How Does a Crypto Address Get Added to the OFAC Sanctions List?

TL;DR - OFAC adds a crypto address to its SDN list when it ties the wallet to a sanctioned person or crime, then publishes the address as a blocked identifier.

If your exchange suddenly freezes a deposit or blocks a withdrawal, an OFAC-listed address somewhere in your transaction history is one of the most common triggers. Most guides explain how to check a wallet against the list. Few explain how an address lands on that list in the first place - which is what tells you whether a flag is a direct hit or distant exposure you can document and clear.

What does it mean for a crypto address to be on the OFAC SDN list?

The SDN list - short for Specially Designated Nationals and Blocked Persons - is maintained by the US Treasury's Office of Foreign Assets Control, or OFAC. It names people, companies, and now crypto wallets that US persons are barred from transacting with. When a wallet appears on it, every US individual and business must block or reject transfers tied to that address and report the blocked funds to OFAC, generally within 10 business days.

OFAC began listing crypto addresses in November 2018, starting with two Iran-based individuals connected to the SamSam ransomware scheme. Each crypto entry carries the full address, a program code that names the legal authority for the listing, and the date it was added.

How does a crypto address get added to the SDN list?

A wallet does not get sanctioned because of a single suspicious transaction. The address is published as an identifier only after OFAC designates the person or entity that controls it. The path usually runs like this: an investigation - often with help from blockchain analytics firms such as Chainalysis, TRM Labs, or Elliptic - ties one or more wallets to a sanctioned actor; OFAC issues the designation under a sanctions program; and the wallet addresses are listed as identifiers so anyone can screen for them on chain.

The program code attached to each entry explains why. CYBER2 covers malicious cyber activity, SDGT covers terrorism financing, NPWMD covers weapons proliferation, and country programs such as RUSSIA-EO14024 cover specific jurisdictions. The wallet itself is not the target. The sanctioned person is, and the address is just a machine-readable way to enforce the block.

Which crypto addresses has OFAC sanctioned so far?

The list has grown from that first 2018 entry to more than 1,200 crypto addresses across several blockchains. High-profile additions include the mixers Tornado Cash and Blender.io, the exchanges Garantex and Suex, and wallets tied to North Korea's Lazarus Group, which has been linked to billions of dollars in stolen crypto.

Designations keep arriving. In April 2026 OFAC added crypto addresses connected to the Central Bank of Iran after roughly $344 million in USDT was frozen. Sanctions can also be lifted: Tornado Cash was removed from the SDN list in March 2025, though analytics tools still treat past mixer use as a risk signal. Our guide on whether a delisted Tornado Cash still flags your wallet covers that gap in detail.

Why can a wallet be blocked even if it is not on the list?

OFAC states plainly that its published address list is not exhaustive. Sanctioned actors spin up new wallets faster than any list can track, and the rule extends to any address a blocked person controls - listed or not. Then there is exposure. If funds reach your wallet after passing through a sanctioned address a hop or two back, an exchange's screening can flag the deposit even though your own address never appears on the SDN list.

You can check a single address yourself on the OFAC Sanctions List Search portal, but it only returns exact matches on listed wallets - it will not show indirect exposure or the addresses a sanctioned actor controls quietly. Screen your wallet with Plastron to check it against the full OFAC set and trace multi-hop exposure across seven EVM chains in one pass. For the deeper question of how distant a sanctioned link can be and still cause a flag, see our guide on how many hops from a sanctioned address flag your wallet.

What happens to funds at a sanctioned address?

Once an address is listed, US persons must freeze any related property and report it. In practice exchanges block deposits and withdrawals tied to the address, and stablecoin issuers can go further. Tether and Circle can freeze USDT or USDC at the smart-contract level, locking the tokens regardless of who holds the private keys.

Funds stay blocked until OFAC authorizes their release, which can require a formal license application. This is why screening before you transact matters more than screening after. Once tainted funds land in your wallet, unwinding the situation is slow and largely out of your hands.

FAQ

Can a crypto address be sanctioned without the owner being named?

No. The address is published as an identifier of a person or entity OFAC has designated. The wallet is listed because of who controls it, even when that party is known only by an alias.

How often does OFAC update its crypto address list?

There is no fixed schedule. OFAC adds addresses whenever a designation is made, which has happened many times a year since 2022, so screening tools should refresh their data daily.

Is it illegal to receive crypto from a sanctioned address by accident?

US sanctions are strict liability, so even an unknowing transaction can be a violation. Intent affects the penalty, not whether a breach occurred - which is why pre-screening is the safer habit.

Does removal from the SDN list clear a wallet's history?

Delisting ends the legal prohibition, but analytics tools may still treat prior activity as a risk factor. Tornado Cash is the clearest case: delisted in 2025, yet still scored as elevated risk by many screeners.