Users can type in a name or paste a digital currency address. For addresses, the tool runs an exact-match search.
A positive result is a starting point, not a verdict. Names can overlap, and a match on a name still requires confirming you’re actually dealing with the listed party.
A negative result is arguably the trickier one. OFAC’s guidance makes clear that an address not appearing in the search does not mean it carries no risk. Wallets are cheap to create, and a sanctioned actor isn’t obligated to keep using the addresses the government already knows about.
Then there’s ownership. Under OFAC’s so-called 50% rule, ownership stakes tied to sanctioned parties can trigger compliance obligations even for an entity that never appears on the list by name. So a company can be absent from the search results and still be subject to blocking rules.
From two Bitcoin addresses to roughly 1,075
The scale of crypto data on the SDN List has changed dramatically. In November 2018, OFAC published its first two digital currency addresses, both Bitcoin wallets connected to Iranian ransomware activity.
As of October 28, 2026, the SDN List contained approximately 1,075 digital currency addresses. Those addresses are tied to 109 entries on the list.
That works out to an average of nearly 10 addresses per entry, though the distribution is unlikely to be even. Some sanctioned actors have one or two published wallets. Others have sprawling address sets spread across multiple blockchains.
The most recent example landed the same day. On October 28, 2026, OFAC sanctioned a network of North Korean IT workers associated with Russia. That action added eight new Ethereum and TRON addresses to the list.
The chain mix is worth noting. The first entries in 2018 were Bitcoin-only. The newest additions sit on Ethereum and TRON, showing that sanctions designations now track activity across multiple networks rather than a single dominant chain.
Why compliance teams should care
For crypto businesses, the practical takeaway is that the OFAC search is a floor, not a ceiling. The exact-match limitation means screening has to be ongoing. An address that returns nothing today could be designated tomorrow, as the October 28 action demonstrates. A one-time check at onboarding captures a single moment, not a relationship.
The ownership issue raises the stakes for anyone doing business with counterparties rather than just individual wallets. A trading firm, payment processor or market maker can look clean in the search and still carry exposure through who owns it. That pushes compliance work beyond address lookups and into corporate due diligence.
There’s also an asymmetry baked into how the list grows. Every new designation adds known addresses, but the people behind them can generate fresh ones in seconds. The list will always trail the activity it is trying to capture, which is precisely why OFAC frames a non-match as inconclusive.
What this means for the market
The growth from two addresses to approximately 1,075 tells a clear story about where sanctions enforcement is heading. Digital assets are now a routine part of how Treasury maps and targets illicit networks, from ransomware operators to state-linked IT worker schemes.
For institutions entering crypto, the bar keeps rising. Firms operating across international jurisdictions or handling large transaction volumes face the most exposure.
The North Korean angle also bears watching. The October 28 designations tied DPRK IT workers to Russia and put Ethereum and TRON addresses on the list.
The tool itself is useful, free and official. Its limits are spelled out by OFAC. The firms that get into trouble will likely be the ones that read the search result and skip the fine print.