OFAC Targets 134 ISIS-K Wallets as Tether Freezes Associated Funds

The U.S. Treasury’s Office of Foreign Assets Control (OFAC) has expanded its sanctions targeting ISIS-Khorasan (ISIS-K), sanctioning 134 cryptocurrency wallet addresses tied to the group. ISIS-K has been designated as a Specially Designated Global Terrorist since September 2015.

OFAC added the addresses to its Specially Designated Nationals (SDN) list on Wednesday. The SDN designation covers individuals, entities, and digital asset addresses linked to terrorism and other illicit activity, bringing more crypto-linked points of contact into the U.S. enforcement framework. OFAC’s recent action outlines the update.

Key takeaways

• OFAC sanctioned 134 cryptocurrency wallet addresses associated with ISIS-Khorasan, adding them to the SDN list.
• Blockchain analysis by Chainalysis says 131 of the sanctioned addresses were on Tron and were frozen by Tether; three were on Monero.
• Chainalysis reports the Tron addresses received more than $1.4 million in crypto donations since 2023 and sent over $880,000.
• The new action follows OFAC’s prior ISIS-support financier sanctions issued on June 22.

OFAC adds 134 crypto addresses to the SDN list

The latest OFAC update is part of an ongoing effort to disrupt terrorist financing conducted through digital assets. By designating specific wallet addresses, OFAC places them within the SDN framework—aimed at preventing U.S. persons and covered businesses from dealing with the sanctioned parties or facilitating transactions tied to them.

According to OFAC’s description of the measure, earlier rounds focused on “key facilitators who enable ISIS to move funds among its regional affiliates.” The new tranche expands the net further by targeting additional wallet infrastructure associated with ISIS-K’s illicit financial activity. OFAC’s SDN list update records the addresses added this week.

Tether freezes Tron holdings; Chainalysis flags Monero addresses

Industry blockchain forensics firm Chainalysis, in a report released alongside the sanctions news, attributed the breakdown of wallets by network: 131 Tron addresses and three Monero addresses were identified in the OFAC action. Chainalysis said Tether froze balances tied to the 131 Tron addresses, while the remaining addresses were on the Monero network.

The freezing step matters operationally. Sanctions can create legal and compliance barriers, but the immediate restriction of balances by major stablecoin infrastructure can reduce the near-term ability of sanctioned actors to access funds—even before prosecutions or extended enforcement follow.

Chainalysis’ analysis of the specific wallets and their network exposure was published in its report on the July 2026 sanctions round: “ISIS Designation of Crypto Addresses — July 2026”.

Where the money flowed: donations and transfers traced on-chain

Chainalysis also described what it found when mapping the sanctioned wallets’ activity. The report says the 131 Tron addresses received more than $1.4 million in cryptocurrency donations since 2023 and sent over $880,000. The group has reportedly sought crypto donations historically through campaigns using websites and messaging platforms.

Beyond aggregate totals, Chainalysis says it identified donation-related addresses used across multiple networks—including Tron, Monero, and Bitcoin—and noted what it characterized as “significant exposure to mainstream services.” The firm also found wallets that routed funds to cryptocurrency exchanges based in Syria.

That mix—terror-linked wallets interacting with larger crypto services—highlights a key enforcement challenge. Even when an illicit actor uses anonymity-oriented networks (such as Monero), their broader financial graph can intersect with centralized or regulated endpoints through exchange flows, custody, or liquidity routes. For compliance teams, that intersection is often where disruptions become most practical.

Sanctions momentum builds after June 22 enforcement

This week’s OFAC action arrives a little more than a week after the agency sanctioned additional individuals and entities connected to ISIS-related financing. On June 22, OFAC sanctioned three individuals and six entities across Europe, the Middle East, and West Africa, including MSB Bitcoin Xchange (Syria) and MSB Spider (Turkey). OFAC’s June 22 press release describes that previous round and the agency’s rationale.

Comparing the two actions, the pattern appears to be widening from alleged facilitators toward the transactional endpoints used to receive or move funds. By adding wallet addresses to the SDN list, OFAC reduces flexibility for sanctioned networks and increases compliance pressure across exchanges, custodians, and stablecoin-related entities that manage address-based monitoring and balance controls.

It also reinforces the role of blockchain analytics in sanctions design. Chainalysis’ ability to identify donation flows and network-specific wallets helped connect the sanctions process to on-chain behavior, enabling a targeted approach rather than a broad, non-specific sweep.

Why blockchain intelligence is becoming central to enforcement

Across counter-terrorism and financial-crime policy, blockchain intelligence tools are moving from “supporting evidence” to operational components in enforcement. Earlier this year, TRM Labs said onchain evidence was key to securing convictions of three individuals for terrorism financing in Indonesia in 2024 and 2025. TRM Labs argued that courts have treated cryptocurrency evidence—such as wallet addresses, transaction histories, and on-chain flows—as admissible and capable of anchoring prosecution. The company described this in a statement on its site: TRM Labs: on-chain intelligence and terrorism financing prosecutions.

The broader implication for market participants is straightforward: sanctions enforcement increasingly depends on traceable, address-level data. That trend tends to raise the importance of robust address-screening and transaction monitoring, especially for companies that deal with stablecoin liquidity, exchange withdrawals, or custody services across multiple networks.

For readers following this area closely, the next question is how quickly more connected wallets and counterparties are identified—and whether additional enforcement actions will target exchange routes, intermediary services, or other infrastructure tied to the newly sanctioned addresses. Chainalysis’ reporting suggests ISIS-K’s crypto activity has been persistent, but OFAC’s approach is shifting toward more granular, address-specific disruption that can constrain access to funds in real time.