US Orders MEXC Financial Cutoff Over $16.7 Billion in Alleged Illicit Flows; Exchange Launches Review

A major crypto exchange faces a US transfer ban

The United States has ordered a financial cutoff of MEXC Global after the Treasury Department's Financial Crimes Enforcement Network identified $16.7 billion in transactions connected to alleged illicit activity between May 2021 and May 2026. The findings span Russian sanctions evasion, Iranian financial networks, a sanctioned North Korean intermediary and payments linked to cybercrime.

FinCEN issued the order on November 6, 2026, under section 9714(a) of the Combating Russian Money Laundering Act. It will prohibit covered US financial institutions from transferring funds, including cryptocurrency, to or from MEXC. The restriction takes effect 30 days after publication in the Federal Register, the government's official publication for legal notices.

MEXC responded on November 7 that operations were continuing normally and user assets remained secure. The exchange said its legal and compliance teams were reviewing the action, and that it had begun an independent examination of its controls against money laundering and sanctions violations.

The stakes extend beyond a small offshore trading platform. Treasury describes MEXC as one of the world's 20 largest cryptocurrency exchanges, handling more than $1 billion in daily transactions and holding approximately $5 billion in reserves.

Treasury Secretary Scott Bessent presented the action as part of Operation Economic Outcast, a campaign targeting financial channels used to evade sanctions. In the department's November 6 announcement, he described access to American finance as the pressure point.

Financial institutions cannot have it both ways: Either you support the Iranian regime, or you have access to the U.S. financial system," said Bessent. "Treasury will continue to sever the Iranian regime's economic lifelines and thwart its desperate attempts to circumvent U.S. sanctions using digital assets.

What the order changes, and when

FinCEN's funds transfer order finds MEXC to be a financial institution outside the United States of primary money laundering concern in connection with Russian illicit finance. In plain language, the agency has determined that the exchange presents a serious risk of moving money connected to prohibited Russian activity.

The legal tool is a FinCEN transfer prohibition under section 9714(a), as amended by the National Defense Authorization Act for Fiscal Year 2022. Covered American institutions must stop sending funds to MEXC or receiving funds from it once the order becomes effective. Violations may bring civil or criminal penalties.

The order reaches MEXC's subsidiaries, branches, offices and successor entities operating outside the United States. Named businesses include MEXC Global Ltd and MX Global Ltd in Seychelles, MEXC Estonia OÜ, Switzerland's GIDA Technology AG and the United Kingdom's MXC Global Ltd.

The exact starting date was still unsettled when the action was announced: the order contained a placeholder for Federal Register publication, and the notice had not appeared by Friday evening Eastern time. The 30 day countdown begins with that publication. The order has no scheduled end date.

American institutions must also continue meeting existing Bank Secrecy Act duties, including filing suspicious activity reports, and complying with sanctions administered by Treasury's Office of Foreign Assets Control, or OFAC. The new prohibition adds a specific restriction on transfers involving MEXC.

Russia links form the legal foundation

FinCEN traced nearly $1.5 billion in direct and indirect exposure to transactions linked to Russian sanctions evasion between May 2021 and May 2026. Within that amount, $232 million involved direct transactions with entities sanctioned by the United States, European Union or United Kingdom.

The $232 million represents roughly 15% of the nearly $1.5 billion Russia figure. That comparison helps explain the agency's case: investigators identified both dealings with sanctioned entities themselves and a wider set of transactions connected through other participants.

MEXC continued processing transactions involving Russian exchange Garantex and its successor Grinex as recently as June 2026, Treasury said. OFAC had designated Garantex in April 2022, more than four years earlier.

FinCEN said its conclusions drew on public information, information unavailable to the public and analysis of blockchain records. A blockchain is a shared record of cryptocurrency transfers. Investigators can follow movements between digital addresses and use other information to connect those addresses to businesses or individuals.

