From 2022 to 2026, crypto asset regulation moved into a decisive period. HTX Research frames these four years as the phase in which on-chain enforcement and blacklist systems rapidly took shape. The focus expanded from a single protocol to developers, users, exchange entry points, stablecoin contracts and the data infrastructure used by law enforcement and compliance teams.
The starting point was August 8, 2022, when OFAC used IEEPA to place 44 Tornado Cash smart contract addresses on the SDN sanctions list. It was the first time the U.S. government sanctioned a piece of “code” rather than a “person.” The immediate industry response was severe: GitHub closed the code repository, Circle froze USDC addresses that had interacted with Tornado Cash, and the Uniswap front end blocked related trading pairs. Yet the underlying contracts did not stop. During the sanctions period, Tornado Cash still processed about $2.5 billion in transactions, showing that freezing front ends and freezing a protocol are not the same thing.
The legal boundary was redrawn on November 26, 2024, when the U.S. Court of Appeals for the Fifth Circuit issued a landmark ruling in Van Loon v. Treasury. The court held that OFAC had exceeded its authority because immutable smart contracts do not constitute “property” under IEEPA. They cannot be owned or controlled by anyone; they are simply “lines of code.” On March 14, 2025, OFAC formally removed Tornado Cash from the SDN list. The nearly three-year litigation confirmed an institutional principle: regulators cannot use IEEPA as an open-ended tool to expand power without clear authorization from Congress.
The Tornado Cash dispute is not over. Prosecutors have shifted their attention from the protocol to individuals, and criminal charges against developers Roman Storm and Roman Semenov are still moving forward. HTX Research highlights the risk in the prosecutorial logic: Tornado Cash was used by North Korean hackers; developers knew this; developers did not stop it; therefore developers can be treated as co-conspirators in crimes they did not themselves execute. A conviction of Storm would set a precedent linking the act of writing code to criminal liability and would reshape the legal foundation of open-source DeFi development.
The Samourai Wallet case shows how this enforcement model has already changed. In April 2024, the DOJ filed charges against two Samourai Wallet founders. In July 2025, both pleaded guilty in the U.S. District Court for the Southern District of New York and faced up to five years in prison. Prosecutors argued that Samourai was not “pure code” but a complete service system involving a user interface, servers and a fee model. This distinction between immutable code and a hybrid service with operators is becoming a critical legal dividing line. If a protocol still has maintainers and fee collection, enforcement agencies are inclined to treat it as a service and pursue responsibility for misuse.
Global enforcement has also intensified. In November 2023, OFAC sanctioned Sinbad.io. In March 2025, Germany’s BKA joined the United States, the Netherlands and Finland in action against Garantex. In February 2025, the European Union placed Garantex on a sanctions list for the first time. At the same time, stricter mixer enforcement did not stop state-linked laundering. In 2025, Bybit was hit by a $1.5 billion theft, the largest single theft in crypto history, and North Korea’s cumulative stolen amount reached $6.75 billion. Another notable development in 2025 was the DOJ’s subpoenas to early Tornado Cash users, suggesting an enforcement route that targets users rather than only protocols.
HTX Research argues that the real center of on-chain enforcement power is not limited to governments. Between 2022 and 2026, Chainalysis, TRM Labs, Elliptic and Merkle Science moved from address-labeling tools to extensions of quasi-judicial power. When an address is labeled “high risk,” an exchange can freeze the account, a USDT issuer can freeze the assets, and the affected user has almost no appeal channel. Chainalysis covers more than 27 blockchains; its Reactor tool is used by more than 1,500 agencies including the FBI, DOJ and IRS; it holds about 45% of the global enforcement share; and its knowledge graph links more than 1 billion addresses to more than 134,000 real-world entities. TRM Labs monitors more than 75% of global crypto transaction volume.
The Beacon Network, launched in 2025, represents the next stage of compliance infrastructure. It connects Tether, TRON, the T3 Financial Crime Unit and other core participants into the same data layer. In theory, it can compress the freeze-to-destroy window from hours to minutes. The institutional flaw, according to the research, is the absence of outside oversight. Blockchain analytics firms collect evidence and act as factual arbiters at the same time. Their labels directly affect whether an address is frozen and whether a person is denied service, yet there is no independent appeal mechanism.
Stablecoin issuers hold another concentrated form of power. Tether’s USDT smart contract includes three functions: addBlackList, removeBlackList and destroyBlackFunds. In 2025, Tether blacklisted 4,163 addresses, froze $1.26 billion and permanently destroyed $698 million. During that year, 96.4% of blacklisted addresses were never removed from the blacklist. The TRON network’s multisignature wallet freeze process had a 44-minute delay window, which HTX Research describes as a system gap that can become a survival window for ordinary users. As stablecoin issuers upgrade multisig structures, on-chain assets become more controllable in a way that increasingly resembles traditional bank accounts.
