OFAC Crypto Sanctions Address Checker
Check Sanction Status
Enter a cryptocurrency wallet address to verify if it's on the OFAC SDN list. Note: This is a demonstration tool using sample data. Always use official OFAC feeds for real compliance.
Key Takeaways
- The OFAC SDN list now contains over 1,200 crypto wallet addresses across 17 blockchains.
- Real‑time screening (updates every 15 minutes) is the industry standard for U.S. exchanges.
- DeFi protocols, DAOs, and even AI‑driven trading bots are now subject to sanctions.
- Traditional financial sanctions focus on institutions; crypto sanctions pinpoint individual addresses.
- Compliance teams need to ingest OFAC’s XML feed, support layer‑2 networks, and monitor stablecoins like USDT and USDC.
When you hear "OFAC crypto sanctions," you might picture a long list of names on a spreadsheet. In reality, it’s a constantly shifting web of wallet addresses, smart contracts, and even whole decentralized organisations that the U.S. Treasury’s Office of Foreign Assets Control (OFAC) has marked as off‑limits. If you run a crypto exchange, a DeFi platform, or even a fintech app that lets users move tokens, you need a clear picture of how the sanctions list works, which addresses are blocked, and what you must do to stay compliant.
What is the OFAC sanctions list?
OFAC sanctions list is a set of designations published by the Office of Foreign Assets Control, a bureau of the U.S. Department of the Treasury. The list flags individuals, entities, vessels, and increasingly, cryptocurrency wallet addresses that are prohibited from doing business with U.S. persons or accessing the U.S. financial system.
The core of the crypto‑focused effort lives in the Specially Designated Nationals (SDN) section of the list. As of October 2025, the SDN list includes more than 1,200 wallet addresses spanning Bitcoin, Ethereum, Monero, and a host of newer tokens.
How OFAC targets crypto addresses
Unlike a traditional bank account, a crypto wallet is a string of alphanumeric characters on a public ledger. To block a bad actor, OFAC simply adds that exact address to the SDN list. The challenge for compliance teams is that an address can appear on multiple blockchains (e.g., a wrapped token) or be obscured behind a privacy coin.
Key points about the current scope:
- Seventeen blockchain families are covered, from Bitcoin (XBT) and Ethereum (ETH) to newer ecosystems like Arbitrum (ARB) and Binance Smart Chain (BSC).
- Stablecoins (USDT, USDC) are heavily monitored because they enable quick cross‑border value transfer.
- DeFi protocols, DAOs, and even AI‑driven autonomous trading bots can be designated.
- Layer‑2 networks (e.g., Optimism, zkSync) are now part of the OFAC Blacklist v2.0, closing a previous loophole.
Each address in the SDN feed carries a risk score (low, medium, high) that helps platforms prioritize alerts.
Major crypto types covered
Below is a quick rundown of the 17 assets that OFAC presently monitors. These are the tokens most likely to appear in a sanction designation.
- Bitcoin (XBT)
- Ethereum (ETH)
- Monero (XMR)
- Litecoin (LTC)
- ZCash (ZEC)
- DASH
- Bitcoin Gold (BTG)
- Ethereum Classic (ETC)
- Bitcoin Satoshi Vision (BSV)
- Bitcoin Cash (BCH)
- Verge (XVG)
- USD Coin (USDC)
- Tether (USDT)
- Ripple (XRP)
- Tron (TRX)
- Arbitrum (ARB)
- Binance Smart Chain (BSC)
Technical infrastructure and 2025 upgrades
In early 2025 OFAC rolled out the Crypto Compliance Guidance 2025, which makes real‑time monitoring a regulatory requirement for any U.S.-based exchange. The guidance forced a shift from daily CSV imports to an XML feed (sdn_advanced.xml) that can be parsed into JSON or plain‑text lists.
Key technical milestones:
- March 2025 - OFAC endorsed three new wallet‑screening engines designed for DeFi platforms.
- May 2025 - Launch of OFAC Blacklist v2.0, adding real‑time alerts and layer‑2 coverage.
