OFAC Sanctioned 3 Monero Wallets. It Can't Freeze Any of Them.

An OFAC sanctions listing bars US persons and firms from dealing with an address, whether or not anyone can actually freeze the funds inside it.

On Wednesday, July 1, 2026, Treasury's Office of Foreign Assets Control added 134 crypto wallet addresses to its ISIS-Khorasan sanctions entry. Tether froze all 131 Tron addresses within hours. The other three run on Monero, and OFAC cannot touch a single coin sitting in them.

That gap matters for anyone who screens wallets, not just Treasury. Most coverage of a new SDN designation stops at "an address got added to the list." It skips the part where a listing and an actual freeze are two separate things, and where the difference tells you exactly what a screening tool needs to catch instead.

What did OFAC actually sanction on July 1, 2026?

OFAC updated its existing ISIS-Khorasan sanctions entry with 134 new crypto addresses tied to the group's fundraising network. Of those, 131 sit on Tron and carry USDT balances; the remaining 3 are Monero addresses. It is an update to a standing terrorism-financing case, not a brand-new designation, which is how most crypto additions to the SDN list actually happen.

The scale is not unusual. Plastron's own OFAC dataset, mirrored from the public SDN list, currently tracks 780 sanctioned crypto addresses across every active Treasury program, not just this one entry. Most of those additions land on chains with a central issuer to lean on: Tron and Ethereum-based USDT, USDC on multiple chains, exchange hot wallets a custodian can freeze on request. What is unusual about the July 1 update is the split inside a single entry: 131 addresses OFAC could count on being frozen within hours, and 3 it could not touch at all.

Why could Tether freeze the Tron wallets but not the Monero ones?

USDT on Tron is a token with a central issuer. Tether holds admin keys that can blacklist an address at the smart-contract level, and it exercised them on all 131 addresses the same day OFAC published the update. That is the same mechanism behind every stablecoin freeze you have read about on Ethereum or Tron: one company, one switch, one signed transaction.

Monero has none of that. There is no issuer, no admin key, and no smart contract sitting between a wallet and its coins. Ring signatures and stealth addresses hide the sender, receiver, and amount by design, and no company controls the protocol the way Tether controls USDT. There's no button because there's no company to press it.

This is not a new problem for Treasury. OFAC sanctioned the Tornado Cash smart contracts back in 2022 for the same underlying reason: the tool was built specifically so no single party could freeze or reverse what went through it. Monero was designed with that same property from day one, not bolted on later, and it applies to every address on the network, sanctioned or not.

What does a sanctions listing even do if nobody can freeze the funds?

Three things, none of which depend on a technical freeze. First, any US person or entity is now legally barred from transacting with those three addresses, and OFAC's strict-liability regime does not require proof you knew the address was sanctioned. Second, a foreign exchange or bank that keeps servicing the address risks losing its own correspondent banking relationships under secondary sanctions, even with no US customers involved at all. Third, and most relevant to wallet screening, the address becomes a permanent entry in every KYT and blockchain-analytics database that ingests the SDN list, which is exactly what a hop-based risk score is built to catch.

The listing itself is the enforcement mechanism. The freeze was always a bonus that stablecoin issuers happen to be able to deliver.

Does this mean Monero transactions are invisible to screening tools?

No, not the addresses OFAC just named. Those three strings are now public, and any screening tool, including a free one, can match a wallet's counterparties against them the same way it matches Tron or Ethereum addresses. What stays hidden is everything upstream and downstream of the transaction inside Monero itself: who funded that address, and where the coins went after they left it.

That is why a Monero conversion gets flagged the moment it touches a transparent chain, a pattern covered in Plastron's breakdown of how exchanges treat Monero and Zcash swaps. The murky Monero leg disappears from view, but the Bitcoin or Ethereum leg on either side stays fully visible, and exchanges treat that visibility gap as the red flag on its own.

Hop-based risk scoring works the same way here as it does anywhere else. A wallet that received funds two hops after one of these three Monero addresses does not show a direct match against the SDN list, but it inherits elevated exposure the moment the trail can be reconstructed through the transparent leg of the swap. The score does not need to see inside Monero to move. It only needs to see where the coins landed on either end of it.

What should you do if a wallet you're screening has Monero-linked history?

Do not treat "no direct on-chain match" as clearance. Three checks catch most of the real exposure:

• Ask for a source-of-funds statement covering the period a wallet converted through or from Monero, not just a balance snapshot.
• Treat any EVM address that received funds shortly after a known Monero-to-crypto swap through a bridge or DEX as elevated risk, even with no direct address match.
• Run the destination address through a tool that checks the full OFAC SDN corpus and known mixer clusters, not a single sanctions-list lookup.

Cross-referencing a wallet against OFAC's SDN list by hand stops scaling once the list runs to hundreds of crypto addresses spread across a dozen active program entries. Screen the address with Plastron instead, and it checks the full OFAC list, known mixer clusters, and stolen-funds exposure across Ethereum and six other EVM chains in one pass.

FAQ

Is it illegal to hold Monero because OFAC sanctioned a Monero address?

No. Holding or using Monero on its own carries no OFAC exposure. The prohibition applies specifically to transacting with the three addresses named in the July 2026 ISIS-Khorasan update, not to the currency itself.

How does OFAC even attribute a Monero address to a sanctioned group?

Through investigative and intelligence work rather than public on-chain forensics. A designation only needs to satisfy Treasury's evidentiary standard for the sanctions program, unlike the transparent-chain tracing that firms publish for Bitcoin or Ethereum addresses.

Does this designation affect Ethereum or other EVM wallets directly?

Not directly. None of the 134 addresses added on July 1, 2026 sit on Ethereum or another EVM chain. The same downstream-exposure logic still applies the moment funds from a sanctioned address get bridged or swapped onto one.

Why add these addresses to an existing entry instead of a new designation?

OFAC maintains one SDN entry per sanctioned group or person and updates it as new supporting addresses surface. A brand-new designation is reserved for a group or individual that was not already on the list, which ISIS-Khorasan has been for years.