Crypto Sanctions 101: How Governments Sanction and Freeze Addresses

‍

Summary

• Crypto sanctions apply existing legal authorities to blockchain addresses, marking specific wallets as property that regulated firms and individuals are barred from interacting with.
• The U.S. Treasury's Office of Foreign Assets Control (OFAC) began attaching wallet addresses to its Specially Designated Nationals (SDN) List in November 2018, and the EU, UK, and other jurisdictions have since built parallel regimes.
• Designation and freezing are separate events, with the authorities publishing the designated addresses while exchanges, custodians, and stablecoin issuers are the parties that actually freeze the funds.
• Sanctioned wallets remain fully visible on-chain, and platforms like Arkham Intelligence label them, map their counterparties, and score exposure for compliance teams.

What Are Crypto Sanctions?

A crypto sanction is a legal instruction from a government or international body which restricts movement or economic activity around a specified entity or address. While a crypto sanction does not change the data on the blockchain, it impacts the position of everyone within that government's jurisdiction who might otherwise interact with said entity or address.

This differs from a traditional bank account freeze in the way that a bank can lock a customer out of their own balance because the bank controls access to the account. No equivalent authority exists over permissionless blockchains like Bitcoin or Ethereum. A sanctioned address is closer to a serially numbered banknote circulated after a robbery. The banknote can be held with little to no consequence, but spending it anywhere that might check the serial number then becomes the issue.

In the U.S., an OFAC designated address means that U.S. persons must block any property involving it and are prohibited from transacting with it, unless OFAC has issued a licence. The same logic extends to entities. When an exchange is designated, every wallet it controls falls under the prohibition, whether or not OFAC has explicitly published the address.

Each country has its own governing body that regulates sanctioned addresses and entities, with OFAC being the most active and the most consequential, given the dollar's role in global settlement. The European Union (EU) legislates through Council regulations, and its 19th sanctions package, adopted on 23 October 2025, introduced the bloc's first ban on transactions involving a specific crypto asset: the ruble-backed A7A5 token. Similarly, the UK's Office of Financial Sanctions Implementation runs its own asset freeze regime and has designated crypto businesses independently, including Huobi Global in May 2026.

The motives for crypto sanctions generally cluster around a handful of national security priorities: North Korean revenue generation, Iranian oil and proxy financing, Russian sanctions circumvention, ransomware infrastructure, and, more recently, the Southeast Asian fraud economy. In April 2026, OFAC designated Cambodian senator Kok An and 28 associated individuals and entities over scam compounds that defrauded Americans through digital asset investment schemes.

A key distinction to note, a designation differs from the actual freezing of funds. While the two often come hand in hand, the designation is an administrative procedure, while freezing of funds requires technical intervention, either through smart contract blacklisting or account locks by exchanges.

How Do Governments Sanction Crypto Addresses?

Identify the target: Investigators attribute wallets to a person, group, or company using a mix of subpoenaed exchange records, seized servers, informant testimony, and blockchain tracing. Attribution must be backed by evidence to survive legal scrutiny, since designations can be challenged.

Add the address or addresses to a sanctions list: In the U.S., OFAC appends addresses to an SDN entry as identifiers, formatted by asset ticker. An example from a Federal Register notice from July 2026 lists two designated parties and one entity, alongside their linked addresses on Bitcoin, Ethereum, Solana, and more, attached under the "Digital Currency Address" field. Crucially, OFAC also notes that its address listings "are not likely to be exhaustive", and instructs anyone who identifies further wallets belonging to a designated person to block them and file a report.

‍

‍

Regulated firms block or freeze: Exchanges, custodians, brokers, and payment processors screen against the updated list. Under OFAC FAQ 646, a U.S. person holding blocked virtual currency must deny all parties access to it and report it to OFAC within 10 business days, then annually while it remains blocked. Firms are not required to convert it to dollars.

Monitor for continued activity. Since designation alone cannot halt transactions, agencies and their private-sector partners watch what the wallet does next, which frequently produces the intelligence behind the following round of designations.

The third and fourth steps in the sanction process reveal its structural limitations. A designated address can still broadcast transactions, pay gas, and interact with smart contracts, because the blockchain or protocols has no concept of a sanctions list. As such, the law can only limit the ability for these addresses to be able to spend their illicit funds. Regulated exchanges refuse the deposit, fiat off-ramps close, and counterparties that have proper screening measures in place will not service them.

How Are Sanctioned Crypto Funds Frozen?

Since the majority of public blockchains are permissionless, freezing can only happen at points where administrative control can be exercised, either on the assets themselves or the accounts holding them.

