OFAC Sanctioned 134 ISIS-K Crypto Addresses in 2026

On July 2, 2026, the U.S. Treasury’s Office of Foreign Assets Control added 134 crypto wallet addresses to its ISIS-K sanctions entry, extending a counterterrorism enforcement framework into a discrete set of blockchain identifiers rather than naming only persons or organizations.^[1] The sanctioned set comprised 131 Tron addresses and 3 Monero addresses, indicating that the action focused primarily on a Tron-based fundraising and transfer network while also identifying a smaller privacy-coin component.^[2] In the present record, the event was therefore a regulatory intervention into alleged illicit financing infrastructure, not a theft, protocol exploit, or exchange failure.^[1][2]

The earliest pivotal element documented in the brief was the accumulation of activity across the Tron wallets from 2023 onward. CoinDesk, citing Chainalysis, reported that the Tron addresses later added to the sanctions entry had received more than $1.4 million since 2023.^[3] The same report stated that those wallets had sent more than $880,000, suggesting that the addresses were not merely static donation endpoints but part of an active transfer network through which funds moved onward after receipt.^[4] The brief did not include transaction hashes, counterparties, or a complete address list, so the exact path by which funds entered and exited the network was not established in the present record, but the aggregate figures indicate sustained use over a multiyear period rather than a single episodic campaign.^[3][4]

The attribution mechanism described in public reporting rested on blockchain tracing and intelligence synthesis rather than on a disclosed judicial record. Chainalysis said that ISIS-K used its media arm, al-Azaim Media Foundation, to solicit crypto donations through websites and messaging platforms.^[6] Within that framing, the wallet cluster appears to have functioned as an intake and routing layer for donations associated with propaganda or outreach channels rather than as an operational treasury publicly identified through ordinary commercial activity.^[6] Because the brief only preserved the reported attribution and not the underlying analytical dossier, the link between each individual address and any specific operator has remained evidentiary by report rather than independently reproducible from the materials provided.^[6]

The decisive intervention occurred on July 2, 2026, when OFAC formally added the 134 addresses to the ISIS-K sanctions entry.^[1] In practical terms, the designation changed the compliance status of those identifiers for U.S.-linked persons and firms and created a basis for immediate service-provider action where technical control existed.^[1] That distinction mattered because the sanctioned set spanned two different technical environments. The 131 Tron addresses were reported to have been frozen by Tether, whereas the 3 Monero addresses were identified in the sanctions action without any corresponding freeze mechanism described in the brief.^[2][5] The event therefore illustrated how sanctions enforcement can produce materially different operational outcomes depending on whether assets are held in a token system with issuer-level administrative controls or in an asset class where such controls are not described in the source record.^[2][5]

Tether’s reported response was immediate and comprehensive within the Tron subset identified by the source. CoinDesk reported that Tether froze balances on all 131 Tron addresses.^[5] That action did not require a protocol-wide halt or validator-level intervention; instead, it relied on the issuer’s ability to block token balances on supported chains.^[5] In effect, the sanctions designation and the issuer’s control function combined to convert a list-based regulatory action into an operational constraint on wallet usability for the affected Tron addresses.^[1][5] The brief did not state the balances present at the moment of freezing, did not identify whether non-USDT assets were held in those wallets, and did not establish whether any value had already moved beyond the frozen addresses before the action took effect.^[3][4][5]

The chain composition of the sanctions set also shaped the likely enforcement profile. Tron accounted for 131 of the 134 addresses in the designation, while Monero accounted for 3.^[2] In the source record, only the Tron side was paired with a documented post-designation freeze by a centralized issuer.^[5] The Monero addresses were therefore significant less because of their count than because they marked an acknowledged privacy-coin component in the alleged network, one for which the brief offered no equivalent custodial or issuer-side remediation path.^[2] As a result, the action appears to have had two layers: a broad legal prohibition covering all listed addresses and a narrower technical immobilization affecting the Tron wallets where Tether’s control was available.^[1][2][5]

The documented consequences were regulatory and operational rather than market-wide. Treasury added 134 addresses to the ISIS-K sanctions entry, and CoinDesk reported that Tether froze balances on all 131 sanctioned Tron wallets.^[1][5] Public reporting further stated that the Tron wallets had received more than $1.4 million since 2023 and sent more than $880,000, which establishes the scale of the network cited in the designation record.^[3][4] The present dossier did not establish any seizure, forfeiture, criminal charge against identified wallet operators, or final disposition of frozen balances.^[5] It also did not document broader market dislocation, user losses, or protocol-level outages arising from the action.^[1][5]