🇺🇸 BREAKING: US Treasury orders crypto exchange MEXC banned from the US financial system over $16 BILLION in illicit funds. Treasury says MEXC handled at least $16 BILLION tied to Iranian, North Korean and Russian sanctions evasion and cybercrime from May 2021 to May 2026. Once the order takes effect, US financial institutions can’t move any funds to or from MEXC. 🇷🇺 Russia: nearly $1.5 BILLION linked to sanctions evasion 🇮🇷 Iran: about $1 BILLION with more than 40 Iranian crypto exchanges 🇰🇵 North Korea: Treasury calls MEXC a hub for its sanctions evasion It also moved about $22 MILLION for Iran’s central bank, the Revolutionary Guard and its Qods Force. MEXC’s own rules ban users in Iran and North Korea, but Treasury says weak anti-money laundering controls let them through. It was still trading with sanctioned Russian exchange Garantex as recently as June 2026, more than 4 years after the US blacklisted it. “Either you support the Iranian regime, or you have access to the U.S. financial system,” Treasury Secretary Scott Bessent said.

Operation Economic Outcast: FinCEN ordered 𝐌𝐄𝐗𝐂 𝐆𝐥𝐨𝐛𝐚𝐥 cut off from the U.S. financial system after finding the cryptocurrency exchange facilitated at least $16 billion in illicit transactions tied to Iranian, North Korean, and Russian sanctions evasion, cybercrime, and other illicit activity. Entities - 𝐌𝐄𝐗𝐂 𝐆𝐥𝐨𝐛𝐚𝐥 — Headquarters not specified; major convertible virtual currency exchanger identified as a primary money laundering concern in connection with Russian illicit finance. FinCEN found severe AML and customer-verification deficiencies despite the platform’s stated compliance controls. - 𝐆𝐚𝐫𝐚𝐧𝐭𝐞𝐱 and successor 𝐆𝐫𝐢𝐧𝐞𝐱 — Sanctioned Russian exchanges that continued transacting through MEXC Global as recently as June 2026. - 𝐀𝟕 𝐍𝐞𝐭𝐰𝐨𝐫𝐤 — Russia-based, OFAC-sanctioned sanctions-evasion network that received at least $26 million in MEXC-facilitated transactions. - 𝐂𝐞𝐧𝐭𝐫𝐚𝐥 𝐁𝐚𝐧𝐤 𝐨𝐟 𝐈𝐫𝐚𝐧 — OFAC- and EU-sanctioned institution involved, alongside the IRGC and IRGC-Qods Force, in approximately $22 million of transactions processed by MEXC Global. - 𝐈𝐬𝐥𝐚𝐦𝐢𝐜 𝐑𝐞𝐯𝐨𝐥𝐮𝐭𝐢𝐨𝐧𝐚𝐫𝐲 𝐆𝐮𝐚𝐫𝐝 𝐂𝐨𝐫𝐩𝐬 and 𝐈𝐑𝐆𝐂-𝐐𝐨𝐝𝐬 𝐅𝐨𝐫𝐜𝐞 — OFAC-, UK-, and EU-sanctioned Iranian actors that benefited from MEXC-facilitated transactions. Key findings - May 2021–May 2026: At least $16 billion linked to sanctions evasion, cybercrime, and other illicit activity. - Russian exposure: Nearly $1.5 billion tied to sanctions evasion, including $232 million in direct transactions with U.S.-, EU-, or UK-sanctioned entities. - A7 ecosystem: Almost $200 million connected to the A7 Network’s A7A5 stablecoin, used as a sanctions-evasion store of value. - Iranian exposure: Approximately $1 billion in direct transfers with more than 40 identified Iranian CVC exchangers, including some under U.S. or international sanctions. - Additional activity included DPRK sanctions evasion, ransomware and scam payments, and Russian and other darknet-market transactions. - As of September 2026, MEXC Global reportedly processed more than $1 billion daily, held approximately $5 billion in reserves, and offered over 3,000 cryptocurrencies and tokenized assets. Compliance impact - Issued under Section 9714(a) of the Combating Russian Money Laundering Act, the order prohibits U.S. financial institutions from transmitting funds from or to 𝐌𝐄𝐗𝐂 𝐆𝐥𝐨𝐛𝐚𝐥. - The prohibition becomes effective 30 days after publication in the Federal Register. - Violations may trigger civil or criminal penalties. - Existing Bank Secrecy Act, Suspicious Activity Report, and OFAC sanctions obligations remain unchanged. - FinCEN whistleblowers may qualify for awards when information leads to a successful enforcement action with monetary penalties exceeding $1 million. Source:

🔥 LATEST: China's P2P stablecoin wallets have grown 43x since early 2024 despite restrictions, while South Korea's $449.1B crypto economy is the largest in East Asia, according to Chainalysis. Standard Chartered plans institutional crypto custody in Singapore, Hong Kong has reaffirmed its end-2026 deadline for a crypto licensing bill, and Japan has added Garantex to its Russia sanctions list. It's all in Asia Express, our roundup of everything that happened in crypto in Asia this week.

Crypto stolen in the alleged $13.7 million hack of Grinex are moving. We’re tracking stolen funds as they flow through mixers and cross-chain bridges, with cash-out points at a mainstream exchange. This complicates recovery for the exchange’s users. But is it a hacker or an insider laundering the funds? Two months ago, Grinex (successor to Russian exchange Garantex) claimed it was hacked by “foreign intelligence services.” But on-chain evidence pointed to a possible inside job. For one, the alleged hacker swapped exfiltrated stablecoins for Tron (TRX) on a decentralized exchange that Garantex once favored. Most of the funds are still being held as balances on private wallets. Grinex claims on its website that it will compensate its customers for stolen assets — will these users get their funds back, or have they fallen victim to an exit scam?

The EU designated 34 individuals and 47 entities on June 15, 2026, targeting Russia's military-industrial complex and shadow fleet, human rights violations tied to Alexei Navalny's persecution, and foreign information manipulation networks. Among the FIMI listings: Kirill Fedorov, a military blogger who solicits crypto donations via Telegram for Russian frontline units. The designation arrived without cryptocurrency addresses, but TRM had already been tracking his on-chain activity — finding donations flowing to non-custodial exchanges, to global exchanges through intermediary addresses, and to Garantex. Read TRM's full analysis 👉

To everyone in the HTX community concerned about the recent news, I’d like to clarify the situation and reduce unnecessary panic and misinformation. First, this is a relatively common compliance review process. We are actively communicating with all relevant parties to resolve misunderstandings as quickly as possible. HTX also sees this as an opportunity to further strengthen our compliance and risk-control systems, helping the platform become even more resilient. At present: Platform operations are normal User assets remain secure Deposits, withdrawals, and trading are functioning normally There is no need for excessive concern. For users asking what they should do right now, there are two options: 1️⃣ Do nothing You may simply wait while we complete communications with relevant parties and resolve the situation. HTX has operated for 13 years and has weathered multiple market cycles and industry challenges. We remain fully committed to protecting user assets and platform security. Our support team and I will continue to be available 24/7 to assist users. 2️⃣ If you still feel uncomfortable, you may temporarily withdraw assets on-chain Deposits and withdrawals are currently operating normally, and users are free to make their own decisions. ⸻ What happened? On May 26, the UK Foreign Office announced a new round of Russia-related sanctions under The Russia (Sanctions) (EU Exit) Regulations 2019. The list included 18 crypto-related entities and individuals, including a company named “Huobi Global S.A.” According to the UK statement, this entity allegedly provided financial services and technical support to the Russian exchange Garantex and the A7 crypto payment network. However, there is one very important point many people misunderstand: “Huobi Global S.A.” is not the same thing as the HTX exchange platform used by global users today. Many people equate a brand name with a legal operating entity, but global businesses often operate through multiple legal entities across different jurisdictions for compliance purposes. So: Sharing a similar brand name does NOT mean sharing the same legal entity, operational structure, or asset system. The HTX platform used by users today operates independently under its own structure. ⸻ Why users should not panic 1️⃣ The sanctions target a specific legal entity This is not a “brand-wide sanction.” The UK sanctions apply to a specific listed entity and do not automatically extend to all businesses using similar branding. The practical impact is also mainly limited to the UK financial and regulatory system. ⸻ 2️⃣ The sanctions mainly affect relationships inside the UK financial system This may include: Restrictions involving UK financial institutions Suspension of payment or intermediary relationships Asset-related measures within UK jurisdiction But this does NOT mean: Global user assets are frozen HTX has stopped operating Users cannot trade or withdraw funds At this time, the platform continues to operate normally. ⸻ Why did the situation escalate so quickly? Some third-party blockchain security providers applied broad risk labels to related wallet addresses in a “one-size-fits-all” manner. This affected certain normal user transactions and created unnecessary panic and speculation. Our compliance, security, and legal teams are already communicating with the relevant parties, and we expect the issue to be resolved soon. We understand the community’s concerns and will continue to communicate transparently. If you have any questions, please feel free to reach out to us or our support team anytime.