A7 and other exchanges widen the network

MEXC facilitated at least $26 million in transactions benefiting the sanctioned A7 network and almost $200 million connected to its A7A5 token, according to FinCEN. A7A5 is a stablecoin backed by the Russian ruble, a digital token designed to track the value of that currency.

The order describes A7A5 as a way to transfer value among actors linked to A7 when banking channels are restricted or less dependable. It operates on the Tron and Ethereum blockchains. FinCEN identified connections involving issuer Old Vector LLC and owner Ilan Shor, both subject to US, EU and UK sanctions.

The wider A7 operation had already drawn Treasury scrutiny. In October, the department designated A7 a transnational criminal organization and flagged more than $179 billion in transactions through A7A5. That figure describes the broader network's activity; MEXC's alleged A7A5 connection was almost $200 million.

FinCEN also identified more than $13 billion in direct transactions between MEXC and at least four exchanges sanctioned by the United Kingdom for helping Russian sanctions evasion and financing military operations in Ukraine. Those transactions covered May 2018 to July 2026.

Another finding concerned approximately $2.9 billion in direct transactions between May 2021 and May 2026 with Russian and other exchanges that allegedly collected no customer identification information. The agency also cited $8.5 million involving Russian darknet markets between September 2020 and July 2026. Darknet markets operate on concealed parts of the internet and can sell illegal goods or services.

Iran exposure included more than 40 exchanges

FinCEN estimated approximately $1.87 billion in MEXC transactions with exposure to Iran between May 2021 and May 2026. More than $1 billion took the form of direct transfers with over 40 identified Iranian cryptocurrency exchanges, some subject to American or international sanctions.

The agency also identified approximately $22 million in transactions associated with the Central Bank of Iran, the Islamic Revolutionary Guard Corps and its Quds Force. Those institutions and organizations face sanctions from the United States and other jurisdictions identified in the order.

A further $36 million went to or from MEXC in transactions related to the Gaza based Al-Qassam Brigades and other groups linked to Iran, FinCEN assessed. The order describes a broader total of nearly $2 billion connected to identified Iranian actors or known or suspected terrorist groups.

These findings follow earlier action against Iranian cryptocurrency platforms. Treasury sanctioned Nobitex in June after saying it processed more than half of Iran's cryptocurrency inflows in 2025. In September, the United States sanctioned BitBank over alleged bitcoin transfers to the Revolutionary Guard.

A North Korean intermediary received $350,000

FinCEN's North Korea finding centers on Sim Hyon Sop, also rendered Sim Hyon-sop, a financial intermediary whom OFAC sanctioned in April 2023. The agency assessed that MEXC helped him receive approximately $350,000 between June and September 2025.

OFAC had specifically identified and sanctioned his cryptocurrency addresses in 2023. The alleged receipts through MEXC therefore occurred more than two years after those identifiers became part of the sanctions record.

Treasury has identified Sim as a representative of North Korea's Korea Kwangson Banking Corporation. It has accused him of involvement in cryptocurrency laundering, managing revenue from overseas information technology workers and arranging payments for purchases on behalf of the North Korean government.

The MEXC finding follows the October 28 sanctions on crypto intermediaries accused of helping North Korean officials move revenue. That action targeted eight North Koreans, two Russians and a North Korean controlled organization in Russia. Treasury said one Russian intermediary handled nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025.

For investigators, the practical concern is how people already identified under sanctions continue to receive money. FinCEN's allegation against MEXC points to a specific recipient, a defined period and cryptocurrency addresses that authorities had previously published.

Cybercrime accounts for another major finding

FinCEN assessed that at least $1.99 billion originating from or moving to illicit cyber actors passed through MEXC between May 2021 and May 2026. The order puts that at an average of more than $1 million a day.

Between January 2022 and July 2024, MEXC received more than $37.9 million in suspected ransomware payments, with exposure to over 125 ransomware variants, the agency said. Ransomware is malicious software used to lock files or disrupt systems while attackers demand payment.

