U.S. Treasury Building in Washington, D.C. for a ProCoinNews article about OFAC crypto wallet sanctions.

Treasury Puts 134 Crypto Wallets on the ISIS-K Sanctions List

By Isaac • July 2, 2026 12:41 pm • Comments

The Treasury Department’s Office of Foreign Assets Control updated its ISIS-K sanctions entry on July 1 and attached something more specific than names. It listed wallet addresses.

OFAC added 134 cryptocurrency wallet identifiers to the designation for ISIL Khorasan, the group commonly called ISIS-K. The set breaks down into 131 TRON addresses and 3 Monero addresses.

This is the sanctions machine tightening down to the ledger level. A name on a list is one thing.

Trending: Europe’s MiCA Deadline Hits, and Only 244 Firms Made the Cut

A specific on-chain address that compliance teams can screen against is another.

Blockchain analytics firm Chainalysis mapped the flows the same day.

Chainalysis mapped the on-chain activity behind the designation.

Its July 1 analysis says OFAC added 134 cryptocurrency wallets to the ISIS-K entry, including 131 TRON addresses and 3 Monero addresses. Chainalysis says the TRON wallets received more than $1.4 million since 2023 and sent more than $880,000.

The firm also says Tether froze balances on all 131 TRON addresses after the sanctions update. That turns the case from a static government list into a live infrastructure response, because USDT on TRON can be frozen at the issuer level.

Chainalysis says the wallets had heavy exposure to mainstream services and that several designated wallets sent funds to Syria-based crypto exchangers. In plain terms, the case is about how illicit fundraising touches ordinary crypto rails before compliance teams catch up.

The same analysis mentions a separate PCC-related action in Brazil, where crypto allegedly helped move illicit proceeds back from the United States. The broader enforcement pattern is clear: wallet identifiers are becoming standard evidence in terrorism and organized-crime finance cases.

CoinDesk put the action into the July 2 crypto-market frame.

Its report says the Treasury Department sanctioned more than 100 ISIS-K-linked crypto addresses tied to funds moving through TRON, Monero, and Bitcoin. CoinDesk highlighted the $1.4 million flow figure and the freeze on the 131 TRON wallets.

The stablecoin piece matters because USDT on TRON is a major payments rail in global crypto markets. When OFAC names a wallet and an issuer can freeze balances, sanctions enforcement moves from after-the-fact tracing into direct asset control.

CoinDesk also notes that ISIS-K allegedly used its media wing to solicit donations through crypto. The point stays narrow: this is a sanctions and infrastructure story, not a story about crypto replacing every other terrorism-finance channel.

The report also connects the action to a separate Treasury move against Primeiro Comando da Capital in Brazil, where officials alleged more than $30 million in illicit crypto flows. Taken together, the July actions show Treasury leaning on wallet-level evidence across both terrorist-finance and organized-crime cases.

The mechanics here reward transparent chains and expose the limits of privacy coins. TRON is public, so analysts trace the money and issuers can act on the addresses.

Monero is built to obscure exactly that kind of tracing, which is why only three XMR addresses made the list against 131 on TRON.

OFAC has explained this wallet-identifier system before. OFAC FAQ 562 says the agency may add digital currency addresses to the SDN List to identify digital currency identifiers associated with a blocked person.

The FAQ also warns that address listings are not likely to be exhaustive. A blocked party can spin up new wallets, route through intermediaries, or use assets that are harder to trace than transparent-chain tokens.

FAQ 562 tells parties who identify digital currency tied to a sanctioned person to block the relevant property and file a report with OFAC. In practice, wallet screening is one layer of the compliance job, not the whole job.

That is why the July 1 update lands differently for exchanges, stablecoin issuers, custodians, brokers, and analytics providers. A listed wallet creates a clear red flag, while transaction context still determines what other exposure may exist around it.

The guidance also helps explain why Monero and TRON appear in the same action but create different compliance problems. Transparent-chain assets can be traced and frozen more directly; privacy assets force a heavier reliance on off-chain controls and counterparties.

The OFAC recent-action page is the formal source for the designation update.

The page folds the digital currency identifiers into the existing ISIS-K counterterrorism entry and lists the organization under terrorism authorities carrying secondary sanctions risk. It also includes the long TRON address set and the three Monero addresses visible in the updated entry.

The official page changes the compliance record that regulated institutions, crypto platforms, and screening providers have to check against. It is dry by design, but the operational effect is real: address lists become screening data, alert rules, exchange controls, and issuer decisions.

Two lessons come through. Public blockchains can give investigators a durable record of wallet activity, and centralized issuers can sometimes act directly once an address is named.

That is the direction sanctions are heading in crypto. Government lists the addresses, analytics firms map exposure, and platforms holding choke points decide how quickly funds stop moving.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.

 

Search ProCoinNews