OFAC lists 134 ISIS-K crypto wallets; Tether freezes 131 TRON

The U.S. Treasury's Office of Foreign Assets Control (OFAC) added 134 cryptocurrency addresses tied to Islamic State Khorasan (ISIS-K, also written ISKP) to its Specially Designated Nationals list on July 1, 2026. The breakdown, confirmed by OFAC's recent-actions page and the two blockchain-analytics firms that reconstructed the network: 131 TRON (TRX) addresses and 3 Monero (XMR) addresses. Tether — the largest USDT issuer, whose token contract runs on TRON among other chains — blacklisted the 131 TRON addresses within hours of designation, freezing whatever USDT balances remained on them. The 3 Monero addresses stay out of reach: Monero's default view-key-hidden design makes both third-party tracing and any issuer-side freeze structurally impossible.

What OFAC and Tether actually did

OFAC's July 1 update is a designation refresh, not a first-time listing — ISIS-K itself was already designated. The addition attaches 134 specific digital-currency identifiers to the existing entity entry, converting them into blocked property under Executive Order 13224. From the moment the SDN update publishes, any U.S. person or entity — and any non-U.S. counterparty processing dollars through U.S. correspondents — must reject or freeze transactions with those addresses.

Tether's response is procedural and fast. The USDT contract on TRON exposes an AddBlackList function callable by the issuer; once an address is added, the token contract refuses transfer from that address regardless of who holds the private key. Tokens don't leave the wallet; they can't move either. That's the "kill switch" Tether uses whenever a sanctioned wallet holds a stablecoin balance that Tether can reach. Tether has not, as of publication, posted a dedicated statement about the July 1 action on its news feed.

Numbers

- OFAC designation date       : 2026-07-01
- Addresses added to SDN      : 134 total
                                — 131 TRON (TRX)
                                — 3 Monero (XMR)
- Tether freeze scope         : 131 TRON addresses (USDT balances)
- Tether freeze latency       : within hours of designation
- Inflows since 2023          : > USD 1.4M received across the 131 TRX wallets
- Outflows since 2023         : > USD 0.88M sent from the 131 TRX wallets
- Total network estimate      : ~USD 2M (TRM Labs framing)
- Counterparty geography      : off-ramps identified in Syria among others
- Legal authority             : Executive Order 13224 (counterterrorism)

Numbers are drawn from Chainalysis and TRM Labs, which reconstructed the flows independently.

The Monero gap OFAC did not resolve

Three of the designated addresses are Monero. OFAC's designation blocks U.S. persons from transacting with them, but no Monero equivalent of Tether's blacklist function exists. The Monero protocol hides amounts, receiver and sender by default via ring signatures and stealth addresses. That leaves the three XMR addresses in a category the sanctions regime has not solved: legally blocked, operationally untouchable. Chainalysis' write-up flags the gap without proposing a fix; TRM Labs frames it the same way.

Skeptical attribution note: neither Chainalysis nor TRM published transaction hashes for the individual TRX wallets in their public posts; the SDN entries themselves list the addresses. The $1.4M / $880K figures are analytics-firm reconstructions, not law-enforcement claims. The Syria exposure was flagged by both firms; the OFAC entry does not itself name off-ramps.

What to watch

1. Exchange KYC updates. Any address that received funds from the 131 TRX wallets in the last 24 months is now downstream of a sanctioned counterparty. Tron-focused exchanges (Binance, HTX, Bybit, KuCoin) will be scrubbing histories against the new SDN entries; expect account-level actions on identified counterparties.
2. Non-USDT balances on the same TRX wallets. Any TRX, TRC-20 tokens other than USDT, or NFT-style assets sitting on those 131 wallets are not affected by Tether's blacklist. They remain movable unless the token issuer takes parallel action or a validator-level policy is introduced (Tron has none).
3. Whether Justin Sun / Tron Foundation takes protocol-level action. Tron itself has no address-freeze primitive at the L1. Any additional TRX-level enforcement would need to come from block producer coordination — a step no major PoS or DPoS chain has taken over a sanctions listing to date.
4. Follow-on designations. OFAC's July 1 entry is a refresh, not a one-off. Analytics firms and prior designations suggest the ISKP network is broader than 134 addresses; further TRX and XMR additions are likely.

Context — stablecoin issuers are now standing enforcement infrastructure

This is not novel behavior — it is the maturation of a pattern. Tether's public tally of assisted freezes has run in the hundreds of millions of dollars over the last two years, coordinated with OFAC, DOJ, and foreign law enforcement through the T3 Financial Crime Unit that Tether, Tron and TRM Labs set up in 2024. Circle exposes the same primitive on USDC and used it in the court-ordered freeze on $12.6M of cUSDC held in a Zama contract. The June 25 OFAC-CFIUS action against Aeza Group and the 2024 designations of Garantex-linked wallets fit the same shape: designate the address, let the token issuer freeze the balance, treat the on-chain layer as an extension of the correspondent-banking freeze regime.

The Monero gap is the one part of that regime that does not close. Every subsequent designation that lists XMR addresses will be a reminder of it.

Sources:

• OFAC — Recent Actions, 2026-07-01 (primary designation).
• Chainalysis — OFAC Sanctions 100+ ISIS-K Crypto Addresses (address breakdown, flow analysis).
• TRM Labs — OFAC Sanctions 134 ISKP Cryptocurrency Addresses Tied to USD 2 Million in Terrorist Financing (independent analytics reconstruction, 2023 Istanbul arrest reference).
• Tether — T3 FCU announcement (2024) (background on Tether/TRON/TRM enforcement stack).