One deposit address hosted by MEXC received more than $1.17 million linked to ransomware during that period, according to the order. FinCEN also cited scam payments and activity involving Russian and other darknet markets.

The transaction categories cover different periods and include overlapping relationships. The $232 million in direct dealings with sanctioned entities sits inside the nearly $1.5 billion Russia figure, while other figures describe networks, counterparties or particular tokens. FinCEN's headline assessment for May 2021 to May 2026 is $16.7 billion connected to illicit activity.

MEXC promises a review as controls face scrutiny

MEXC said on November 7 that trading, deposits and withdrawals were operating normally and that user assets were safe. It said it planned constructive communication with FinCEN and other regulators and government authorities around the world.

The exchange also announced an independent review of its anti money laundering and sanctions controls. Customer verification, often called know your customer or KYC, means checking who is opening or using an account. Sanctions controls involve screening customers and transactions against restrictions on named people, organizations and jurisdictions.

Treasury's allegation is that MEXC's written rules and its actual transaction activity diverged. The platform claimed to maintain verification and money laundering safeguards and barred people in jurisdictions including Iran and North Korea, yet FinCEN identified transactions involving those jurisdictions and sanctioned actors.

MEXC's regulatory difficulties extend beyond Washington. The United Kingdom's Financial Conduct Authority warned in March 2024 that MEXC Global Ltd was unauthorized. Hong Kong's Securities and Futures Commission warned that month that the platform was marketing to local investors without a licence. Seychelles authorities took action against MX Global Ltd over unlicensed virtual asset operations in May 2026.

Japan's Financial Services Agency had also warned about MEXC as an unregistered cryptocurrency exchange operator in March 2023 and November 2024. FinCEN's order describes the Seychelles incorporated business as operating across more than 170 countries and cites licensing concerns raised by multiple national regulators.

The dates behind the cutoff

MEXC was founded in 2018 and expanded into a large international trading venue. Treasury says it offers more than 3,000 cryptocurrencies and tokenized assets and supports trading in over 50 currencies. FinCEN's order estimates that it accounted for approximately 9% of global centralized cryptocurrency exchange trading volume in December 2025.

The case brings together years of transactions and several earlier sanctions decisions. The main dates show how long some relationships allegedly continued after authorities identified the participants:

• April 2022: OFAC designated Russian cryptocurrency exchange Garantex.
• April 2023: OFAC sanctioned Sim Hyon Sop and identified his cryptocurrency addresses.
• June to September 2025: MEXC allegedly facilitated approximately $350,000 in receipts for Sim.
• May 2026: The main assessment period ended, with FinCEN identifying $16.7 billion connected to illicit activity since May 2021.
• June 2026: Treasury says MEXC was still processing transactions involving Garantex and Grinex.
• November 6, 2026: FinCEN issued the transfer prohibition under Operation Economic Outcast.
• November 7, 2026: MEXC said operations were normal and announced an independent controls review.
• Thirty days after Federal Register publication: The prohibition becomes effective.

For customers and financial partners, MEXC's statement addresses current operations, while the order sets a future legal restriction on covered American institutions. Once effective, those institutions must stop transfers to and from the exchange, including transfers of cryptocurrency. Banking partners and payment providers with US connections will have to account for that restriction in handling MEXC business.

Key Points

• FinCEN identified $16.7 billion in MEXC transactions connected to alleged illicit activity between May 2021 and May 2026.
• The order prohibits covered US financial institutions from transferring funds, including cryptocurrency, to or from MEXC.
• The prohibition starts 30 days after Federal Register publication and has no scheduled end date.
• Findings include nearly $1.5 billion linked to Russian sanctions evasion, approximately $1.87 billion in exposure to Iran and $350,000 received by a sanctioned North Korean intermediary.
• FinCEN also identified at least $1.99 billion moving to or from illicit cyber actors.
• MEXC says operations and user assets remain secure and has launched an independent review of its controls.