- January 2025 - Expansion of sanction criteria to cover DAOs and protocols without a formal legal entity.
The XML feed includes fields for address, blockchain, risk score, and a brief description of the underlying entity. Most compliance vendors (Scorechain, Chainalysis, Elliptic) have built parsers that pull the feed every 15 minutes and automatically flag transactions that match.
Real‑world case studies
Understanding the abstract list becomes clearer when you look at actual designations.
- Iranian oil network (Sept2025) - Two Iranian nationals used Ethereum and TRON wallets to move over $600million, with $100million directly tied to oil sales. OFAC froze the wallets and required exchanges to block any further transfers.
- SECONDEYE SOLUTION - Linked to the INTERNET RESEARCH AGENCY LLC, this entity operated multiple Bitcoin addresses, including
1NE2NiGhhbkFPSEyNWwj7hKGhGDedBtSrQand19D8PHBjZH29uS1uPZ4m3sVyqqfF8UFG9o. The addresses were used to funnel money for alleged election‑interference operations. - Garantex seizure (Mar2025) - Joint U.S., German, and Finnish action seized $26million in crypto held by the exchange. After the initial sanction, the operators tried to re‑launch as "Grinex," prompting a second designation.
- Lazarus Group (Q12025) - North‑Korean hackers moved $200million through sanctioned DeFi protocols, exploiting smart‑contract loopholes before being blocked by updated OFAC filters.
- AI‑driven trading bot (Feb2025) - The first autonomous bot used for money‑laundering was added to the SDN list after moving $60million through a mix of stablecoins and privacy tokens.
Compliance requirements for exchanges and service providers
If your platform lets users deposit, withdraw, or trade crypto, you must implement the following steps:
- Subscribe to the
sdn_advanced.xmlfeed directly from OFAC’s website. - Parse the XML into a searchable database that maps address → blockchain → risk score.
- Integrate the database with your transaction monitoring engine so that each inbound/outbound transaction is checked against the list in real time.
- Set alert thresholds (e.g., block high‑risk matches, flag medium‑risk for manual review).
- Update the database at least every 15 minutes - most providers automatically pull the feed on that schedule.
- Maintain audit logs showing when a match occurred and what action was taken.
- Train compliance staff on how to interpret risk scores and handle false‑positive appeals.
Compliance teams also need to support multiple networks simultaneously. A single transaction might involve a wrapped token on BSC that ultimately settles on Ethereum, so your scanner must resolve cross‑chain bridges.
Traditional financial sanctions vs. cryptocurrency sanctions
| Aspect | Traditional sanctions | Crypto sanctions |
|---|---|---|
| Target | Bank accounts, financial institutions, corporate entities | Specific wallet addresses, smart contracts, DAOs, layer‑2 addresses |
| Enforcement | Through correspondent banks and SWIFT filters | Through blockchain analytics, real‑time address screening |
| Visibility | Often opaque, relies on reporting | Public ledger provides immutable transaction history (except privacy coins) |
| Adaptability | Slow to react; changes require legal notices | Updates can be pushed via XML feed every 15minutes |
| Evasion tactics | Use shell companies, offshore banks | Generate new addresses, use mixers, privacy chains, or layer‑2 solutions |
Best practices and common pitfalls
Even with the right tools, teams stumble on a few recurring issues.
- Ignoring layer‑2 activity. Many scammers move funds to Optimism or Arbitrum before jumping back to mainnet. Your scanner must ingest those feeds.
- Relying on a single vendor. If your provider’s parser fails during a feed outage, you lose compliance coverage. Keep a backup XML pull script.
- Hard‑coding address lists. Addresses change; always pull the live feed instead of static CSVs.
- Over‑blocking. Flagging every match without context can freeze legitimate user funds and attract regulator scrutiny. Use risk scores to tier responses.
- Neglecting smart‑contract developers. The May2025 proposal holds developers liable for enabling evasion. Conduct code reviews for any contract that interacts with sanctioned addresses.
