Wallet addresses OFAC publishes against the parties on its SDN list. They are taken from the SDN file itself, where an address is recorded on the entity it belongs to, so a hit tells you both that the address is sanctioned and which designated party holds it.

address

network

info

entity

Cryptocurrency addresses on the OFAC SDN list

Addresses associated with the Tornado Cash mixer. Funds passing through a mixer are deliberately hard to trace, which is what makes an address linked to one worth knowing about even when it carries no designation of its own.

Addresses linked to Tornado Cash

Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122

Addresses reported as having received ransomware payments. Reports are crowdsourced and verified against the public ledger, so a hit means an address has been reported in connection with a ransomware campaign rather than sanctioned by an authority.

Addresses reported for ransomware

Addresses sanctioned, or reported for ransomware and mixing

Cryptocurrency wallets

3 sources in this category