OFAC crypto sanctions tracker

OFAC designated Russian nationals Ilya Boykov and Vitold Obertas and DPRK national Kim Ki Hyok, who leads a Russia-based delegation of DPRK IT workers, under North Korea authorities. Treasury says Boykov exchanged and converted about $3.5 million in cryptocurrency for DPRK IT company Alis and Obertas conducted nearly $2 million in crypto conversions for illicit DPRK transactions.

Listed: BOYKOV, Ilya Aleksandrovich; KIM, Ki Hyok; OBERTAS, Vitold Viktorovich

OFAC sanctioned a financial network of the Foreign Terrorist Organization Tren de Aragua which, per Treasury, stole millions from U.S. banks; the operation is orchestrated by Anibal Alexander Canelon Aguirre. Each of the seven designated individuals is listed with a TRON (TRX) address.

Listed: CANELON AGUIRRE, Anibal Alexander; CARDENAS ARZOLA, Eric Gabriel; GALEANO BAZURTO, Jose Dario; HERNANDEZ GUERRERO, Anthony Wuiliam; MARTINEZ ARMENTA, Carlos Javier; MARTINEZ PIRONA, Oscar Leonardo …

OFAC designated Xinbi Guarantee, a Chinese-language online marketplace that Treasury says is used extensively by cybercriminals to support cyber scams, fraud and money laundering, as a significant transnational criminal organization under E.O. 13581. Its SDN entry lists 52 TRON (TRX) addresses.

Listed: XINBI GUARANTEE

As part of a broad Iran action, OFAC designated individuals listed with digital currency addresses, including members of a group led by Behzad Mesri that Treasury says conducts computer network exploitation for Iran's Ministry of Intelligence and Security; Mesri's existing entry was updated with 15 new addresses.

Listed: BLAGH, Keyvan Fayyaz Gareh; GHAL'EH-KUHI, Mojtaba; KAHZADIAN, Arman; TSORIS, Almpertos; MESRI, Behzad (update)

OFAC designated Siavash Kayvanpour and companies he controls, including Georgia-based SHPS Shelbit (operator of Shelbit Exchange) and UAE-based Crypto Home DMCC, under counterterrorism authority. Treasury says IRGC-linked addresses sent the equivalent of over $1 million to Shelbit Exchange addresses.

Listed: KAYVANPOUR, Siavash; CRYPTO HOME DMCC; SHPS SHELBIT

In an action against Muslim Brotherhood and Hamas financial networks, OFAC designated Türkiye-based Zaid Issam Ahmed Al-Jebouri, a shareholder of El-Kahira, which Treasury says provided underground banking in fiat and cryptocurrency to Sweden-based organized crime groups such as Foxtrot Network. Seven TRON addresses are listed.

Listed: AL-JEBOURI, Zaid Issam Ahmed

OFAC updated the existing SDN entry of Bank Markazi Jomhouri Islami Iran (Central Bank of Iran) with four additional TRON (TRX) addresses. The same-day press release does not discuss the crypto listing.

Listed: BANK MARKAZI JOMHOURI ISLAMI IRAN

OFAC designated First VPN Service (1VPNS), which Treasury describes as a VPN provider selling services to ransomware groups, and its administrator Dmytro Rashevskyi under cyber authorities. 20 addresses across eight currencies are listed.

Listed: RASHEVSKYI, Dmytro; FIRST VPN SERVICE

OFAC updated the existing SDN entry of ISIL Khorasan (FTO, SDGT) with 134 digital currency addresses (131 TRX, 3 XMR). The press release linked on the OFAC page covers other designations and does not discuss this update.

Listed: ISIL KHORASAN

OFAC designated France-based Miloud Abderrahmane, whom Treasury identifies as one of several individuals who facilitated transactions for ISIS. Two TRON addresses are listed.

Listed: ABDERRAHMANE, Miloud

OFAC designated Armando de Jesus Ojeda Aviles, who Treasury says leads a network laundering fentanyl proceeds for the Sinaloa Cartel, and associate Rodrigo Alarcon Palomares; the network brokered bulk transfers of drug proceeds through digital currency addresses. Six ETH addresses are listed.