Pro tip: Set up a sandbox environment that simulates a real‑time feed. Run test transactions against known sanctioned addresses (e.g., 1NE2NiGhhbkFPSEyNWwj7hKGhGDedBtSrQ) to verify your alerts.
Future outlook
Looking ahead, expect three trends to shape the sanctions landscape:
- Expansion into privacy‑coin monitoring. OFAC is already drafting guidance for Monero and ZCash tracing.
- More joint international operations. The FATF‑OFAC joint directive of 2025 predicts synchronized sanctions lists across G7 economies.
- Liability for DeFi protocol developers. Pending May2025 regulations could make every smart‑contract code audit a compliance requirement.
Staying ahead means treating sanctions as a continuous data‑stream, not a quarterly compliance checklist.
Frequently Asked Questions
What is the difference between the OFAC SDN list and the regular sanctions list?
The SDN (Specially Designated Nationals) list is a subset of OFAC’s overall sanctions. It names individuals, entities, vessels and, increasingly, crypto wallet addresses that U.S. persons must block. The broader list also includes country‑wide embargoes and sector‑specific measures.
How often does OFAC update the crypto‑address feed?
Since the 2025 guidance, the XML feed (sdn_advanced.xml) is refreshed at least every 15minutes. Most compliance vendors mirror that cadence to stay compliant.
Can an address be removed from the SDN list?
Yes, but removal is rare. The entity must demonstrate that the sanctions criteria no longer apply, and OFAC issues a formal delisting notice that appears in the next XML update.
Do stablecoins count as the same as Bitcoin for sanctions?
Stablecoins are treated as separate assets. USDT and USDC each have their own address sets, and OFAC can sanction them independently of Bitcoin or Ethereum.
What should a small DeFi project do to avoid accidental sanctions violations?
Integrate an open‑source address screening library that pulls the OFAC XML feed, run all outbound transactions through it, and keep a manual review queue for any medium‑risk hits.
shirley morales
October 13, 2025 AT 09:30Sanctions compliance is a non‑negotiable duty for every regulated entity.
EDMOND FAILL
October 14, 2025 AT 02:10the feed updates every fifteen minutes so you gotta poll it like a heartbeat.
Jennifer Bursey
October 14, 2025 AT 18:50Cross‑chain address resolution is essentially threading the needle across multiple L2 fabrics.
A robust API becomes the backbone of any crypto‑compliant architecture.
Maureen Ruiz-Sundstrom
October 15, 2025 AT 11:30OFAC’s expansion into the crypto realm reveals an underlying desire to control a fundamentally decentralized space. Yet the list’s reliance on static address entries betrays a naïve assumption about anonymity. Every new wallet can be generated in milliseconds, rendering a blacklist a moving target. The real power lies in the analytics engines that map transaction graphs. If a compliance team merely copies the XML feed without context, they are chasing ghosts. Risk scores, as presented, are blunt instruments that ignore behavioral nuance. A high‑risk tag on a wallet used for legitimate DeFi liquidity provision is a false positive. Conversely, low‑risk designations can conceal sophisticated laundering schemes. Therefore, institutions must supplement OFAC data with heuristic models. Machine‑learning classifiers can detect patterns that static lists miss. Integration pipelines should be modular, allowing rapid updates as the feed changes. Auditing logs must capture not just matches but also the decision path. Regulators will soon demand proof of due diligence beyond simple block‑lists. Failure to adapt will invite enforcement actions that can cripple operations. In short, OFAC provides a framework, but the onus of effective enforcement rests on the institution. Treat the feed as a living stream, not a static spreadsheet.
Michael Bagryantsev
October 16, 2025 AT 04:10Absolutely, building that modular pipeline is key.
Start with a sandbox that replays known sanctions and iterate.
Maria Rita
October 16, 2025 AT 20:50When the system flags a wallet, the panic button should ring loud and the compliance team must act instantly.
Jordann Vierii
October 17, 2025 AT 13:30Think of each address check as a guard at the gate, keeping the platform safe.
Lesley DeBow
October 18, 2025 AT 06:10In the ledger of humanity, every flagged address is a moral checkpoint, a moment where technology meets ethics.