Hackers want $3 million by tomorrow. Revolut says nobody has called. Italy has opened a file. IAmNotAVillain put a clock on a site: 6,000 Monero (about $3m), pay in 24 hours, or the packs go on sale (FT). Reuters asked Revolut. The answer: no direct contact, no demand. The actor made the ask public. Revolut hasn't used channels to open dialogue. In Italy, the picture moved. Reggio Calabria prosecutors have a case (LaPresse). Postal Police are on the PEC. The DNA — national anti-mafia and counter-terrorism directorate — has been looped in because a government mailbox is in play, not because anyone has proved a mafia job (ANSA). The Garante is asking other banks how they check official mail (La Stampa). Interior Ministry has not confirmed the box. Some coverage slips into “Italian hackers.” That is a jump. What they have is an Italian official channel. Who sat at the keyboard remains unknown. The method is clearer if you take Duel / Korra, who say they spoke to the same actor. They scraped public Bitcoin addresses and txids, dumped hundreds on Revolut as a fake European Investigation Order, and asked who sat behind each one. Spray and pray, hoping they find "whales". Korra says they saw the .emls: folders with IDs, selfies, statements. Three things in those emails should have stopped by a competent officer. 1. The envelope was a prefettura Enti locali PEC in Reggio Calabria — local-authorities admin (entilocali.prefrc@pec.interno.it). The PDF inside looked like it was from the Postal Police / Milan procura / an EIO. Wrong address, wrong instrument. 2. An EIO in Italy is a judicial act issued by a prosecutor or judge. A prefettura cannot issue one. 3. The letterhead was wrong. Staff wrote back and told them to address Revolut Digital Assets Europe Ltd in Cyprus, not “UAB Italian Branch” (Korra). That is fixing the attacker’s homework and still fulfilling. Three flags. A live PEC was treated as enough. A person I believe is inside the firm told me, "They are so scared of government agencies they are almost over-compliant." Revolut still will not confirm the number. FT and my other channels put it at about 680. Nicola Vicino is GM of the Italian branch of Revolut. Not the person who hit send, but I believe he has questions to answer. What happened. From spring to September, mail authenticated on a real Italian government domain asked for KYC. Revolut sent identity documents, selfies, statements and Bitcoin histories. Eventually, Revolut found out it was a scam, blocked the address, and told those customers. Not a hack of the app. Money stayed. Files left. People on that list are not debating PEC law. They are waiting to see if a pack with their face and their chain history is sold. Others watching from the sidelines are asking a simpler question: if official-looking mail is enough, how much of this bank is process and how much is judgment.