OFAC Has Sanctioned 1,066 Crypto Addresses. 341 Are Tron.

The United States sanctions list has 19,416 entries on it. One hundred and six of them carry a cryptocurrency address — 0.55%.

Those 106 parties carry 1,066 addresses between them. Half are Bitcoin. Read the addresses by their own format rather than by the label OFAC gives them, and another third are Tron.

What the file actually contains

OFAC publishes the Specially Designated Nationals list as a machine-readable export. Where it knows a sanctioned party's wallet, it attaches the address to the entry as a feature tagged with a currency — Digital Currency Address – XBT, – TRX, – USDT, and so on. Twenty different tags appear.

By those tags: 534 Bitcoin, 261 Tron, 120 Ethereum, 94 Tether, and 57 spread across sixteen other labels, down to a single Dogecoin and a single XRP.

But a currency tag is not a rail. Tether runs on several chains, and an address's format says which one. So HaiPay classified all 1,066 by the shape of the string itself.

That gives 542 Bitcoin addresses, 341 Tron, 133 on EVM chains, 14 Litecoin, 10 Monero and 26 across nine others. Tron is 32.0% of every address the United States has sanctioned.

The 80-address gap between OFAC's 261 TRX tags and the 341 Tron-format addresses is almost all Tether: of the 94 addresses tagged USDT, 79 are Tron addresses. Eight are on an EVM chain. Seven are Bitcoin addresses — Omni-layer Tether, the original issuance route, and all seven belong to three Russian exchange designations from 2021 and 2022.

Two tags that do not match their address

Reading 1,066 strings against their formats turns up two that do not fit.

Entry 45404, Wang Mingming, designated on 3 October 2023, carries an address tagged XBT whose value is thirty-four characters beginning with T. That is the Tron form. No Bitcoin address takes it.

Entry 29585, Dmitrii Karasavidi, designated on 16 September 2020, carries a value tagged XMR that is a sixty-four-character hexadecimal string. A Monero address is ninety-five characters and does not look like that.

Neither finding says a designation is wrong. What they say is that the currency tag and the address do not agree, in a file that compliance systems read automatically. Two in 1,066 is a low error rate. It is not zero, and screening software that routes by the tag rather than the string will route these two to the wrong chain.

A very short list of very long lists

The distribution is extremely uneven. The median party carries four addresses. Thirty carry exactly one.

ISIL Khorasan carries 134, of which 131 are Tron. Hydra Market, designated in April 2022 under the cyber programme, carries 117, all Bitcoin. Those two names are 23.5% of every sanctioned address. The top ten are 56.1%.

Among the rest: Cheil Credit Bank, listed under a North Korea programme, with 53 Tether addresses that are all Tron; Xinbi Guarantee, added in September 2026, with 52 Tron addresses; Blender.io, designated in May 2022, with 46 Bitcoin addresses.

Seventy-three of the 106 parties are individuals rather than organisations. The picture most people have of crypto sanctions — exchanges and mixers — describes the biggest entries but not most of them.

Why this matters for payments

Any business that touches digital assets has to screen against this list, and the list is the only authoritative statement of what is prohibited. Its shape determines what screening has to do.

A thousand addresses is a small file. The hard part is not volume, it is that the list mixes twenty currency tags with addresses whose real chain has to be inferred from the string. A screening rule written against the tag will treat 79 Tron addresses as Tether and miss them on a Tron lookup.

The concentration matters too. More than half the list sits behind ten names, and those names are already the ones every vendor's risk feed flags. The marginal value of the list is in the long tail — the thirty parties with one address each, who will not be in anyone's heuristics.

What this is not

A sanctions listing records an address. It does not record a balance. Nothing in these files says how much value any address holds, has held, or has moved, and nothing here should be read as implying it.

The chain classification is HaiPay's, from address format alone. Format identifies the chain an address can be used on. It does not identify what is held there, and an EVM-format address is valid on many chains at once.

The dates in the enhanced file are the dates each party was added to the SDN list, not the dates its addresses were. OFAC adds addresses to existing entries in later updates. ISIL Khorasan was designated in September 2015 and now carries 131 Tron addresses; Iran's central bank was designated in 2010 and now carries six. No trend about chain adoption over time can be read off these dates, and none is offered here.

The list is amended continuously. These are the figures in the file published on 9 October 2026 and retrieved on 12 October.

HaiPay did not contact OFAC or the Department of the Treasury.

What to watch

Whether Tron overtakes Bitcoin. The gap is 542 to 341 — but it rests on very few parties. Three entries hold 236 of the 341 Tron addresses, which is 69%. One more listing the size of ISIL Khorasan's would close most of the gap in a single day, and one delisting would widen it again.

Whether OFAC starts tagging by chain rather than by asset. The ambiguity is entirely in the stablecoin tags, and it is the one part of this file that a reader cannot resolve without parsing the address.

And whether the long tail keeps growing. Twenty-five parties designated in 2026 carry an address, more than in any previous year, and seven of them — all added on 30 September — carry exactly one each.