OFAC Sanctions List: How It Works for Crypto

Summary

• The OFAC sanctions list is the U.S. Treasury's public register of people, companies, vessels and crypto addresses that U.S. persons must not deal with, and whose assets must be frozen once they touch the U.S. system.

• Anyone can search it for free with Treasury's Sanctions List Search tool, and a crypto address can be checked by pasting it into the tool's ID # field.

• All U.S. persons must comply, and so must foreign firms whose transactions touch the U.S. Liability is strict, so an exchange that receives sanctioned funds is expected to freeze and report them even if it had no way of knowing.

• OFAC has listed crypto addresses since 2018, but each listing names only a few wallets, so tools like Arkham trace the wider cluster and the funds that pass through it.

How to Check Crypto Addresses for Sanctions Exposure With Arkham

The walkthrough below uses Garantex, a Russia-based exchange OFAC sanctioned in April 2022 and again in August 2025. If you’re new to Arkham, start with our guide on How to Use Arkham Intel.

1. Look up the sanctioned entity: Type "Garantex" into Arkham's search bar and open the entity page. The page groups every address Arkham attributes to the exchange, with balances and transfer history across chains, and flags the entity as “OFAC Sanctioned” in its tags.

2. Review the cluster and its counterparties: Open the Top Counterparties tab to see which wallets and services sent funds to Garantex or received funds from it. Labelled counterparties, such as other exchanges or OTC desks, show where sanctioned money has flowed.

3. Check an address with indirect exposure: Pick an address that does not appear on the SDN list but has transacted with Garantex, and copy its address. Using Arkham’s API, Arkham's risk score rates it from 0 to 100 and breaks the score down by category, including its exposure to sanctioned addresses such as ones controlled by Garantex.

4. Set an alert. Create an alert on the sanctioned entity or the exposed address so Arkham notifies you when funds move. These alerts can be further filtered down by specific tokens, chains, senders and recipients, and transaction values, for more granularity.

OFAC generally only names a handful of addresses per entity. Garantex's first SDN entry, in April 2022, listed three. Its revised entry in August 2025 listed 12, with seven more for its successor Grinex. Yet the DOJ alleges Garantex changed its operational wallets daily to stop U.S. exchanges from blocking them. Arkham attributes the wider cluster, 208K addresses at the time of writing, and the funds that move through it.

What Is the OFAC Sanctions List?

The OFAC sanctions list is a set of public records naming the targets of U.S. economic sanctions, published by the Treasury's Office of Foreign Assets Control (OFAC).

OFAC is the Treasury office that turns U.S. foreign policy and national security goals into financial restrictions. Its main tool is the Specially Designated Nationals and Blocked Persons List, or SDN list. For any name or address listed on it, all U.S. persons are prohibited from dealing with that party, and any of its property they hold must be frozen in place. OFAC also runs several narrower lists, gathered together as the non-SDN Consolidated Sanctions List. These include the Foreign Sanctions Evaders List and the Sectoral Sanctions Identifications List, which restrict only specific dealings rather than completely cutting off access to them.

The list is also wider than it looks. Under OFAC's 50 Percent Rule, any entity owned 50% or more in total by one or more blocked persons is itself blocked, whether or not it appears by name.

How to Search the OFAC Sanctions List

Treasury's Sanctions List Search tool is free and does not require an account. It covers the SDN list and the non-SDN lists in one place.

1. Search by name. Type a person, company or exchange into the Name field. The name search uses fuzzy logic, so it returns close spellings as well as exact ones, and each result must then be reviewed by hand.

2. Search by address. Paste a crypto address into the ID # field and click Search. OFAC's FAQ 594 notes that this field does not use fuzzy logic: only an exact, character-for-character match comes back.

3. Open the entry. Each result links to a full SDN record. Crypto addresses appear in the identification section in a fixed format: "Digital Currency Address", a dash, then the asset's ticker, such as "Digital Currency Address - XBT" for Bitcoin or "- TRX" for TRON.

The search tool covers all entities and addresses that are currently on the list, but to find what recent additions were included in the list, users can check OFAC's Recent Actions page. Each action prints the full SDN entries added, so users can look directly for lines beginning with "Digital Currency Address". Alternatively, users can also download the SDN list or the archived delta files from OFAC's Sanctions List Service and filter for the same phrase. This is the most reliable way to catch every address at scale.

Finally, OFAC also publishes formal notices of designations on the Federal Register. A July 15, 2026 notice, for example, listed Bitcoin, Ethereum, Litecoin, Solana and TRON addresses for three ransomware-linked targets.

History of OFAC and Crypto Addresses

OFAC's crypto listings began with a ransomware case and now cover exchanges, mixers, state hackers and central banks.

November 28, 2018: OFAC sanctioned two Iran-based men who cashed out SamSam ransomware payments, and identified two Bitcoin addresses tied to them. Treasury called it the first time OFAC had publicly attributed digital currency addresses to designated individuals.

September 21, 2021: SUEX became the first crypto exchange designated, for its role in processing ransomware proceeds.