DeAnna Greenhaw
October 18, 2025 AT 22:50While the metaphor is appealing, the operational reality demands precise rule‑sets rather than poetic sentiment.
Luke L
October 19, 2025 AT 15:30Anyone ignoring the fifteen‑minute feed updates is effectively courting illegal activity.
Mandy Hawks
October 20, 2025 AT 08:10One might argue that sanctioning a cryptographic hash is akin to censoring a word in a digital dialect.
Scott G
October 21, 2025 AT 00:50Indeed, the analogy underscores the tension between open networks and sovereign authority, a nuance that compliance officers must internalize.
VEL MURUGAN
October 21, 2025 AT 17:30The recent inclusion of Monero wallets signals a shift toward privacy‑coin scrutiny; analysts should calibrate their models to account for stealth transaction patterns.
Russel Sayson
October 22, 2025 AT 10:10Implementing OFAC compliance is not a mere checkbox-it is the backbone of a trustworthy exchange.
First, ingest the sdn_advanced.xml feed directly from the Treasury’s portal using a reliable HTTP client.
Parse the XML into a normalized table that maps address, blockchain, and risk score.
Second, integrate this table with your transaction engine so every inbound and outbound movement triggers a lookup.
Third, define tiered actions: block high‑risk matches, flag medium‑risk for manual review, and log low‑risk for audit.
Fourth, schedule the feed pull at least every fifteen minutes to stay aligned with OFAC’s update cadence.
Fifth, maintain a versioned backup of each feed snapshot to support forensic investigations.
Sixth, incorporate cross‑chain bridge monitoring; many sanctioned addresses appear as wrapped tokens on Layer‑2 solutions.
Seventh, implement alert throttling to avoid overwhelming compliance analysts with duplicate hits.
Eighth, regularly test your pipeline with known sanctioned addresses such as 1NE2NiGhhbkFPSEyNWwj7hKGhGDedBtSrQ.
Ninth, ensure your audit logs capture the full decision chain-from feed receipt to final transaction action.
Tenth, conduct quarterly reviews of risk score thresholds to adapt to evolving threat landscapes.
Eleventh, educate your development team on the legal ramifications of interacting with designated smart contracts.
Twelfth, coordinate with legal counsel to draft SAR filing templates that can be auto‑populated when a block occurs.
Thirteenth, stay abreast of international sanction harmonization efforts to anticipate future state‑level designations.
Finally, view compliance as a continuous data stream, not a static policy, and your platform will navigate the regulatory seas with confidence.
Isabelle Graf
October 23, 2025 AT 02:50Sounds like a checklist, but the real issue is the will to enforce it.
Millsaps Crista
October 23, 2025 AT 19:30Push those alerts through the same pipeline you use for KYC-consistency breeds confidence.
Matthew Homewood
October 24, 2025 AT 12:10Reflecting on sanctions, one sees a mirror held up to the decentralized ideal, distorting it with state power.
Shane Lunan
October 25, 2025 AT 04:50yeah, but the mirror also shows the cracks we ignore.
Jeff Moric
October 25, 2025 AT 21:30If you need help designing that modular pipeline, feel free to DM me for a walkthrough.
Shrey Mishra
October 26, 2025 AT 14:10The gravitas of OFAC’s mandate compels every crypto steward to internalize its edicts lest they be swept aside by regulatory tides.
Ken Lumberg
October 27, 2025 AT 06:50Anyone who sidesteps these sanctions is essentially facilitating illicit finance and must be called out.
Blue Delight Consultant
October 27, 2025 AT 23:30i agree, but remember its not just about calling out its about fixing the sysytem.
Kevin Duffy
October 28, 2025 AT 16:10Great discussion everyone! 🚀 Keep the compliance fire burning bright!
Tayla Williams
October 29, 2025 AT 08:50It is imperative that institutions adopt a proactive stance toward OFAC updates, lest they suffer severe reguatory repercussions.
Brian Elliot
October 30, 2025 AT 01:30A balanced approach blends automation with human oversight to ensure both efficiency and ethical integrity.