US Treasury sanctions eight Canadian money-service firms over Iranian currency channels
The United States Treasury has sanctioned eight Canadian money-service businesses, escalating Washington’s campaign against crypto-adjacent illicit finance and pushing enforcement deeper into cross-border payment networks.
The action, taken on Nov. 6, alleges the companies helped sanctioned Iranian entities exchange Iranian rials and other currencies for digital assets. Treasury said the businesses enabled international transactions involving Iran, in breach of the US sanctions regime. The designation extends a familiar playbook into new territory: rather than targeting a crypto exchange or a blockchain protocol, Treasury has gone after conventional money-service businesses that sit between fiat currency and digital assets.
The move matters because it clarifies the perimeter of US enforcement. Any firm, crypto-native or otherwise, that facilitates conversion into digital assets on behalf of sanctioned parties now sits squarely within Treasury’s reach. For the money-services sector in North America, the message is that sanctions compliance obligations do not stop at the point where a transaction leaves the banking system. They follow value wherever it travels, including on-chain.
Canada’s proximity to the US financial system makes the case particularly pointed. Money-service businesses operating across the border routinely interact with US correspondent banks and dollar clearing. A Treasury designation effectively freezes those firms out of the dollar network, cutting off the lifeblood of any cross-border remittance operation. The reputational consequences are likely to be just as severe as the legal ones, with counterparties expected to sever relationships quickly to avoid secondary exposure.
Readers following the broader enforcement trend can find more in our regulation coverage, where sanctions actions against crypto-adjacent firms have become a recurring theme.
FinCEN moves to cut MEXC Global off from the US financial system
In a parallel and arguably more consequential action, Treasury moved through the Financial Crimes Enforcement Network to sever MEXC Global from the US financial system entirely.
FinCEN alleged that MEXC processed at least $16 billion in transactions connected to sanctions evasion, cybercrime and other illicit activity between May 2021 and May 2026. The alleged transactions involved sanctioned groups in Iran, Russia and North Korea, three jurisdictions at the centre of US sanctions policy.
The mechanism is significant. The restriction would bar US financial institutions from processing transfers involving MEXC and takes effect 30 days after publication in the Federal Register. That structure gives the measure a formal administrative timetable while leaving little practical room for the exchange to contest the outcome before compliance departments begin de-risking. US banks are unlikely to wait for the deadline to pass before cutting ties; the cost of being the last institution connected to a designated counterparty far exceeds the cost of early termination.
The $16 billion figure, spanning five years, positions MEXC among the largest alleged illicit-finance channels ever named in a US enforcement action against a crypto exchange. The scale of the allegation, combined with the breadth of the sanctioned jurisdictions involved, suggests the case was built over an extended surveillance period rather than as a rapid response to a single incident.
For the wider exchange sector, the action reinforces a hardening reality. Offshore registration no longer insulates a trading venue from US consequences if dollar liquidity touches its operations at any point. Exchanges that have treated US banking access as optional, or that have routed around it through intermediaries, now face a demonstrated willingness by Treasury to close the perimeter. Compliance chiefs at mid-tier venues will be reviewing their own transaction histories against the conduct FinCEN has described.
There is also a market dimension. MEXC users outside the United States face the prospect of degraded fiat rails and reduced liquidity as banking partners withdraw. Where liquidity thins, spreads widen and withdrawal friction increases, effects that tend to spill beyond the directly sanctioned entity. The action is therefore not only a compliance event but a market structure event, with potential knock-on effects for token listings and trading volumes that were concentrated on the venue.
Binance’s $6.3 billion hack: transparency meets the limits of what blockchains can show
While enforcement dominated the headlines, the industry’s biggest unresolved security question continues to hang over Binance following its $6.3 billion hack.
Binance co-CEO Richard Teng said the incident involved the exchange’s hot wallet, while most customer assets were held in offline cold storage and moved to hot wallets only for requested withdrawals. Binance said attackers accessed an internal wallet-signing service and bypassed the normal withdrawal process, but some technical details would remain confidential.
