Finance · Fintech · Crypto — explained

Start here Search/
Bitfolio

An independent explainer desk · No ads · No affiliate links

Sections

Start here · Search · About

PolicyExplainer

How do sanctions apply to crypto? OFAC, wallet addresses and the Tornado Cash case

Sanctions law does not care whether money moves through a bank or a blockchain. Here is how the US Treasury applies it to crypto, and why the Tornado Cash case became a test of its limits.

By the Bitfolio Explainer Desk · Checked against primary sources · 7 min read

Education only, not investment, tax or legal advice. Crypto-assets are high-risk — risk disclosure.

The columned facade of the US Treasury Department building in Washington, DC
Photo: “The US Treasury Department” by *rboed*, CC BY 2.0, via flickr.com · Edited: duotone, cropped.

The short answer

US sanctions apply to crypto exactly as they do to dollars. The Treasury's Office of Foreign Assets Control (OFAC) lists sanctioned people and entities, sometimes with their wallet addresses, and US persons must not deal with them. Penalties can apply even without knowledge, because civil liability is generally strict.

Key takeaways

  1. OFAC says sanctions obligations are the same whether a transaction uses crypto or traditional currency.
  2. Since 2018 OFAC has added known crypto addresses to some entries on its Specially Designated Nationals (SDN) list, but it warns these lists are unlikely to be complete.
  3. Civil sanctions penalties are generally based on strict liability, so a US person can be liable without knowing a violation occurred.
  4. Tornado Cash was sanctioned in 2022; a federal appeals court ruled in 2024 that its immutable smart contracts were not blockable property, and Treasury removed it from the list in March 2025.
  5. Crypto firms have faced large penalties, including a $968 million OFAC settlement with Binance in 2023.

What are sanctions, and who enforces them for crypto in the US?

Economic sanctions are legal restrictions that cut named people, companies or countries off from a country's financial system. In the US they are administered by the Office of Foreign Assets Control (OFAC), part of the Treasury Department. OFAC's central tool is the Specially Designated Nationals and Blocked Persons list, usually called the SDN list2.

When someone is added to the list, US persons must block (freeze) property in which that person has an interest and must not deal with them unless OFAC authorises it24. OFAC's 2021 guidance for the crypto industry is blunt: these obligations apply equally to transactions in virtual currency and in traditional fiat money1.

Risk warning

Not knowing is not a defence

OFAC says civil penalties for sanctions violations are generally based on strict liability: a US person can be held liable even without knowing, or having reason to know, that a transaction broke sanctions1. Sending crypto to, or receiving it from, a sanctioned person's address therefore carries real legal risk.

OFAC expects crypto businesses to run a risk-based compliance programme with five parts: management commitment, risk assessment, internal controls, testing and auditing, and training1. It also suggests tools such as geolocation and IP-address blocking to keep users in sanctioned jurisdictions out1.

How do sanctions lists include crypto wallet addresses?

In 2018 OFAC began adding known virtual currency addresses to SDN entries as identifying information1. An address appears in the entry much like a passport number would, and anyone can search for it in OFAC's Sanctions List Search tool by entering it in the ID field; the tool only returns exact matches2.

Figure · What happens when a firm finds a listed address

What happens when a firm finds a listed address01Screenmatch address to SDNlist02Blockdeny all partiesaccess03Reportto OFAC in 10business days04Keep reportingannual blockedproperty report
  1. 01Screenmatch address to SDN list
  2. 02Blockdeny all parties access
  3. 03Reportto OFAC in 10 business days
  4. 04Keep reportingannual blocked property report
Simplified steps from OFAC's guidance and FAQs for businesses that hold customer crypto. Source: [1]

The list is a floor, not a ceiling. OFAC says its address listings are not likely to be exhaustive, and expects firms that find other wallets belonging to a listed person to block them and report them too3. When a firm identifies blocked crypto, it must deny all parties access to it2 and report it to OFAC within 10 business days, then annually1.

What happened with Tornado Cash?

Tornado Cash is a mixer: software on the Ethereum blockchain that pools deposits so it is hard to link the coins that go in with the coins that come out; Treasury described it as obscuring the source and destination of funds5. On 8 August 2022 Treasury sanctioned it, saying it had been used to launder more than $7 billion worth of virtual currency since 2019, including over $455 million stolen by the Lazarus Group, a North Korean state-sponsored hacking group4.

On 8 November 2022 OFAC removed and simultaneously re-designated Tornado Cash, adding North Korea-related authority to the original cyber-related one5. A group of plaintiffs challenged the designation in court. On 26 November 2024 the Fifth Circuit Court of Appeals ruled in Van Loon v. Department of the Treasury that Tornado Cash's immutable smart contracts, code that no one can change or control, are not "property" that can be blocked under the International Emergency Economic Powers Act (IEEPA), and that OFAC had exceeded its authority6. The court did not decide whether Tornado Cash is an entity that could be sanctioned in other ways6.

Figure · Tornado Cash and US sanctions

Tornado Cash and US sanctionsAug 2022Treasury sanctionsmixerNov 2022Re-designatedNov 2024Appeals courtrulingMar 2025Removed from SDNlistAug 2025Co-founder verdict
  1. Aug 2022Treasury sanctions mixer
  2. Nov 2022Re-designated
  3. Nov 2024Appeals court ruling
  4. Mar 2025Removed from SDN list
  5. Aug 2025Co-founder verdict
Dates from Treasury, OFAC, the Fifth Circuit and the Justice Department.

