Is a Crypto Address Sanctioned? How to Check

TL;DR — A crypto address is sanctioned when a government names it on a designation list such as the OFAC SDN. Check any address against the current list before you send, receive or deposit.

Sanctions are the one category in wallet screening that is not a risk estimate. Everything else — mixer exposure, scam proximity, stolen-funds distance — is an inference with a confidence attached. A sanctions designation is a published legal fact: an address is on the list, or it is not.

That makes it both the easiest thing to check and the most consequential thing to get wrong. This guide covers how addresses get designated, how the exposure spreads to wallets that never transacted with anyone on a list, what actually happens when an address is designated, and how to check one yourself.

What does it mean when a crypto address is sanctioned?

It means a government has named that specific address in a legal instrument. In the United States that instrument is the Specially Designated Nationals and Blocked Persons list, maintained by the Treasury's Office of Foreign Assets Control — OFAC. The list has carried digital-currency addresses since 2018, when two Iranian nationals connected to the SamSam ransomware campaign were designated alongside the Bitcoin addresses they used.

For a US person, the consequence is blunt: transacting with a designated address is prohibited, and the prohibition is strict liability. Not knowing does not help you. That is the legal reality behind every "we screened your deposit" message you have ever received from an exchange.

Three things people routinely get wrong here. Designation applies to the address, not just the person — the address is the blocked property. Designation is not limited to individuals: a smart contract can be designated, as Tornado Cash was, and the question of whether a DAO can be sanctioned has already been tested. And the list is not static: addresses are added, and occasionally removed, on no fixed schedule.

Which lists matter, and where does the data live?

OFAC is the one most tools mean when they say "sanctions", but it is not the only list, and it is not automatically the one that applies to you.

• OFAC SDN (United States). The most complete published set of crypto addresses, and the one with the broadest extraterritorial reach because of the dollar's role in settlement.
• EU consolidated list and UK OFSI. Overlapping but not identical. An entity can be designated in one jurisdiction and not another, and the crypto-address granularity is generally thinner — the differences matter more than people assume.
• National lists maintained by individual regulators, which is where the HTX designation in the EU sat before anyone asked what it meant for ordinary wallets.

One fact shapes what any screening tool can actually do: the majority of OFAC-listed crypto addresses are Bitcoin addresses, with Tron second and Ethereum a distant third. A tool that screens only Ethereum is blind to most of the list by construction. The live per-chain breakdown is on the OFAC sanctions check page and refreshes with the list.

How does an address end up on the list?

Designation follows investigation, not transaction volume. Treasury names an address because it has attributed that address to a designated person, entity or programme — a ransomware operator, a sanctioned exchange, a state-linked hacking group, a terrorism-financing network. The address is evidence in a case that was already being built.

That is why designations arrive in clusters and often long after the activity. A batch will name a dozen addresses at once because they all belong to one investigation. If you want the mechanics in detail, we covered how an address gets added separately.

Two consequences follow for anyone holding crypto. First, an address can be clean the day you transact with it and designated three months later — which is exactly the situation in receiving crypto from an address that was later sanctioned. Second, entire services get designated, not just wallets: when an exchange like Garantex or Grinex is named, every withdrawal anyone ever made from it becomes exposure.

What is the 50 percent rule, and why does it catch people?

OFAC's 50 percent rule says that an entity owned 50 percent or more, directly or indirectly, by one or more designated persons is itself blocked — even though it is not named on the list.

In traditional finance that is a corporate-ownership question. On-chain it is murkier and broader in effect: an address controlled by a designated entity is blocked property whether or not Treasury has published it. Which means the SDN list is a floor on your exposure, not a ceiling. Screening against the published addresses alone tells you about the named set; it cannot tell you about the unnamed set that the rule also blocks. We unpacked the practical reading in the 50 percent rule and wallet screening.

How far does sanctions exposure spread?

This is the question that turns a legal fact into a risk score, and it is where tools diverge most.

Direct contact — you sent to, or received from, a designated address — is unambiguous. Beyond that, exposure propagates through intermediaries, and every screener applies some form of haircut so that contribution falls off with distance. One hop from a designated address is a serious finding. Four hops through high-volume services is usually noise, because value passing through an exchange's commingled pool carries no meaningful attribution forward.

Two variables decide whether an indirect hit is material: how many hops, and how much value. A dust-sized inbound transfer from a distant tainted source is not the same event as a substantial one, even though a naive "any contact" rule flags both. We looked at where the line actually falls in how many hops from a sanctioned address flags a wallet, and at the harassment case in a dust attack that froze a Kraken account.

The honest summary: a compliance team is making a risk decision, not a legal finding, and their threshold for a hold is far lower than the threshold for a seizure. That asymmetry is the whole argument for checking before you move funds rather than after.

What actually happens when an address is designated?

Less than people imagine, and more than people hope.

Nothing happens on-chain. Sanctions do not freeze a blockchain address — no authority can reach into Bitcoin or Ethereum and stop a key holder from signing. The designated address keeps working. What changes is that every regulated party in the world is now prohibited from touching it, which is a far more effective constraint than a technical one: the address becomes unable to reach any exchange, any payment processor, any fiat exit.

The exceptions prove the rule. Centralised stablecoins are different because the issuer controls the contract: Circle and Tether can and do blacklist addresses, which is the one case where a designation translates into an actual on-chain freeze. And at the other extreme, a designated Monero address cannot be frozen or even meaningfully traced, which is why designation there is a signal to the ecosystem rather than an enforcement action.