That last caveat is where the tension lies. Public blockchains are, by design, transparent. Wallet balances and fund movements are visible to anyone. But as Jonathan Riss, an analyst at CertiK, cautioned, blockchain wallet balances reveal fund movements, not the internal controls governing them. The industry can watch the stolen funds move in real time, yet cannot verify from the outside whether Binance’s account of the breach, its containment, or its custody practices is complete.
This gap between on-chain observability and off-chain operational reality is the central lesson of the incident. Exchanges are not smart contracts. They are companies running proprietary signing infrastructure, key management systems and withdrawal approval workflows, none of which are subject to the public auditability that blockchain maximalists often cite as the technology’s core advantage. When a wallet-signing service is compromised, the failure occurred in precisely the layer that blockchains cannot illuminate.
The decision to withhold some technical details is defensible from an incident-response perspective; publishing the precise mechanism could aid copycat attacks across the industry. But it also means the market must price the risk on partial information. Institutional allocators, already sensitive to custody failures, will weigh the co-CEO’s assurances against the reality that a signing service was compromised at the largest exchange by volume. Counterparty risk assessments that relied on cold storage ratios as a proxy for safety will need to incorporate the operational path between cold storage and withdrawal, because that path is where the attack occurred.
Teng’s framing, that most customer assets sat in cold storage and moved to hot wallets only for requested withdrawals, describes a sound custody architecture on paper. The hack demonstrates that the architecture is only as strong as the signing service that mediates between the two states. For more on how the market is digesting custody and security failures, see our Bitcoin coverage.
Strive reports $509 million quarterly net income and adds 15,124 BTC
Against the enforcement and security backdrop, corporate Bitcoin accumulation continues at remarkable scale. Strive, the Bitcoin treasury company, reported $509 million in third-quarter net income and bought 15,124 BTC in October, taking its total holdings to 43,124 BTC.
The October purchase alone represents one of the largest single-month corporate acquisitions of Bitcoin on record, and the pace shows no sign of slowing. At 43,124 BTC, Strive’s holdings place it among the most significant corporate treasuries in the sector, a cohort that has grown from a curiosity into a distinct asset class within equity markets.
The $509 million quarterly net income figure adds a second dimension to the story. Treasury companies have typically been valued on the spread between their Bitcoin holdings and their equity market capitalisation, with accounting rules historically producing volatile reported earnings as digital asset prices move. A nine-figure quarterly profit on top of aggressive accumulation suggests the model is generating returns that extend beyond simple price appreciation, at least as reported.
The timing is notable. While regulators tighten the screws on exchanges and illicit finance channels, the corporate treasury side of the market is expanding with apparent regulatory blessing. Treasury companies operate through regulated vehicles, audited balance sheets and conventional capital markets, which places them on the comfortable side of the enforcement line that MEXC and the sanctioned Canadian firms now sit behind.
What these stories tell us about crypto’s current moment
Taken together, the week’s developments sketch the industry’s operating environment with unusual clarity.
On one side, the enforcement perimeter is tightening in ways that reach beyond crypto-native firms. The eight Canadian money-service businesses were not exchanges, and the action against them signals that Treasury views the fiat-to-crypto on-ramp as fully within its jurisdiction regardless of the corporate form it takes. The MEXC designation, with its $16 billion allegation and clean severance mechanism, shows that the United States is willing to remove venues from the dollar system entirely rather than negotiate remediation.
On the other side, the Binance hack exposes the limits of the industry’s core transparency narrative. Public blockchains did exactly what they are designed to do: the movement of $6.3 billion was visible to everyone. What remained invisible, as CertiK’s analyst noted, were the internal controls that should have prevented the loss. The industry’s security posture still depends on private operational systems that no outside party can audit in real time.
Between these two poles, Strive’s accumulation demonstrates that institutional capital is not retreating. It is migrating toward structures that regulators understand and can supervise. The divergence is becoming the defining pattern of this market cycle: enforcement pressure concentrates on opaque venues and illicit channels, while compliant treasury vehicles scale at a pace that would have seemed implausible two years ago.
For exchanges, the compliance calculus has changed permanently. For investors, the lesson is that custody risk and regulatory risk are now the two variables that matter most, and neither is fully visible on-chain.”
}
