# OFAC Sanctioned Crypto Addresses: Balances and Activity

> Every crypto address on OFAC's SDN list with its entity, program and listing date, its balance on each chain and when it last sent or received funds.

Markdown copy of https://voltfincrypto.com/apps/ofac-sanctioned-crypto-addresses

**Question:** Which crypto addresses are on the OFAC sanctions list, what do they hold and are they still moving funds?

- Kind: Table in Voltfin Strata
- Topic: [Security and risk](https://voltfincrypto.com/topics/security)
- Chains: Bitcoin, Ethereum, Tron, BNB Chain, Arbitrum, Polygon, Base
- Status: Planned. The data is not published yet, so this page states no figure; each figure will open its receipt when it is.

The US Treasury's Office of Foreign Assets Control lists crypto addresses beside the people and entities it sanctions, in the digital currency address fields of its SDN list. This table gathers every listed address in one place and reads each one on-chain: what it holds now, when it last received or sent funds and whether money still arrives after the listing.

Listings cover exchanges, ransomware operators, darknet markets, hacking groups and the services that move their funds. The August 2025 action against the Garantex exchange, its successor Grinex and the companies behind the ruble-backed A7A5 token named addresses on Bitcoin, Ethereum and Tron. Delisted addresses, such as the Tornado Cash contracts removed in 2025, stay in the table marked as removed.

Sort by balance to see where sanctioned funds sit, or by last activity to see which addresses are still in use. Every balance and date opens the block and the read behind it. The table is a data reference, not legal advice.

## Blueprint

One row: One row per listed address per chain it is read on, at the latest block

- **Address** (`address`): The address as it appears on the SDN list, linked to its listing.
- **Chain** (`chain`): The chain this row reads; an EVM address is read on every covered EVM chain.
- **Entity** (`entity`): The sanctioned person or entity the address is listed under.
- **Program** (`program`): The sanctions program named in the listing, such as cyber-related or North Korea sanctions.
- **Listed** (`listed_on`): The date OFAC added the address to the SDN list.
- **Status** (`status`): Listed or removed, with the removal date for delisted addresses.
- **Balance** (`balance`, USD): Native and stablecoin balances at the latest block, valued at oracle prices.
- **Frozen by issuers** (`frozen`, USD): USDT and USDC at the address that the issuers have frozen and that cannot move.
- **Received since listing** (`received_since_listing`, USD): Value sent to the address after its listing date, from native and token transfers.
- **Last received** (`last_in`): The date of the latest inbound transfer to the address.
- **Last sent** (`last_out`): The date of the latest outbound transfer, the clearest sign the key is still in use.
- **Receipt** (`receipt`): The block, hash and reads behind the row's balance and dates.

## How it will be measured

- Addresses come from the digital currency address fields of OFAC's SDN list, recorded with the entity, the sanctions program and the date each address was added or removed (off-chain).
- Balances are native balances plus USDT and USDC balanceOf at the latest block; an address listed under an EVM chain is also read on each covered EVM chain, where the same key controls funds.
- Last activity is the block of the latest inbound and the latest outbound transfer, from native transfers and token Transfer logs on each chain.
- Value received since listing sums transfers into the address after its designation date, separating dust and poisoning attempts from larger payments.
- Stablecoin freezes by Tether and Circle on listed addresses are read from their blacklist events and shown beside the balance.

## Data it needs

- `address_labels` (to build): Labels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- `stablecoin_freezes` (to build): Addresses frozen or blacklisted by stablecoin issuers, the balances frozen, and later unfreezes or destroyed funds, per stablecoin and chain.
- `native_prices_daily` (to build): Reference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- Source: OFAC SDN list digital currency address fields, entity names, programs and listing dates, recorded with the list's publication date (off-chain)
- Source: Native balances and USDT and USDC balanceOf of each listed address at the latest block on each covered chain
- Source: Native transfers and ERC-20 or TRC-20 Transfer logs to and from each listed address, for last activity
- Source: Tether AddedBlackList and Circle Blacklisted events on listed addresses

## Questions

### What is the OFAC SDN list?

The Specially Designated Nationals and Blocked Persons list is the US Treasury's list of people, companies and other entities whose property is blocked. Since 2018 entries can include digital currency addresses, tagged with the asset they were listed under, such as XBT for bitcoin or ETH for ether.

### Which crypto addresses are sanctioned by OFAC?

Every address in the digital currency fields of the SDN list. This table lists all of them with the entity each belongs to, the program it was listed under and the date it was added, and reads each one's balance and activity on-chain.

### Is it illegal to send crypto to a sanctioned address?

US persons are generally prohibited from dealing with sanctioned people and their property, and sending them crypto falls under that. Other countries keep their own lists and rules. This table is a data reference, not legal advice.

### Why do sanctioned addresses still receive funds?

Anyone can send to any address. Listed addresses receive dust, address poisoning attempts and unsolicited tokens, as well as payments from people outside US jurisdiction. The table separates small repeated transfers from larger ones so that real use stands out.

### Is Tornado Cash still on the sanctions list?

No. The Treasury listed the Tornado Cash contracts in August 2022 and removed them in March 2025, after the Fifth Circuit ruled in Van Loon v. Department of the Treasury that its immutable smart contracts were not property that could be sanctioned. The removed addresses stay in the table with both dates.

### Do stablecoin issuers freeze sanctioned addresses?

Tether and Circle can freeze an address on their tokens, and they often freeze addresses that appear on the SDN list. A frozen balance cannot be moved, so the table shows it apart from funds the holder can still spend.

## Glossary

- **SDN list**: The Specially Designated Nationals and Blocked Persons list kept by the US Treasury's Office of Foreign Assets Control, which can include crypto addresses.
- **Designation**: OFAC's act of adding a person, entity or address to a sanctions list, with a date and the program it falls under.
- **Delisting**: The removal of an entry from the SDN list, which ends the blocking of that entry's property from the removal date.

## Related apps

- [Crypto Address Checker: Flagged, Sanctioned or Hacked](https://voltfincrypto.com/apps/crypto-address-checker)
- [USDT Blacklist Tracker: Frozen USDT and USDC Wallets](https://voltfincrypto.com/apps/usdt-blacklist-tracker)
- [North Korea Crypto Hacks: Lazarus Group Theft Tracker](https://voltfincrypto.com/apps/north-korea-crypto-hacks-tracker)
- [Tornado Cash Tracker: Deposits, Withdrawals and Anonymity Sets](https://voltfincrypto.com/apps/tornado-cash-tracker)
- [Address Label Lookup: Who Controls This Wallet?](https://voltfincrypto.com/apps/address-label-lookup)
- [Bitcoin Quantum Risk: BTC in Exposed Public Key Addresses](https://voltfincrypto.com/apps/bitcoin-quantum-risk-exposed-keys)

Build it in Voltfin Studio: https://app.voltfincrypto.com/signup?next=%2F