From Wallets to Infrastructure: How Crypto Sanctions Grew Up

In eight days, two major jurisdictions executed large-scale exchange designations against two different adversaries.

On May 26, 2026, the United Kingdom designated HTX, one of the largest cryptocurrency exchanges in the world, along with 17 other entities tied to Russian sanctions evasion. Eight days later, on June 2, the U.S. Treasury designated Nobitex, Iran’s largest crypto exchange, along with three other Iranian platforms and several of their executives. Two leading sanctions authorities, acting within a single week against two different adversaries, using a strikingly similar playbook: target the dominant national exchange, treat it as critical financial infrastructure, and attach secondary sanctions risk to anyone who continues to transact with it.

Eight Years of Enforcement Evolution

The history of adding cryptocurrency identifiers to sanctions frameworks is a history of expansion, each action a new theory of what sanctions could reach. In March 2018, OFAC published its first FAQs acknowledging that cryptocurrency fell within existing sanctions obligations, in relation to Venezuela. By November of that year, it designated two Iran-based individuals for converting ransomware-derived Bitcoin into rial, putting specific wallet addresses on the SDN List for the first time. An address, the action established, is an identifier like any other.

In 2019, the designation of North Korea’s Lazarus Group extended crypto sanctions into state-level national security enforcement. In September 2021, SUEX became the first sanctioned virtual currency exchange. The target was no longer an individual or a wallet, it was the financial institution exchanging the crypto for national currencies. Then 2022 brought the watershed: OFAC designated Hydra, Garantex, and Tornado Cash, sanctioning in the last case not just the operators but the smart contract addresses themselves. Three different types of entity, three enforcement theories, one signal that OFAC would pursue all aspects of the cryptocurrency ecosystem regardless of how it was structured.

By March 2025, Garantex was taken down. Within weeks, successor infrastructure, Grinex and the A7A5 ruble-pegged stablecoin, emerged to absorb the displaced activity. Like most illicit financial networks, it proved more durable than any single entity. That lesson sits directly beneath both of this past week’s actions.

Two Actions, One Model

The UK action against HTX broke new ground in its choice of instrument. For the first time, the UK applied Regulation 17A, historically a tool deployed against banks to restrict correspondent relationships and payment processing, to a cryptocurrency exchange. That treats the exchange not as a novel technology platform but as financial infrastructure subject to the same systemic pressure used against designated banks. The UK suspects HTX, which processed $3.3 trillion in volume in 2025, channeled over $1.5 billion to Russia through Garantex and Grinex and serviced the A7 network whose A7A5 stablecoin recorded $93 billion in its first year.

The OFAC action against Nobitex broke ground of a different kind. Nobitex is the first Iran-incorporated platform directly designated by the United States. With over 11 million users, it processed more than half of all Iranian digital asset inflows in 2025 and functioned as a parallel financial system, moving hundreds of millions in stablecoins for the Central Bank of Iran and facilitating payments tied to the IRGC. Treasury Secretary Bessent noted the U.S. has now seized roughly $1 billion in Iranian cryptocurrency. Both designations carry explicit secondary sanctions exposure for any foreign institution that continues to transact with the named entities.

Where Each Authority Looked for Leverage

The two actions shared a target type but diverged on one revealing point: the individuals behind the exchange. The UK action stayed at the entity level, designating HTX as a corporate platform without listing its principals. OFAC went further, designating not only Nobitex but its leadership, including co-founders identified as members of a family connected to the Iranian regime’s inner circle. One approach pressures the rails. The other pressures the people who control them.

What This Means Going Forward

The trajectory from 2018 to 2026 is unmistakable. Crypto sanctions began with individuals and wallet addresses, moved to exchanges and mixers, reached decentralized protocols, and are now applied to the largest exchanges by multiple jurisdictions at once. The conceptual center of gravity has shifted from the actor to the infrastructure.

In crypto markets, wallets are disposable, but networks are not. Both of this week’s actions reflect that understanding, targeting the infrastructure that lets financial networks adapt and persist rather than the individual nodes that can be replaced. For compliance teams and investigators, the implication is direct: screening designated names is necessary but no longer sufficient. The question is whether a counterparty sits within an ecosystem identified as sanctions evasion infrastructure, and whether the exposure runs to the entity, the individuals behind it, or both. That is a harder analytical problem, and increasingly the one that matters.

Meridian3 works at the intersection of OSINT, FININT, sanctions, and cryptocurrency investigation. This is an area we continue to examine closely.