Worth separating from the other agency people confuse it with: OFAC designates and blocks; FinCEN sets reporting and anti-money-laundering obligations. They do different jobs, and only one of them puts addresses on a list.

How do you check an address against the list?

Three approaches, in ascending order of usefulness.

Search the published list by hand. Treasury publishes the SDN data, and for a single address that you already suspect, this works. It answers only the direct question — is this exact string on the list — and tells you nothing about the wallet's exposure to addresses that are.

Use a block explorer. Explorers show transactions and sometimes carry community labels. What they do not do is evaluate. You can read every counterparty of a wallet on Etherscan and still miss a sanctions hit three transactions deep, because nothing on that page is checking a list for you.

Screen the wallet. A screening tool resolves the address and its counterparties against the current list, applies the hop and materiality logic above, and returns a verdict with the driving evidence. That is the only one of the three that answers the question you actually have, which is not "is this address listed" but "will my deposit clear".

Plastron's sanctions check is free and runs against the full SDN crypto set, refreshed with the list. It also states plainly what it did not check, which matters more than it sounds: a clean result covering direct counterparties is a weaker statement than a clean result covering four hops, and a tool that presents them identically is telling you less than it knows.

When is checking actually worth it?

1. Before depositing to any regulated venue. The exchange screens on arrival; by then your funds are behind their wall and the conversation is with a compliance analyst.
2. Before accepting payment from a counterparty you do not know. OTC deals, freelance work, P2P trades. Tainted coin becomes your problem the moment it lands.
3. After a designation batch that touches your ecosystem. When a service is named, exposure appears retroactively in wallets that did nothing new.
4. Before large withdrawals. Knowing your own exposure in advance is the difference between preparing source-of-funds evidence and being asked for it under time pressure.

What to do if you find sanctions exposure

The first instinct is almost always the wrong one. Do not move the funds to a fresh address. It does not clean anything — the chain of custody is already permanent — and to anyone reviewing it later it reads as an attempt to obscure the trail, which turns a compliance question into a conduct question.

Work out three things before you act, in this order:

1. How direct is it? Direct contact with a designated address is a legal matter and warrants advice from someone qualified to give it. Exposure three or four hops away through a high-volume service is usually a documentation problem, not a legal one.
2. How much value? A dust-sized inbound transfer you never touched sits at the opposite end of the spectrum from a substantial receipt. Compliance teams weigh proportion, and so should you when deciding how seriously to take a flag.
3. Which designation? A designated exchange you withdrew from years ago and a ransomware wallet that paid you last week are both "sanctions exposure" and nothing else about them is alike.

Then assemble evidence before anyone asks for it: exchange statements, the specific transaction hashes, invoices or contracts covering the inbound value, and a plain-language timeline. The proof-of-funds case is far easier to make while you still have access to the records than after an account is restricted.

If the finding looks wrong — and false positives are real, clustering around heavily-used infrastructure contracts — document precisely why, and raise it with both the venue holding your funds and the data source carrying the label. A label from a single unverified report deserves to be challenged; a Treasury designation does not.

What a sanctions screen cannot tell you

It cannot tell you about the unnamed set the 50 percent rule blocks. It cannot tell you who controls an address — screening evaluates history, never identity, which is a separate question covered in screening versus ownership verification. And it cannot substitute for the broader compliance check a business counterparty may need. It cannot promise that today's clean result survives tomorrow's designation batch. And it cannot tell you what a specific exchange will decide, because their threshold is theirs.

What it can do is remove the surprise. Almost every frozen-deposit story starts with someone who had no idea the exposure was there, and almost none of them start with someone who checked.

FAQ

Is it illegal to hold crypto that touched a sanctioned address?

Holding is not the same as transacting, and indirect exposure is not the same as dealing with a designated party. But the practical risk is real: a regulated venue can and will freeze on exposure alone. If the contact was direct or substantial, take legal advice rather than guessing.

Can an address be removed from the SDN list?

Yes. Delisting happens, usually when the underlying designation is lifted or successfully challenged. It is uncommon and it is slow, and the exposure a designation created in other wallets does not automatically unwind with it.

My wallet shows sanctions exposure but I never dealt with anyone on a list. How?

Almost always through an intermediary — a service that was later designated, a counterparty who received tainted value before paying you, or an unsolicited inbound transfer. The useful next step is finding out how many hops away it sits and how much value was involved, because those two numbers decide whether it is material.

Do sanctions apply to me if I am not in the United States?

OFAC's reach is broader than US residency, particularly where dollars or US-linked infrastructure are involved, and your own jurisdiction will have its own list. In practice the exchange you use enforces whichever regime it is bound by, which is frequently more than one.

Does moving the funds to a new wallet help?

No. It adds a hop to a chain of custody that is already permanently recorded, and to anyone reading it later it looks like an attempt to obscure the trail — which is a worse position than the exposure itself.

How often does the list change?

There is no schedule. Designations land when an investigation concludes, which means an address can be added on any business day. Any tool that screens against a cached copy of the list is one batch behind, which is why the refresh cadence is worth asking about.

Is a sanctions hit the same as a high risk score?

A direct sanctions hit produces the highest score there is, because it is the only category resting on a legal fact rather than an inference. A high score without a sanctions hit means something else fired — mixer contact, stolen funds, fraud proximity — and those are arguable in a way a designation is not.