On the regulatory framework side, the research identifies Europe as the winner of the past four years and the United States as the loser. The difference is not only legislative speed but regulatory philosophy. Europe built a complete system through MiCA, which was passed in May 2023, implemented in phases in 2024 and fully landed in 2025. MiCA covers CASP licensing, stablecoin reserve disclosure and the extension of the FATF Travel Rule. AMLA began operating in 2025 and will directly supervise high-risk CASPs from 2028. MiCA’s core value is not only strictness but legal certainty: institutional capital can allocate under known rules, and fiat-pegged stablecoins can operate within a compliance framework.
The United States spent the same period in political division. In July 2025, the House of Representatives passed the Digital Asset Market Clarity Act, or CLARITY Act, by 294 votes to 134. The bill establishes the division of jurisdiction between the SEC and CFTC, a safe harbor for DeFi developers and the legal status of self-custody wallets. As of April 2026, it was still stalled in the Senate Banking Committee. The divide between the two parties is not whether to regulate, but who should regulate. From 2024 to 2026, SEC lawsuits against Coinbase, Robinhood and Uniswap consumed major regulatory resources. The SEC partially lost in the Ripple case and was forced to withdraw multiple claims in the Coinbase case, increasing legal uncertainty for the U.S. crypto industry.
Chainalysis’ 2026 report adds another uncomfortable data point: in 2025, sanctioned-entity activity accounted for 68% of all illicit crypto transaction volume. HTX Research states that today’s on-chain enforcement is not only fighting hackers and scammers, but also three sovereign states: North Korea, Russia and Iran. North Korea stole $2 billion in 2025 and $6.75 billion cumulatively. Its methods evolved from exploiting code vulnerabilities to impersonating recruiters and infiltrating IT roles at crypto companies. Russia’s approach was more systematic: the A7A5 ruble-pegged stablecoin processed $93.3 billion in transaction volume within four months of launch, while Garantex continued operating through technical means after joint sanctions. Iran used proxy armed organizations for more than $2 billion in money laundering, illegal oil sales and weapons procurement.
The industry is divided over the deepening of on-chain enforcement. Major exchanges such as Coinbase and Kraken embrace compliance and treat OFAC compliance, KYT screening and proof-of-reserves disclosure as competitive barriers. Decentralized protocols such as Uniswap and Curve maintain a code-neutral position and argue that the protocol layer should not bear compliance obligations. Privacy protocols such as Tornado Cash and Aztec challenge the legitimacy of on-chain enforcement at a more fundamental level. The split is not simply between compliance and anti-compliance camps; it is a clash between centralized finance logic and decentralized-native logic.
The core disagreements focus on three questions. The first is where the boundary lies between on-chain privacy rights and financial regulatory authority. MiCA requires all CASPs to perform KYC, cutting off much privacy demand at the entry point, while DeFi front ends and self-custody wallets remain in a gray zone. The second is whether protocol neutrality provides legal immunity. The Tornado Cash case gives a partial negative answer: immutable code cannot be sanctioned as property, but services with operators can be pursued. The third is how to oversee the quasi-judicial power of stablecoin issuers. Tether froze $1.26 billion in 2025 and did not remove 96.4% of addresses from the blacklist that year, with no independent audit or appeal mechanism described in the process.
Technically, on-chain enforcement rests on the labeling capacity of analytics platforms. Chainalysis Reactor, TRM Labs’ TRM Forensics and Elliptic Navigator have become standard tools for global enforcement agencies. A typical labeling process includes address clustering, fund tracing, risk scoring and cross-chain tracking. Once an address is marked “high risk,” the chain reaction can move from an analytics platform to a USDT or USDC issuer freeze, then to exchange KYC account freezes, OTC service denial and bank rejection of related funds. This chain can be completed within hours and crosses both traditional finance and crypto finance.
HTX Research summarizes the 2022-2026 evolution into four structural shifts: from list-based sanctions to risk-tiered management; from single-jurisdiction actions to multilateral coordination; from pursuing protocols to pursuing individuals; and from confrontation to co-governance. The Garantex case and the Bybit theft exposed the limits of unilateral sanctions, while AMLA, FATF strengthening, Beacon Network and the Basel Committee’s review of bank crypto-asset exposure point toward broader coordination. At the same time, the Samourai Wallet case and the Roman Storm trial place personal liability for developers and operators at the center of the next stage of enforcement.
The report closes with operational suggestions for individual users. Users should avoid direct interaction with mixers, refrain from approving unlimited permissions on unknown DEXs, use European exchanges with MiCA licenses as preferred entry points, choose bank transfers for fiat entry where available, and distribute on-chain assets between hardware wallets and multiple trusted custodians. The aim is to reduce the risk that a single freezing event causes a total loss of accessible assets.