The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned 134 cryptocurrency wallet addresses identified as belonging to ISIS-Khorasan (ISIS-K), a group that has been designated as a Specially Designated Global Terrorist since September 2015. The move, announced on Wednesday, adds these addresses to OFAC’s Specially Designed Nationals (SDN) list, which targets individuals, entities, and digital asset addresses involved in terrorism, narcotics trafficking, and other illicit activities.
The sanctioned addresses include 131 on the Tron network and three on the Monero network. Stablecoin issuer Tether has frozen the balances associated with the 131 Tron addresses, effectively blocking any further use of those funds. Blockchain forensics company Chainalysis revealed in a Wednesday report that the Tron addresses had collectively received over $1.4 million in crypto donations since 2023 and had sent out more than $880,000.
Background on ISIS-K and Cryptocurrency Financing
ISIS-Khorasan, also known as ISIS-K, is the Afghanistan-based affiliate of the Islamic State group. It emerged in 2015 and has been responsible for numerous devastating attacks in the region, including the 2021 Kabul airport bombing that killed 13 U.S. service members and at least 170 Afghans. The group has increasingly turned to cryptocurrency to raise and move funds, seeking to bypass traditional financial systems that are more susceptible to monitoring and seizure.
According to Chainalysis, ISIS-K has historically solicited crypto through donation campaigns on various websites and messaging platforms. The group’s operatives post wallet addresses on Telegram, Signal, and other encrypted apps, often accompanied by calls for support. The Tron network, in particular, has become a preferred platform due to its low transaction fees and widespread availability across exchanges.
The use of Monero, a privacy-focused cryptocurrency, underscores the group’s attempts to obscure its financial trail. Monero transactions are inherently untraceable, making it difficult for blockchain analytics firms to track funds. However, the small number of Monero addresses sanctioned indicates that ISIS-K still relies heavily on more transparent blockchains like Tron for the bulk of its fundraising.
Details of the Sanctions
The 134 addresses added to the SDN list represent a significant expansion of OFAC’s targeting of terrorist crypto financing. OFAC update to SDN list showed the specific wallet identifiers, though the agency did not disclose the entities or individuals behind each address. U.S. persons and entities are generally prohibited from engaging in transactions with any sanctioned parties, and financial institutions must freeze any assets held by them.
Tether’s swift freeze of the Tron addresses is noteworthy. As the issuer of USDT, the largest stablecoin by market capitalization, Tether has increasingly cooperated with law enforcement and regulators. This action is consistent with Tether’s voluntary compliance efforts, which include blocking wallets on its blocklist. However, the three Monero addresses remain beyond Tether’s reach since Monero operates on a separate, privacy-centric blockchain. Law enforcement will likely rely on alternative methods, such as exchange cooperation or on-chain analysis of Monero transactions that touch transparent bridges.
Chainalysis Investigation
Chainalysis, a leading blockchain intelligence firm, played a key role in identifying the wallets. Its investigation mapped out a network of ISIS-K funding entities, revealing multiple donation addresses on Tron, Monero, and Bitcoin. The firm found significant exposure to mainstream services, including some wallets that sent funds to Syria-based cryptocurrency exchanges. This suggests that the group may be laundering funds through less regulated exchanges or peer-to-peer platforms.
The report detailed that the 131 Tron addresses not only received over $1.4 million but also sent out $880,000, indicating active fund flows. Some of these outflows were directed to other wallets that may belong to operatives or facilitators. Chainalysis said that the addresses exhibited patterns consistent with donation campaigns: small, frequent incoming transactions from many different senders, with occasional larger consolidations. The analysis also identified likely conversion points where the funds were swapped for fiat currency or other cryptocurrencies.
Blockchain analytics tools are increasingly integral to financial sanctions targeting illicit activity. In another case earlier in April, blockchain intelligence company TRM Labs reported that on-chain evidence was key to securing the conviction of three individuals for terrorism financing in Indonesia in 2024 and 2025. Indonesian courts have demonstrated that cryptocurrency evidence—wallet addresses, transaction histories, and on-chain flows—is both admissible and can anchor a terrorism financing prosecution.