Listed: OJEDA AVILES, Armando de Jesus; ALARCON PALOMARES, Rodrigo

OFAC updated the existing SDN entry of Bank Markazi Jomhouri Islami Iran (Central Bank of Iran) with two TRON (TRX) addresses. The same-day press release does not discuss the crypto listing.

Listed: BANK MARKAZI JOMHOURI ISLAMI IRAN

OFAC targeted DPRK IT worker networks, designating DPRK IT company Amnokgang Technology Development Company, Laos-based IT worker group leader Yun Song Guk and associate Hoang Minh Quang; it also added 11 addresses to the existing entry of Sim Hyon Sop.

Listed: AMNOKGANG TECHNOLOGY DEVELOPMENT COMPANY; YUN, Song Guk; HOANG, Minh Quang; SIM, Hyon Sop (update)

In an action against Iranian regime officials, OFAC designated Zedcex Exchange Ltd, a UK-registered digital asset exchange that Treasury links to Iranian businessman Babak Zanjani and says has processed over $94 billion in transactions since August 2022. Seven TRON addresses are listed.

Listed: ZEDCEX EXCHANGE LTD

OFAC sanctioned former Canadian Olympian Ryan Wedding and his drug trafficking organization, including Canadian jeweler Rolan Sokolovski, whom Treasury describes as a chief money launderer who laundered the organization's funds. 12 addresses across five currencies are listed.

Listed: WEDDING, Ryan James; SOKOLOVSKI, Rolan

In a joint U.S.-Australia-UK action against Russian cybercrime infrastructure supporting ransomware, OFAC designated Aleksandr Volosovik, general director of Media Land, who Treasury says provided servers to ransomware and DDoS actors. One XBT address is listed.

Listed: VOLOSOVIK, Aleksandr Aleksandrovich

OFAC updated the existing SDN entry of North Korea's Cheil Credit Bank [DPRK4] with 53 USDT addresses, on the same day Treasury sanctioned DPRK bankers and institutions involved in laundering cybercrime proceeds and IT worker funds.

Listed: CHEIL CREDIT BANK

OFAC updated the SDN entry of Chen Zhi, head of the Prince Group transnational criminal organization designated on 14 Oct 2025, adding 25 XBT addresses.

Listed: CHEN, Zhi

In what Treasury calls the largest action ever against Southeast Asian cybercriminal networks, OFAC designated the Cambodia-based Prince Group as a transnational criminal organization along with its leader Chen Zhi, for online investment scams targeting Americans. Four XBT addresses are listed on Chen Zhi's entry.

Listed: CHEN, Zhi

OFAC sanctioned Indian national Sadiq Abbas Habib Sayyed for supplying counterfeit prescription pills containing fentanyl to victims across the United States. One TRON address is listed.

Listed: SAYYED, Sadiq Abbas Habib

OFAC designated Iranian nationals Arash Estaki Alivand and Alireza Derakhshan, who Treasury says coordinated the purchase of over $100 million in cryptocurrency for oil sales for the Iranian government between 2023 and 2025. Seven ETH and TRX addresses are listed.

Listed: ALIVAND, Arash Estaki; DERAKHSHAN, Alireza

OFAC sanctioned Huang Xiaojun, a representative of China-based Guangzhou Tengyue, who Treasury says coordinated shipments of illicit drugs and cutting agents to the United States. One XBT address is listed.

Listed: HUANG, Xiaojun

OFAC sanctioned Russian national Vitaliy Sergeyevich Andreyev, among others, for roles in a fraudulent IT worker scheme orchestrated by the DPRK government. One XBT address is listed.

Listed: ANDREYEV, Vitaliy Sergeyevich

OFAC re-designated the Garantex exchange, designated its successor Grinex, and sanctioned Kyrgyz firm Old Vector, issuer of the ruble-backed A7A5 token, for enabling sanctions evasion and cybercrime. Garantex's entry gained nine new addresses; Grinex and Old Vector are listed with nine more.

Listed: GRINEX; OLD VECTOR LLC; GARANTEX EUROPE OU (update)

OFAC designated Aeza Group, a bulletproof hosting provider that Treasury says supports cybercriminal activity targeting victims in the U.S. and worldwide. One TRON address is listed.

Listed: AEZA GROUP LLC

OFAC sanctioned Philippines-based Funnull Technology Inc., which Treasury says provides computer infrastructure for hundreds of thousands of websites involved in virtual currency investment scams ('pig butchering'), along with its administrator. One ETH and one TRX address are listed.

