How to Check If a Crypto Wallet Is Sanctioned

Sanctioned crypto wallet addresses are published on official government sanctions lists — chiefly the US Treasury's OFAC SDN list, which embeds each address in the record of the person or entity it belongs to. The fastest ways to check an address are OFAC's free Sanctions List Search, the downloadable SDN data files, or an API lookup that checks several lists in one call.

Here are all three methods, step by step, with what a match actually looks like and what to do if you get one.

Method 1: OFAC's official Sanctions List Search

OFAC's own lookup tool at sanctionssearch.ofac.treas.gov is free, official, and the right first stop for a one-off manual check:

1. Open the search page and leave the Name field blank.
2. Paste the full wallet address into the ID # field — digital-currency addresses are stored on SDN records as identification numbers, the same field as passport numbers.
3. Search. A hit returns the designated party's entry; open it to see the designation programs, aliases, and every identifier on the record — including any other wallet addresses.

Know the tool's limits before you build a procedure on it: matching is exact (a typo or a partial address returns nothing, and it will not warn you), it checks one address at a time, there is no API or bulk mode, and it only finds addresses directly on the list — it says nothing about a wallet that merely transacted with a listed one. For a quicker manual check with address-first UX, our free SDN search takes a full or partial address directly and also checks the other sanctions and crime lists CompliAPI screens.

Method 2: download the SDN list data

For repeatable checks, OFAC publishes the SDN list as open data files — sdn.csv and sdn.xml (plus the richer sdn_advanced.xml, covered in our download-and-parsing guide) on the Treasury's sanctions list service. Wallet addresses appear as ID entries with a type of Digital Currency Address - XBT, - ETH, - XMR and so on, attached to the designated party's record. Extract those, normalize the formats, and you can grep an address locally.

The catch is freshness: the list changes irregularly, without notice, and a check against last week's download is a check against a list that may no longer exist. Delistings matter as much as additions — screening against a stale file can flag an address that has been removed. If you go this route, poll for changes and reconcile rather than re-downloading on a lazy schedule. (This pipeline — parsing, normalizing, change-polling every 15 minutes, delisting tracking — is exactly what CompliAPI's OFAC SDN ingestion automates.)

Method 3: automated check via API

When the check needs to run inside software — or you just want the answer now with current data — a wallet screening API is one GET request. A free API key works for this; no sales call required:

curl https://api.compliapi.com/api/v1/screen/crypto/0x098B716B8Aaf21512996dC57EB0615e2383E2f96 \
  -H "Authorization: Bearer $COMPLIAPI_TOKEN"

{
  "value": "0x098b716b8aaf21512996dc57eb0615e2383e2f96",
  "flagged": true,
  "sanctioned": true,
  "matches": [
    {
      "list": "ofac",
      "list_name": "US OFAC SDN",
      "list_type": "sanctions",
      "match": "exact",
      "source_url": "https://sanctionssearch.ofac.treas.gov/Details.aspx?id=27307",
      "metadata": { "symbol": "ETH", "sdn_name": "LAZARUS GROUP", "programs": "DPRK3" }
    }
  ]
}

That worked example is real: the address was added to the SDN list in April 2022 as a Lazarus Group address after the Ronin Bridge theft. Beyond OFAC, the same call checks other official lists — Israel's NBCTF seizure orders, FBI-published Lazarus addresses, the UK, EU, French and Japanese lists — plus labeled crime and risk data, with each match naming the list that produced it. ENS names are resolved before screening, and OFAC data is refreshed every 15 minutes.

What a sanctioned wallet match means

A genuine match ties the address to a designated party: the response (or the Treasury search result) names the entity, the sanctions programs, and links the official record. Some designations you may recognize when they show up:

• November 2018 — the first crypto addresses ever added to the SDN list: two Bitcoin addresses used to cash out SamSam ransomware payments through Iranian exchangers.
• September 2021 — Suex, the first crypto exchange designated for laundering ransomware proceeds.
• May 2022 — Blender.io, the first mixer designated; November 2023 — the Sinbad mixer, tied to Lazarus Group laundering.
• August 2022 — Tornado Cash, the most litigated crypto designation — and its addresses were delisted in March 2025, a reminder that removal happens too and stale data cuts both ways.

An SDN match means full blocking sanctions apply to the designated party — different lists carry different obligations, so it matters which list produced the hit (SDN vs Non-SDN, explained).

What to do if you get a match

For US persons and businesses, the broad shape of the obligation on a true SDN match:

• Don't proceed with the transaction. If you hold assets of the designated party, they are generally required to be blocked — frozen, not returned.
• Report. Blocked property must be reported to OFAC, generally within 10 business days, with annual reports thereafter.
• Verify it's a true match first. Confirm the full address matches exactly and review the official record linked from the result — that is what the source_url is for.
• Document everything — the check you ran, when, against what data, and the decision taken. This record is what an examiner asks for.
• Escalate, don't improvise. Match handling belongs in your sanctions policy, with counsel where the situation is ambiguous — jurisdictions outside the US have their own regimes and obligations.

This is general information, not legal advice; what a match obliges you to do depends on your jurisdiction and facts.

How addresses end up sanctioned

OFAC targets people, companies and organizations — not coins. When it designates a party involved in ransomware, sanctions evasion, North Korean hacking or other targeted conduct, it publishes the identifiers attributed to them, and since November 2018 that has included their crypto addresses. Because blockchain transactions are pseudonymous rather than anonymous, publishing the address is often the single most enforceable identifier a designation carries: anyone can check an address against the list before moving funds — which is precisely the check regulators expect exchanges, payment processors and DeFi frontends to run (what crypto wallet screening is and how it works).

The lists change constantly in both directions — designations land with enforcement actions, and delistings follow litigation and policy shifts. Whatever method you use from this guide, make sure the data behind it is current on the day you check.