The US Treasury's sanctions office provides a free, official way to check whether a crypto wallet or company appears in its records. The Office of Foreign Assets Control's (OFAC) Sanctions List Search can match names and exact digital currency addresses, but a hit still requires identity verification, and a miss does not mean the wallet or company is in the clear.

For exchanges, custodians, over-the-counter (OTC) desks, and anyone else moving digital assets across borders, that gap matters more every year. OFAC's list of sanctioned crypto addresses has grown from a curiosity into a sizable dataset, and the obligations behind it apply broadly to US persons—a category that generally covers US citizens and residents, entities organized under US law, and anyone located in the United States.

What the tool does, and what it doesn't

OFAC's Sanctions List Search was first established in May 2021. It serves as the agency's primary lookup for the Specially Designated Nationals (SDN) List, the roster of people, companies, and entities that US persons are generally barred from dealing with. Users can type in a name or paste a digital currency address, and for addresses, the tool runs an exact-match search—an address only returns a result if it matches a listed entry character for character.

A positive result is a starting point, not a verdict. Names can overlap, and a match on a name still requires confirming that the party being dealt with is actually the one on the list. On the SDN List itself, digital currency addresses function as identifying information for listed entries, much like passport or registration numbers.

A negative result is arguably the trickier one. OFAC's guidance makes clear that an address not appearing in the search does not mean it carries no risk. Wallets are cheap to create, and a sanctioned actor is not obligated to keep using the addresses the government already knows about.

Then there is ownership. Under OFAC's so-called 50% rule, ownership stakes tied to sanctioned parties can trigger compliance obligations even for an entity that never appears on the list by name—in practice, entities that one or more sanctioned parties own 50% or more of, directly or indirectly, are treated as blocked whether or not they are listed. A company can therefore be absent from the search results and still be subject to blocking rules, which generally require freezing affected property rather than moving it.

From two Bitcoin addresses to roughly 1,075

The scale of crypto data on the SDN List has changed dramatically. In November 2018, OFAC published its first two digital currency addresses, both Bitcoin wallets connected to Iranian ransomware activity.

As of October 28, 2026, the SDN List contained approximately 1,075 digital currency addresses, tied to 109 entries on the list. That works out to an average of nearly 10 addresses per entry, though the distribution is unlikely to be even. Some sanctioned actors have one or two published wallets, while others maintain sprawling address sets spread across multiple blockchains.

The most recent example landed the same day as that count. On October 28, 2026, OFAC sanctioned a network of North Korean IT workers associated with Russia, adding eight new Ethereum and TRON addresses to the list.

The chain mix is worth noting. The first entries in 2018 were Bitcoin-only, while the newest additions sit on Ethereum and TRON, showing that sanctions designations now track activity across multiple networks rather than a single dominant chain.

Why compliance teams should care

For crypto businesses, the practical takeaway is that the OFAC search is a floor, not a ceiling. Sanctions violations can carry civil penalties and, in some cases, criminal prosecution in the US, and the exact-match limitation means screening has to be ongoing: an address that returns nothing today could be designated tomorrow, as the October 28 action demonstrates. A one-time check at onboarding captures a single moment, not a relationship.

The ownership issue raises the stakes for anyone doing business with counterparties rather than just individual wallets. A trading firm, payment processor, or market maker can look clean in the search and still carry exposure through who owns it. That pushes compliance work beyond address lookups and into corporate due diligence.

There is also an asymmetry built into how the list grows. Every new designation adds known addresses, but the people behind them can generate fresh ones in seconds. The list will always trail the activity it is trying to capture, which is precisely why OFAC frames a non-match as inconclusive.

What this means for the market

The growth from two addresses to approximately 1,075 tells a clear story about where sanctions enforcement is heading. Digital assets are now a routine part of how Treasury maps and targets illicit networks, from ransomware operators to state-linked IT worker schemes.

For institutions entering crypto, the bar keeps rising. Firms operating across international jurisdictions or handling large transaction volumes face the most exposure.

The North Korean angle also bears watching. The October 28 designations tied DPRK IT workers to Russia and put Ethereum and TRON addresses on the list.

The tool itself is useful, free, and official, and its limits are spelled out by OFAC. The firms that get into trouble will likely be the ones that read the search result and skip the fine print.