Listed: FUNNULL TECHNOLOGY INC

Alongside sanctions on a Houthi procurement network, OFAC said it identified eight digital asset wallets used by the Houthis and added eight USDT addresses to the existing Ansarallah entry (FTO, SDGT).

Listed: ANSARALLAH

OFAC removed Tornado Cash and its 90 ETH smart-contract addresses (listed under CYBER2 and DPRK3) from the SDN List. The Roman Semenov entry was updated the same day.

Listed: TORNADO CASH

OFAC sanctioned Iran-based Behrouz Parsarad, the sole administrator of the Nemesis darknet marketplace taken down by law enforcement in 2024, under the illicit drugs program. 49 XBT and XMR addresses are listed.

Listed: PARSARAD, Behrouz

The U.S., Australia and the UK jointly designated Russia-based bulletproof hosting provider Zservers for its role in supporting LockBit ransomware attacks, together with associated Russian nationals. Four XBT addresses are listed.

Listed: ZSERVERS; MISHIN, Alexander Igorevich

OFAC updated the entry of IRGC-QF-backed Houthi financial official Sa'id al-Jamal with five USDT addresses; Treasury's release refers to wallets associated with al-Jamal.

Listed: AL-JAMAL, Sa'id Ahmad Muhammad

OFAC exposed a Russia-linked money laundering network (TGR Group) using digital assets to evade sanctions, designating persons including Elena Chirkinyan, a decision maker in TGR Group; Treasury says the network used sanctioned exchange Garantex for USDT transactions after its designation.

Listed: CHIRKINYAN, Elena; MAGOMEDOV, Khadzhi Murat Dalgatovich

In coordinated actions against illicit Russian virtual currency exchanges and a cybercrime facilitator, OFAC designated the exchange Cryptex and Russian national Sergey Ivanov under cyber and Russia authorities (PM2BTC was targeted the same day by FinCEN, not OFAC). Four addresses (XBT, ETH, LTC, TRX) are listed on Cryptex's entry.

Listed: CRYPTEX

As part of action against Russia's international supply chains, OFAC designated OOO Konstruktorskoe Byuro Vostok, which Treasury says develops the Scalpel one-way-attack UAV used by Russian forces in Ukraine. One USDT address is listed.

Listed: OBSHCHESTVO S OGRANICHENNOI OTVETSTVENNOSTYU KONSTRUKTORSKOE BYURO VOSTOK

OFAC sanctioned a cybercrime network associated with the 911 S5 botnet, including Yunhe Wang, under cyber authorities. 49 addresses are listed on Wang's entry.

Listed: WANG, Yunhe

OFAC sanctioned Dmitry Yuryevich Khoroshev, a senior leader of the LockBit ransomware group, under cyber authorities. One XBT address is listed.

Listed: KHOROSHEV, Dmitry Yuryevich

In a package of nearly 300 Russia-related sanctions, OFAC designated OKO Design Bureau, which Treasury says develops cheap multifunctional UAVs including a one-way attack UAV. Three addresses (XBT, ETH, TRX) are listed.

Listed: OKO DESIGN BUREAU

OFAC sanctioned a Hamas-aligned fundraising network including Gaza Now, which Treasury says engaged in fundraising to support Hamas after the 7 October 2023 attack. Eight addresses (USDT, ETH, XBT) are listed.

Listed: GAZA NOW

OFAC designated Lebanon-based Syrian money exchanger Tawfiq Muhammad Sa'id al-Law, who Treasury says provided Hizballah with digital wallets to receive funds from IRGC-QF commodity sales. One USDT address is listed.

Listed: AL-LAW, Tawfiq Muhammad Sa'id

OFAC designated Ilya Gambashidze, founder of Moscow-based Social Design Agency, for a persistent foreign malign influence campaign at the direction of the Russian Presidential Administration. Two USDT addresses are listed.

Listed: GAMBASHIDZE, Ilya Andreevich

OFAC sanctioned two affiliates of the Russia-based LockBit ransomware group, Ivan Kondratiev and Artur Sungatov, under cyber authorities. Ten addresses (XBT, ETH) are listed.

