OFAC Just Hit 134 ISIS-K Crypto Wallets

OFAC Adds ISIS-K Wallets

OFAC’s July 1 recent action updated the ISIL Khorasan listing with digital currency addresses, including a long set of TRX identifiers and Monero identifiers. The Treasury page labels the designation under counter terrorism authorities and lists the addresses as identifiers tied to the sanctioned group.

Chainalysis said ISIS-K is the Islamic State’s Pakistani and Afghan affiliate and that its media arm has historically solicited donations through websites and messaging platforms. The firm said it has collected historical donation addresses on Tron, Monero and Bitcoin.

The address mix matters because the enforcement tools are different. A TRON address holding USDT can be screened and, where issuer controls apply, frozen by Tether. A Monero address is useful to investigators as an identifier, but Monero’s privacy design makes balances and counterparties harder to observe publicly.

That split is the compliance story. OFAC can list both types of identifiers, but the practical disruption depends on where funds sit, which services touch them, and whether a centralized issuer or exchange can act quickly.

Tether Freeze Hits Tron

Chainalysis said Tether froze the balances on all 131 TRON addresses in the ISIS-K update. Tether had not immediately published a separate statement on the freeze at the time of writing, so the public record rests on OFAC’s list and Chainalysis’ on-chain analysis.

The freeze adds to a recurring stablecoin enforcement pattern. In June, Daily Crypto Briefs covered Tether freezing $72 million in USDT after investigators linked a Tron wallet to Monero buying, showing how stablecoin issuer controls can collide with privacy-coin liquidity when law enforcement risk rises.

For crypto businesses, the operational lesson is not limited to ISIS-K. Wallet-screening systems need to update when OFAC identifiers change, but they also need lookback checks for previous exposure to now-designated addresses. A counterparty that was not on a list yesterday can become a sanctions issue today.

The action also shows why Tron remains central to stablecoin compliance debates. USDT on Tron is cheap and widely used, which helps legitimate remittances and exchange flows, but the same properties make it a frequent rail in illicit-finance investigations.

Monero Shift Raises Screening Risk

TRM Labs said in its July 1 report that ISKP has relied heavily on USDT for years, with transactions ranging from roughly USD 10 to USD 15,000. It also said the group began publicly soliciting Monero donations through Voice of Khurasan in late 2023.

That shift does not mean stablecoins are fading from terrorist-financing cases. It means sanctioned networks can use both models: transparent, liquid stablecoin rails when they need reach, and privacy coins when they want to reduce public traceability.

Daily Crypto Briefs has followed the policy pressure around privacy assets, including the Philippines’ move to block privacy coins from licensed exchanges. The ISIS-K update gives regulators another concrete case to cite when arguing that privacy-coin support creates higher compliance obligations for venues.

The broader market backdrop remains weak.

What remains unknown is how much of the sanctioned wallet flow can be recovered, whether any exchanges will disclose blocked transactions and whether OFAC will add counterparties that interacted with the listed addresses. The next thing to watch is not only another sanctions notice, but whether stablecoin issuers, analytics firms and exchanges publish evidence that the new identifiers led to real-time disruption.