Guide · Address risk · · by Stefan Tsezarov
The Address You Can't Pay
A sanctioned wallet looks like every other wallet. The blockchain will send money to it without hesitation. The law may see it very differently.
No warning appears. No screen turns red. In most cases, the transaction confirms like any other.
A blockchain can send money almost anywhere. Sanctions law decides where some people are allowed to send it.
This guide explains what a sanctioned address is, how ordinary people can end up touching one without meaning to, and what an address check can — and cannot — tell you. This is general information, not legal advice.
01What "sanctioned" means
Governments keep sanctions lists naming people, companies and organisations that people under their jurisdiction may be prohibited from dealing with.
The best-known U.S. list is maintained by the Treasury Department's Office of Foreign Assets Control, or OFAC. It is called the Specially Designated Nationals and Blocked Persons list — usually just the SDN List.
On 28 November 2018, OFAC did something new: alongside two names on the SDN List, it published their Bitcoin addresses. The two men were not accused of the hacking. They were accused of handling the money — turning ransom payments from the SamSam ransomware, which had hit hospitals, universities and government agencies, into Iranian rial.
From then on, crypto addresses could appear directly in sanctions records. Two things follow from that.
An address is an identifier, not a person. When an address appears on a sanctions list, it helps identify the person or entity behind it. Think of it less like "this wallet is evil" and more like "this is one of the identifiers attached to a designated party." The prohibition is on dealing with that party. Paying their address is dealing with them.
Sanctions apply to people and entities, not to blockchains. A blockchain does not have a nationality. Your legal obligations do.
U.S. sanctions, for example, generally apply to U.S. citizens and permanent residents wherever they are, to people and entities in the United States, and to U.S.-incorporated companies and their foreign branches. Other countries have their own sanctions regimes. They can overlap with U.S. lists, but they are not identical. Which rules apply to you depends on who you are, where you are, and which regime is involved.
02Why the blockchain won't stop you
A bank checks a payment before it leaves. There are sanctions-screening systems. There are compliance teams. There are people whose entire job is to stop a transaction that should not go through.
A blockchain has none of that built into the payment itself. It checks whether the transaction follows the network's rules — a valid signature, enough balance — and does not ask whether the destination appears on a sanctions list.
Paste in an address. Press send. Sign the transaction. It confirms like any other.
No sanctions officer appears. No legal warning. And there is usually no undo button.
There is one partial exception. Some stablecoin issuers can block their own token at addresses they have blacklisted; Circle's USDC contract, for example, refuses transfers to or from them. That is the issuer's decision about its own token, not the network checking your payment, and it does not cover ETH or most other tokens.
So the important check has to happen somewhere else: before you send.
The blockchain verifies the transaction. It does not decide whether you were allowed to make it.
03You can receive from one without asking
Anyone can send crypto to a public address. You cannot stop someone from choosing yours. You may not have asked for the transfer. You may not even know who sent it.
On 8 August 2022, OFAC sanctioned Tornado Cash, a mixing service that makes crypto harder to trace. The Treasury said it had been used to launder more than $7 billion since 2019, including over $455 million stolen by North Korea's Lazarus Group.
The next day, someone sent small amounts of ether out of Tornado Cash to hundreds of public wallets, including ones belonging to a TV host, the chief executive of a major exchange, a sportswear brand and a fund collecting donations for Ukraine.
They had not asked for it. They could not refuse it.
It was a stunt, but it made a real point: being exposed to an address is not the same thing as choosing to deal with it.
That does not mean an incoming transfer can simply be ignored. Exchanges screen where deposits came from. If funds trace back to a listed or otherwise high-risk address, an exchange can hold them while it works out its legal obligations. For a U.S. business, that can mean blocking the funds and reporting them to OFAC.
So yes, someone else can create the problem. You may still be the person left holding it.
04"I didn't know" doesn't make it legal
This is the part many people do not expect.
OFAC can impose civil penalties on a strict-liability basis on people subject to U.S. jurisdiction. In OFAC's own words, a person can be held liable "even if such person did not know or have reason to know" that the transaction was prohibited.
So not knowing does not stop a transaction from being a violation. What it can change is what happens next.
OFAC's enforcement guidelines weigh whether a violation was wilful or reckless, what the person knew, and what they did once they found out. The outcome can range from no action, or a cautionary letter, to a fine. Criminal charges require wilful conduct.