Listed: KONDRATIEV, Ivan Gennadievich; SUNGATOV, Artur Ravilevich

OFAC sanctioned the virtual currency mixer Sinbad, which Treasury says was used by the DPRK's Lazarus Group to launder stolen virtual currency. Two XBT addresses are listed.

Listed: SINBAD

OFAC designated Russian national Ekaterina Zhdanova, a virtual currency money launderer for Russian elites and cybercriminals, under Russia authorities. Three XBT addresses are listed.

Listed: ZHDANOVA, Ekaterina Valeryevna

After the Hamas attack on Israel, OFAC sanctioned Hamas operatives and facilitators including Gaza-based Buy Cash Money and Money Transfer Company, which Treasury says provides money transfer and virtual currency exchange services. One XBT address is listed.

Listed: BUY CASH MONEY AND MONEY TRANSFER COMPANY

OFAC targeted a large China-based network of illicit drug producers, designating individuals and entities including Canada-based Valerian Labs. 19 addresses across five currencies are listed.

Listed: SHEN, Xingbiao; WANG, Jiantong; WANG, Mingming; XIA, Fengbing; ZHANG, Wei; VALERIAN LABS, INC.

OFAC designated Mario Alberto Jimenez Castro, who Treasury says operates a money laundering organization using virtual currency and wire transfers to move fentanyl proceeds for the Sinaloa Cartel's Chapitos faction. One ETH address is listed.

Listed: JIMENEZ CASTRO, Mario Alberto

OFAC designated Roman Semenov, a co-founder of the sanctioned virtual currency mixer Tornado Cash, under cyber and DPRK authorities. Eight ETH addresses are listed.

Listed: SEMENOV, Roman

In designating leaders and financial facilitators of ISIS and al-Qa'ida cells in the Maldives, OFAC listed Ali Shafiu, who Treasury says joined ISIS-K and was part of its media office as recently as 2022. One USDT address is listed.

Listed: SHAFIU, Ali

Targeting DPRK malicious cyber and illicit IT worker activities, OFAC designated Kim Sang Man, who Treasury says received cryptocurrency transfers from DPRK IT teams and was involved in paying salaries to families of overseas DPRK workers. Six addresses are listed.

Listed: KIM, Sang Man

In a package of over 300 Russia-related sanctions, OFAC designated Irish national John Desmond Hanafin, founder and CEO of Huriya, who Treasury says facilitated the movement of Russian money into the UAE. One USDT address is listed.

Listed: HANAFIN, John Desmond

OFAC designated Wu Huihui for providing material support to the Lazarus Group, and Sim Hyon Sop for acting on behalf of Korea Kwangson Banking Corp. 20 addresses (XBT, ETH, ARB, BSC) are listed.

Listed: WU, Huihui; SIM, Hyon Sop

In sanctions on suppliers of precursor chemicals for fentanyl production, OFAC designated Wang Hongfei, who Treasury says owns a wallet used to receive bitcoin payments for illicit drug transactions. One XBT address is listed.

Listed: WANG, Hongfei

OFAC updated the existing SDN entry of Hebei Atun Trading Co., Ltd. [ILLICIT-DRUGS-EO14059] with one XBT address.

Listed: HEBEI ATUN TRADING CO., LTD.

OFAC targeted a global sanctions evasion network led by arms dealer Igor Zimenkov that supports Russia's military-industrial complex, designating his son Jonatan Zimenkov among others. Two addresses (XBT, ETH) are listed.

Listed: ZIMENKOV, Jonatan

In the first use of E.O. 14059 against online and darknet drug sales, OFAC designated Matthew Simon Grimm, Alex Peijnenburg and others for supplying fentanyl and other synthetic drugs to U.S. markets. 66 addresses (XBT, ETH, BCH) are listed.

Listed: GRIMM, Matthew Simon; PEIJNENBURG, Alex Adrianus Martinus

OFAC removed the August 2022 Tornado Cash entries and re-designated Tornado Cash under both cyber (CYBER2) and DPRK (DPRK3) authorities, adding a basis for its support for DPRK activities; the new entry lists 90 ETH addresses.

Listed: TORNADO CASH

OFAC designated Task Force Rusich, which Treasury describes as a neo-Nazi paramilitary group that has fought alongside Russia's military in Ukraine. Five addresses (XBT, ETH, USDT) are listed.

