in coordination with our legal and compliance teams. MEXC is operating normally, and user assets remain secure," MEXC said. "We take the concerns raised seriously and intend to engage constructively with FinCEN, as well as other relevant regulators and competent authorities worldwide. We have also begun an independent review of our AML and sanctions controls."

MEXC Global FinCEN Garantex Grinex A7 network

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Crypto & FinCrime

Crypto & FinCrime

Former FBI Agent Patrick Steven Yaroch Pleads Guilty to Stealing $2.5 Million in Crypto from Investigation Targets

A former FBI supervisory special agent has admitted to wire fraud and money laundering after stealing nearly $2.5 million in cryptocurrency from wallets belonging to fraud victims and nation-state hackers under active FBI probes. Patrick Steven Yaroch, who served in the FBI Boston Division and later at FBI Headquarters Counterintelligence and Espionage Division, accessed passphrases stored in internal case management systems to drain the funds. He conducted around 100 fraudulent transfers tied to 35 separate investigations and attempted to launder the proceeds by moving them between multiple wallets and using them to pay personal debts. Yaroch self-reported the theft to the Department of Justice National Security Division before his arrest and had been planning to relocate his family to Portugal using funds obtained through the scheme. His actions compromised multiple ongoing national security investigations and exposed sensitive FBI sources and methods. He faces up to 40 years in prison at sentencing scheduled for March 4.

BleepingComputerNov 9, 2026Translated from English

Crypto & FinCrime

Former Royal Marechaussee Officer Accused of Stealing Over €6,000 in Cryptocurrency from Schiphol Traveler

A former investigative officer with the Koninklijke Marechaussee is suspected of abusing access to police systems to steal more than €6,000 worth of cryptocurrency from a traveler at Amsterdam’s Schiphol Airport. The Public Prosecution Service (OM) reported that the suspect queried a routine registration made during a passenger check and then located a recovery code for the victim’s crypto wallet stored in another notification. Using that code, the officer drained the funds and transferred them to his own crypto account before converting the proceeds into multiple cryptocurrencies via his personal bank account. The suspect reportedly searched police databases about twenty additional times to monitor the victim’s case. After the traveler filed a report one week later, the officer learned he had become a suspect and claimed that someone else had sent the cryptocurrency to his wallet. He was subsequently dismissed from the Marechaussee, and the OM has demanded a six-month prison sentence plus full restitution of the stolen funds.

Security.NLNov 9, 2026Translated from NL

Crypto & FinCrime

Credit Mutuel Arkea Confirms Cyberattack Enabling $133 Million Crypto Theft and Laundering

Credit Mutuel Arkea has confirmed a cyberattack that triggered fraudulent transactions exceeding 133 million dollars, with blockchain investigator ZachXBT estimating losses above 100 million dollars and noting facilitated money laundering. The operation spanned multiple days, routing funds through centralized crypto exchanges where they were converted into USDC and USDT stablecoins before dispersion via Ethereum and Monero. Fortuneo, the online bank within the Arkea group, is identified as the source of the fraudulent wire transfers executed using falsified beneficiary names. Attackers opened accounts on platforms including Kraken using fabricated identities that passed KYC checks, allowing receipt of the diverted funds without compromising existing accounts. The bank stated that no customer financial impact occurred and that transactions were suspended preventively after detection, while the incident coincides with its MiCA licensing application for crypto services. The case highlights delays in reporting that may have allowed over 30 million dollars to be laundered and occurs amid G7 plans for AI-assisted cyberattack simulations in the financial sector.

ZATAZNov 5, 2026Translated from French