US Bans MEXC Crypto Exchange Over $16B Flows as AI and Ransomware Hit

Federal financial regulators and enterprise incident-response teams confronted a wave of sanctions-evasion enforcement, AI-interface exploitation, and campus ransomware activity on Monday. The U.S. Treasury Department banned cryptocurrency exchange MEXC Global from the U.S. financial system, German hosting provider Mittwald CM Service disclosed a breach of 56 customer projects through its Model Context Protocol (MCP) server, and Vanderbilt University instructed campus users to disconnect from WiFi following a ransomware alert.

U.S. Treasury Cuts Off MEXC Global Over $16 Billion in Illicit Flows

Under an order issued by the Financial Crimes Enforcement Network (FinCEN) on November 6, 2026, the U.S. Department of the Treasury severed Seychelles-based cryptocurrency exchange MEXC Global from the U.S. financial system. Founded in 2018, MEXC serves more than 40 million users across more than 170 countries with access to 3,000 cryptocurrencies and tokenized assets.

FinCEN determined that deficiencies in MEXC's anti-money laundering (AML) and customer identification controls enabled at least $16 billion in illicit transactions tied to cybercrime, ransomware, and sanctions evasion between May 2021 and May 2026. Specifically, the Treasury Department reported that MEXC processed transactions with sanctioned Russian exchanges Garantex and Grinex as recently as June 2026, facilitated at least $226 million in transactions benefiting the OFAC-sanctioned Russian A7 network, and handled approximately $1 billion in direct transfers with more than 40 Iranian virtual currency exchangers. MEXC stated that user assets remain secure and that it has launched an independent compliance review.

Attackers Exploit AI Model Context Protocol Server at German Host Mittwald

In North Rhine-Westphalia, Germany, web-agency hosting provider Mittwald CM Service disclosed on Saturday that an intruder exploited a vulnerability in its Model Context Protocol (MCP) server—an interface enabling customers to connect AI assistants to its mStudio management platform—and remained undetected for 8 days, compromising 56 customer projects.

Managing director Robert Meyer said the attacker first probed the MCP flaw in October while administrators were patching the PHP2Shell vulnerability, then traversed internal systems with only seconds passing between lateral steps, suggesting AI-assisted or automated execution. Supported by external IT forensic specialists, Mittwald confirmed that scans as of Friday showed no remaining attacker activity across the 56 affected projects.

Vanderbilt Issues Campus WiFi Alert After BYOD Ransomware Claim

In Nashville, Vanderbilt University—which enrolls about 14,000 students and employs more than 6,000 staff members, and whose medical center was previously targeted by ransomware in 2023—warned students and employees on Monday morning to shut down devices, disconnect from university WiFi, and report suspicious pop-ups or password prompts.

The alert followed claims by the ransomware gang BYOD, which added Vanderbilt to its extortion leak site early Monday. According to ransomware researcher Allan Liska, BYOD first surfaced on September 29 and has rapidly escalated attacks, including incidents at Michigan State University, the University of New Mexico, and a breach of Trump Mobile that leaked data on 3,615 customers. Industry telemetry from Halcyon documented a 40% increase in ransomware activity between July and September, with 111 extortion groups claiming 2,766 attacks across 122 countries, while Trellix noted that newly formed groups accounted for a third of all victim posts in August.