On 21 March 2025 Treasury removed Tornado Cash from the SDN list, citing the novel legal and policy questions raised by applying sanctions to evolving technology78. It said it remained deeply concerned about North Korean hacking and money laundering, and urged US persons to be cautious about transactions that could benefit those actors7. In the same action, the entry for co-founder Roman Semenov was updated but kept on the list under North Korea sanctions8.

Separately, criminal charges continued. On 6 August 2025 a federal jury convicted co-founder Roman Storm of conspiracy to operate an unlicensed money transmitting business, which carries a maximum of five years in prison9. That conviction is about money transmission law, not the sanctions listing.

Which crypto businesses have faced sanctions or penalties?

Tornado Cash is the best-known case, but it was not the first. Treasury actions against crypto businesses fall into two groups: designations, which put a business on the SDN list, and enforcement settlements, where a firm pays a penalty for apparent violations.

Selected US Treasury actions involving crypto businesses (as described in Treasury press releases)

YearBusinessAction
2021SUEXFirst sanctions designation of a virtual currency exchange10
2022GarantexDesignated over its role in Russia's financial sector11
2022Tornado CashMixer designated; removed in 202548
2023Binance$968 million OFAC settlement, part of $4.368 billion with FinCEN12
2025Garantex and GrinexNew designations of Garantex and its successor exchange Grinex11

The Binance settlement shows how sanctions risk builds up on large platforms. Treasury said more than 1.67 million virtual currency trades took place on the exchange between US users and users in sanctioned jurisdictions, including Iran, North Korea, Syria and Crimea, between 2017 and 202212.

What mistakes do people make about crypto and sanctions?

Common beginner mistakes

  1. Thinking crypto sits outside sanctions law

    OFAC treats crypto and fiat transactions the same. A blockchain does not change who you are allowed to deal with.

  2. Assuming an unlisted address is safe

    Listed addresses are not exhaustive. A wallet controlled by a sanctioned person is covered even if its address is not printed on the list.

  3. Reading the Tornado Cash delisting as approval

    Treasury removed the listing but stressed continuing concern about North Korean laundering, and criminal cases tied to the mixer went ahead.

  4. Ignoring where a platform operates

    OFAC expects platforms to keep out users in sanctioned jurisdictions, including with IP-address controls1. Platforms that fail to do so can face heavy penalties, as the Binance settlement shows12.

For the wider anti-money-laundering rules that crypto firms follow, see our explainers on KYC and AML and the FATF Travel Rule.

Frequently asked questions

Can I check whether a crypto address is sanctioned?

Yes. OFAC's Sanctions List Search tool lets you enter an address in the ID field; it returns exact matches only2. A clean result does not prove the owner is not sanctioned, because listings are not exhaustive3.

Is it illegal to use Tornado Cash now?

Tornado Cash is no longer on the SDN list as of 21 March 20258. Treasury still urged caution about transactions that could benefit North Korea or other malicious cyber actors7. Other laws, such as money transmission and anti-money-laundering rules, still apply.

What happens to crypto that gets blocked?

The holder must deny all parties access to it and report it to OFAC within 10 business days, then annually12. Dealing in blocked property is prohibited unless OFAC authorises it4.

Do sanctions only matter for big exchanges?

No. The obligations apply to US persons generally, and civil liability is generally strict1. Businesses carry the heaviest compliance duties, but individuals are covered too.

Do other countries sanction crypto too?

Many countries run their own sanctions regimes. This explainer focuses on US rules administered by OFAC; check the relevant national authority for other jurisdictions.

The bottom line

In US law, crypto is just another way to move value, so OFAC's sanctions rules apply in full: no dealing with listed people, freeze what you hold of theirs and report it. Wallet addresses on the SDN list help, but they are not a complete map. The Tornado Cash saga shows that courts can limit how far sanctions reach into software, but it did not loosen the rules for transactions with sanctioned people.

Sources

  1. Sanctions Compliance Guidance for the Virtual Currency Industry — Office of Foreign Assets Control, U.S. Treasury, 2021 Primary source
  2. Questions on virtual currency (FAQs 559-563, 594, 646-647) — Office of Foreign Assets Control, U.S. Treasury, 2018 Primary source
  3. FAQ 562: How will OFAC identify digital currency-related information on the SDN List? — Office of Foreign Assets Control, U.S. Treasury, 2018 Primary source
  4. U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash (jy0916) — U.S. Department of the Treasury, 2022 Primary source
  5. Treasury Designates DPRK Weapons Representatives (jy1087) — U.S. Department of the Treasury, 2022 Primary source
  6. Van Loon v. Department of the Treasury, No. 23-50669 (5th Cir. 2024) — U.S. Court of Appeals for the Fifth Circuit, 2024 Primary source
  7. Tornado Cash Delisting (sb0057) — U.S. Department of the Treasury, 2025 Primary source
  8. Cyber-related Designation Removal; North Korea Designation Update and Removal (Recent Actions, 21 March 2025) — Office of Foreign Assets Control, U.S. Treasury, 2025 Primary source
  9. Press release on the jury verdict against Tornado Cash co-founder Roman Storm (6 August 2025) — U.S. Attorney's Office, Southern District of New York, 2025 Primary source
  10. Treasury press release on the designation of SUEX (jy0364) — U.S. Department of the Treasury, 2021 Primary source
  11. Treasury Sanctions Cryptocurrency Exchange and Network Enabling Sanctions Evasion and Cyber Criminals (sb0225) — U.S. Department of the Treasury, 2025 Primary source
  12. Treasury enforcement actions involving Binance (jy1925) — U.S. Department of the Treasury, 2023 Primary source

How we checked this page: every figure above links to the numbered source it came from. Spotted an error? Tell the desk — see our editorial policy.

Read next