Listed: TASK FORCE RUSICH

OFAC sanctioned IRGC-affiliated cyber actors for roles in ransomware activity, listing bitcoin addresses for Ahmad Khatibi Aghada and Amir Hossein Nikaeen Ravari.

Listed: KHATIBI AGHADA, Ahmad; NIKAEEN RAVARI, Amir Hossein

OFAC sanctioned the virtual currency mixer Tornado Cash under cyber authorities, listing Ethereum and USDC smart-contract and wallet addresses.

Listed: TORNADO CASH

In its first-ever sanctions on a virtual currency mixer, OFAC designated Blender.io, which Treasury says the DPRK uses to support its malicious cyber activities and launder stolen virtual currency, and added four ETH addresses to the Lazarus Group entry.

Listed: BLENDER.IO; LAZARUS GROUP (update)

OFAC updated the existing Lazarus Group SDN entry [DPRK3] with three additional ETH addresses.

Listed: LAZARUS GROUP

OFAC updated the existing Lazarus Group SDN entry [DPRK3] with one ETH address.

Listed: LAZARUS GROUP

OFAC sanctioned Russia-based Hydra, which Treasury calls the world's largest darknet market, and the ransomware-enabling virtual currency exchange Garantex. 120 addresses (mostly XBT) are listed.

Listed: HYDRA MARKET; GARANTEX EUROPE OU

As part of a whole-of-government effort against ransomware, OFAC designated the virtual currency exchange Chatex and Sodinokibi/REvil ransomware operators Yevgeniy Polyanin and Yaroslav Vasinskyi, and added addresses to the existing entries of Artem Lifshits and SouthFront.

Listed: CHATEX; POLYANIN, Yevgeniy Igorevich; VASINSKYI, Yaroslav; LIFSHITS, Artem Mikhaylovich (update); SOUTHFRONT (update)

As part of actions to counter ransomware, OFAC designated virtual currency exchange SUEX OTC, S.R.O. for its role in facilitating financial transactions for ransomware actors. 25 addresses (XBT, ETH, USDT) are listed.

Listed: SUEX OTC, S.R.O.

OFAC designated Farrukh Fayzimatov, who Treasury says uses social media to recruit and solicit donations for HTS, under counterterrorism authority. One XBT address is listed.

Listed: FAYZIMATOV, Farrukh Furkatovitch

OFAC sanctioned entities and individuals that attempted to influence the 2020 U.S. presidential election at the direction of the Russian government, including disinformation site SouthFront, Prigozhin front company AFRIC and fraudulent-identity provider SecondEye Solution and Pakistani national Mujtaba Raza. 27 addresses are listed.

Listed: SOUTHFRONT; ASSOCIATION FOR FREE RESEARCH AND INTERNATIONAL COOPERATION; SECONDEYE SOLUTION; RAZA, Mujtaba Ali

OFAC sanctioned two Russian nationals, Danil Potekhin and Dmitrii Karasavidi, for a 2017-2018 phishing campaign against customers of virtual asset service providers that Treasury says caused losses of at least $16.8 million. 12 addresses across eight currencies are listed.

Listed: POTEKHIN, Danil; KARASAVIDI, Dmitrii

OFAC sanctioned Russia-linked election interference actors, including Internet Research Agency-linked Artem Lifshits and Anton Andreyev, under cyber and election interference authorities. 23 addresses are listed.

Listed: LIFSHITS, Artem Mikhaylovich; ANDREYEV, Anton Nikolaeyvich

OFAC sanctioned Chinese nationals Tian Yinyin and Li Jiadong for laundering cryptocurrency stolen by the DPRK's Lazarus Group. 20 XBT addresses are listed.

Listed: TIAN, Yinyin; LI, Jiadong

OFAC targeted Chinese drug kingpins fueling the U.S. opioid crisis, designating members of the Zheng drug trafficking organization under the Kingpin Act. 12 addresses (XBT, LTC) are listed.

Listed: ZHENG, Fujing; ZHENG, Guanghua; YAN, Xiaobing

OFAC designated Iran-based Ali Khorashadizadeh and Mohammad Ghorbaniyan for helping exchange bitcoin ransom payments from the SamSam ransomware scheme, and for the first time identified associated digital currency addresses.

Listed: KHORASHADIZADEH, Ali; GHORBANIYAN, Mohammad