The first and largest of these is the centralised exchange. When a user's balance sits in an exchange's omnibus wallet, the exchange holds the keys to the balances on the wallet and has full control over that balance the same way a bank does over its deposits. As such, an exchange can freeze the funds of any of its users where required. This is why designations aimed at exchanges land harder than designations aimed at individual self-custody wallets.

The second is the stablecoin issuer. Tokens like USDT and USDC are issued through smart contracts that include a blocklist function, allowing the issuer to render a specific address unable to move its balance. The tokens stay in the wallet and remain visible to anyone looking. They simply stop being transferable. This is the most decisive freezing mechanism currently available in crypto, and it operates entirely at the contract level rather than through any blockchain-wide rule.

‍

‍

On 6 March 2025, during a coordinated U.S., German, and Finnish operation against the sanctioned Russian exchange Garantex, Tether froze roughly $27 million in USDT held in the platform's wallets. Garantex suspended trading and withdrawals the same day. More recently, in July 2026, OFAC updated its Central Bank of Iran designation to add four Tron addresses as identifiers, and Tether froze approximately $131 million across them, bringing the total blocked Iran-linked USDT to around $475 million. Note that in the freezing of funds linked to the Central Bank of Iran, OFAC themselves did not freeze any funds. It published four addresses, and Tether, a private issuer, acted on them.

Where there is no controlling party, funds are unable to be frozen. The Fifth Circuit made this point in Van Loon v. Department of the Treasury, holding that Tornado Cash's immutable smart contracts were not property that could be blocked under the International Emergency Economic Powers Act, since nobody, including the original developers, could alter or control them. As a result, OFAC removed the Tornado Cash contracts from the SDN List on 21 March 2025.

How to Identify Sanctioned Addresses On-Chain

The transparency that lets criminals move value quickly also makes designated wallets easy to identify and track on-chain.

Arkham Intelligence maintains a set of dedicated tags for such addresses, including OFAC Sanctioned and UK Sanctioned, applied to addresses named by those authorities. Searching an address on Arkham returns any tags attached to it along with the entity it belongs to, which matters because designated actors control far more wallets than such lists can cover exhaustively.

From an entity page, several key points of data stand out:

Transaction history: Reviewing inflows and outflows chronologically establishes when a wallet first became active, what or who it was funded by, and whether activity stopped at designation or carried on regardless. Dormancy after a freeze looks materially different from a wallet that keeps cycling funds.

Counterparty tracing: Arkham's Visualizer renders fund flows as a graph, allowing easy mapping of relationships with other addresses. Similarly, the Tracer tool facilitates the tracing of value across hops and identifies where it eventually reached a labelled exchange deposit address. That endpoint is usually the most actionable intelligence in a sanctions investigation, because it is the point where an identity can be linked to the wallet.

‍

‍

Exposure assessment: Direct matches against a published list are the easy case. The harder question is often indirect exposure, where a counterparty received funds two or three hops removed from a designated address. Labels enable compliance teams to assess the risk from these designated addresses easily while a well set-up alert system can further notify the team for any further fund movement from the address.

Arkham Risk Scores Add-on

For teams seeking to implement this assessment programmatically rather than manually, Arkham offers Risk Scores as a paid add-on to the Arkham API.

Risk Scores return a rating between 0 and 100 measuring an address or entity's exposure to illicit activity. The system evaluates funds both sent and received, then calculates a weighted average of exposure across several risk factors. Every score arrives with a Risk Briefing containing the reasoning behind the number, the categories assigned to the address or entity, and the specific risky addresses connected to it.

‍

‍

The scoring draws on Arkham's underlying dataset of 7.7 billion address tags and 878,000 entity profiles, built by the proprietary ULTRA engine alongside in-house analysts. The breadth of the database is optimal for sanctions work specifically, given OFAC's own acknowledgement that its published address lists are incomplete. Screening against the list alone catches only what has already been published.

Clients currently use the endpoint to evaluate counterparty risk before onboarding, flag depositors automatically at the point of transfer, and feed custom AML workflows. Integration follows standard API patterns, so scores can be requested at account creation, before withdrawal approval, or on a scheduled sweep of an existing customer base.

Conclusion

Crypto sanctions work in two core phases: designation and freezing. Governments identify targets and publish identifiers, while exchanges, custodians, and stablecoin issuers carry out the actual freezing of funds. Neither half functions well without the other, which is why designations work most effectively when there is a controlling party involved.

For teams or individuals conducting due diligence, the practical takeaway is that a sanctioned address never disappears. It stays on the blockchain, with its full history intact and every counterparty it ever touched available for inspection. This transparency makes screening and assessing indirect risk exposure so much more accessible for compliance teams worldwide.