April 5, 2022: OFAC sanctioned Russian exchange, Garantex, listing three of its addresses. The exchange was linked to the darknet marketplace, Hydra Market ($2.6 million flows), and the Russian ransomware, Conti ($6 million flows).

April 14, 2022: OFAC added an Ethereum address to the existing Lazarus Group entry, tying North Korea to the Ronin bridge theft.

August 8, 2022: OFAC sanctioned Tornado Cash and listed its smart contracts. However, after a federal appeals court ruled that immutable contracts were not property OFAC could block, the U.S. Treasury delisted it on March 21, 2025.

April 24, 2026: OFAC listed two TRON wallets as property of the Central Bank of Iran, and about $344 million in USDT was frozen. Arkham has since mapped them as a Central Bank of Iran entity, with the number of addresses rising to 6, and the amount frozen to $474 million.

OFAC does not publish how it attributes an address, but it does mention that its listings "are not likely to be exhaustive", and that anyone holding funds in a wallet they believe belongs to a sanctioned party must block and report them anyway. Our Crypto Sanctions 101 guide covers how designations and freezes work in greater detail.   

Who Must Comply With OFAC Sanctions?

All U.S. persons must comply with OFAC sanctions, and so must foreign companies whenever a transaction has a U.S. nexus. U.S. persons include U.S. citizens and permanent residents wherever they live, companies organized under U.S. law and their foreign branches, and anyone physically in the United States. OFAC's 2021 Sanctions Compliance Guidance for the Virtual Currency Industry applies these rules to exchanges, wallet providers, miners and ordinary users alike.

The standard is strict liability. A company can be penalized for a sanctions violation even if it is unaware that its counterparty was sanctioned. Intent and diligence can affect the size of a penalty, but not whether a violation happened.

For an exchange, that has practical consequences. A deposit from a sanctioned address cannot be returned to the sender or quietly passed on. It must be frozen, with no party given access, and reported to OFAC within 10 business days, then reported annually for as long as it stays blocked. Accounts tied to sanctioned persons are blocked the same way. The costs of failure can be large. In November 2023, Binance agreed to pay $968.6 million to settle 1,667,153 apparent sanctions violations involving users in sanctioned jurisdictions.

OFAC Sanctions Screening for Crypto Businesses

Sanctions screening in crypto means checking both who a customer is and where their funds have been.

Direct exposure is a transfer to or from an address OFAC has listed. Indirect exposure is one or more hops removed: a wallet that received funds from a sanctioned address and then sent them to you. Indirect exposure is not automatically a violation, but it is often how sanctioned funds reach regulated platforms, and it is usually where screening tools focus.

Screening a customer's name and wallet addresses at sign-up catches known risks. But, it is unable to catch an address that becomes sanctioned next month. OFAC's 2021 guidance suggests a historic lookback whenever it lists a new address, since past deposits can turn out to have come from a now-blocked party.

It should be noted that the SDN list's ID # search returns only perfect matches, and OFAC itself says its address listings are unlikely to be complete. Sanctioned actors also regularly rotate wallets, route funds through mixers and chain hops to cover their on-chain trails. Garantex is alleged to have rotated addresses on a daily basis to avoid regulatory action on their transactions. A list check is necessary, but it covers only the addresses OFAC chose to publish.

Our guides to wallet screening and transaction monitoring cover each layer in detail, and blockchain forensics explains how investigators follow exposure across hops.

For the basics of why on-chain funds can be followed at all, see Is Bitcoin Traceable?

Arkham’s Transaction Monitoring Dashboard

An SDN search is limited because it can only confirm whether an address is on OFAC’s list. As discussed above, sanctioned entities may cycle through many different addresses that never get added to the list. Compliance teams cannot just rely on the addresses published by OFAC, they need to implement Risk Scoring. 

Arkham’s Transaction Monitoring API dashboard is a solution for this because it screens the transfers themselves. It runs in the browser on an Arkham API key, with no integration required.

• Choose what to monitor: Search for entities or addresses, or paste in a list of your own wallets, such as an exchange’s deposit addresses. Then select the risk categories to screen for, including sanctions, hacker, ransomware, mixers and darkweb markets.

• Review the feed: The dashboard pulls the latest transfers in and out and scores every counterparty. Each row shows how many hops separate it from a flagged source, such as “2 hops - Sanctions.” This captures the indirect exposure that an exact-match list check misses. New transfers are screened as they arrive.

• Investigate alerts: Click a flagged transfer to follow the trace hop by hop to its source. Arkham attributes whole clusters, so funds from wallets Garantex rotated into after its listing are still flagged.

• Integrate: Each card shows the API requests behind it. Teams can connect the same screening to Arkham’s WebSocket API and check deposits as they land.

Conclusion

The OFAC sanctions list is public, free to search and the legal starting point for any crypto compliance program. However, it names only the wallets OFAC chooses to publish, and sanctioned money rarely stays in them. In crypto, sanctions exposure spreads to wallets the list never names, which makes OFAC's published addresses the start of a trace rather than the end of one.