Previous OFAC Actions
This latest round of sanctions follows closely on a previous action on June 22, when OFAC sanctioned three individuals and six entities across Europe, the Middle East, and West Africa linked to ISIS-supporting financiers. Those targets included Syria-based MSB Bitcoin Xchange and Turkish MSB Spider, both of which were used to move funds for ISIS. OFAC stated that the June sanctions targeted “key facilitators who enable ISIS to move funds among its regional affiliates.”
The June sanctions demonstrated the interconnected nature of terrorist financing networks. Entities in Syria and Turkey were used as chokepoints to funnel donations from Europe and Asia to operatives in conflict zones. The addition of 134 wallet addresses now expands the scope beyond centralized exchanges to decentralized wallets, signaling that OFAC is prepared to sanction individual wallet addresses even when the identity of the wallet owner is not fully known.
OFAC has been progressively updating the SDN list with digital asset addresses. In 2023, the agency sanctioned hundreds of addresses linked to the Lazarus Group, a North Korean hacking collective. The current action against ISIS-K follows the same playbook, using on-chain intelligence to identify and disrupt illicit finance at the wallet level.
Tether’s Compliance Action
Tether’s decision to freeze the 131 Tron addresses is part of its broader compliance strategy. The company maintains a global sanctions screening program and regularly reviews transactions against OFAC’s list. In a statement, Tether emphasized its commitment to working with global law enforcement to combat illicit activity. This is not the first time Tether has frozen assets linked to terrorism; in previous instances, the firm froze addresses tied to Hamas and other sanctioned groups.
The freeze prevents the funds from being transferred or exchanged, effectively neutralizing the financial resources of the terrorists. However, critics point out that centrally issued stablecoins like USDT can be frozen centrally, which undermines the decentralization principle of cryptocurrency. Supporters argue that this capability is essential for regulatory compliance and for preventing the misuse of digital assets for crime.
Implications for the Cryptocurrency Ecosystem
The sanctions underscore the growing collaboration between blockchain analytics firms, stablecoin issuers, and government agencies. This ecosystem is becoming a powerful tool for disrupting terrorist financing. However, it also raises questions about privacy and the reach of U.S. law enforcement globally. The three Monero addresses that remain outside Tether’s control highlight the cat-and-mouse game between regulators and criminal actors who adopt privacy-enhancing technologies.
For the broader cryptocurrency industry, the development sends a clear message: compliance with sanctions is not optional. Exchanges, wallet providers, and other services that engage with sanctioned addresses risk severe penalties. The U.S. Treasury has increasingly used its authority to hold intermediaries accountable, as seen in the settlement against Binance in 2023 for sanctions violations. The inclusion of individual wallet addresses on the SDN list forces all service providers to screen transactions against the list, increasing the operational burden but also improving the integrity of the financial system.
The amount frozen—$1.4 million—is relatively small compared to the billions moved through cryptocurrency markets daily. Yet the symbolic and practical impact is significant: it demonstrates that even relatively low-value terrorist financing operations can be identified and disrupted. As blockchain analytics becomes more sophisticated, the window for using cryptocurrency anonymously for terrorism narrows. Nonetheless, the shift toward privacy coins like Monero and the use of decentralized exchanges may require new countermeasures involving off-chain intelligence and targeted investigations.
Chainalysis noted that the ISIS-K network exhibited “significant exposure to mainstream services,” suggesting that some funds may have traveled through regulated exchanges before being dispersed. This could lead to further compliance actions against those exchanges if they failed to implement adequate know-your-customer (KYC) procedures. Regulators worldwide are watching these developments closely, and the OFAC action may set a precedent for other jurisdictions to take similar steps.
Source: Cointelegraph News