The Tornado Cash dusting shows how that works. A month later, OFAC said its rules still technically applied to those unsolicited transfers. It also said it would not prioritise enforcement against U.S. recipients who reported them late, provided there was no other sanctions link. Still covered by the rules, but not an enforcement priority. That is strict liability in practice.
Enforcement against ordinary individuals over small amounts is rare, and this guide is not suggesting otherwise. But the lesson is simple: the time to check is before the payment. Afterwards, "I didn't check" and "I didn't know" may leave you with the same problem.
05Lists change — in both directions
A sanctions listing is not necessarily permanent. It is a legal status, and legal statuses can change. Tornado Cash is the clearest example there is.
| When | What happened |
|---|---|
| 8 August 2022 | OFAC sanctions Tornado Cash. |
| 26 November 2024 | A U.S. federal appeals court, the Fifth Circuit, rules that Tornado Cash's immutable smart contracts — code nobody owns and nobody can change — are not "property" the sanctions law allows OFAC to block. |
| 21 March 2025 | The U.S. Treasury removes Tornado Cash from the SDN List. |
Same code. Same addresses. Three different answers, depending on the day you asked.
That is why a sanctions check is always a snapshot. An address that is clear today can be listed tomorrow. One that was listed last year may have been removed since.
There is a second delay, too. The databases a scanner reads do not update at the same moment as the official lists, so there can be a gap between a designation or removal and a database reflecting it. Technical Transparency describes the delay that has been observed in the sanctions oracle this scanner uses.
A check is only as current as the data behind it.
06Here is one
This address is real. On 14 April 2022, OFAC added it to its Lazarus Group entry. It is the address that received the crypto stolen from the Ronin Bridge, the bridge connecting the game Axie Infinity to Ethereum: more than half a billion dollars' worth. It is still on the list today.
Real listed address · do not send anything to it
Copy it into the scanner. Choose EVM, then Scan Wallet, then Ethereum, and run the check.
When we checked on 21 September 2026, it returned FAIL, with the finding "On a sanctions list". The security provider's record for the address carries a sanctions flag, and the same record flags it for theft. Chainalysis's sanctions oracle, a separate source, reported it as sanctioned too, and OFAC's own search returned the Lazarus Group entry.
That is what a direct hit looks like. But a hit is only half the story. The more useful question is: what does a miss actually mean?
07What this scanner checks — and what it doesn't
A scanner is not a magic window into a wallet. It checks specific data, from specific sources, across specific chains and time windows.
| Check | What happens |
|---|---|
| Is this EVM address itself listed? | The address is checked against the security provider's malicious-address library, which includes sanctions, theft, phishing and laundering flags. A sanctions match is FAIL. |
| Has this wallet recently dealt with a listed address? | On eight EVM chains, recent token transfers are read and counterparties are checked against the Chainalysis sanctions oracle. The look-back window is short: a little under seven hours on Ethereum, and from about eight minutes to just over an hour on faster chains. A match is CAUTION, not FAIL. Exposure is not the same as designation. |
| Plain ETH moving between wallets | Not seen. The recent-counterparty check reads token transfers only. |
| The wallet's full history | Not checked. The scan does not reconstruct everything the wallet has ever done. |
| Solana, Sui and TRON wallets | Not screened. The scanner has no wallet-screening source for those chains, and says so rather than pretending otherwise. |
| Token contracts | Not checked against sanctions lists. A token scan looks at what the contract can do, not at the identity of whoever may control or use it. |
A check is only as wide as the lists it reads and the history it can see.
A clean result is not a certificate of innocence. It is a result from particular sources, at a particular moment, over a particular window.
08If a check comes back flagged
If it's someone you are about to pay: stop. Don't send. If they offer a different address instead, that does not change who you would be paying. Ask for another way to settle, or walk away.
If funds from a listed address have already arrived: do not panic, but do not casually move them around either.
- Don't send them back on your own. Returning them is itself a payment to the listed address, and for anyone subject to U.S. rules, moving blocked funds can create a second problem. Get advice first.
- Don't move them through other wallets to make them look cleaner. That does not erase their history. It adds to it.
- Write down what happened. Keep the transaction hash, date, amount, source address and any messages that explain how the funds arrived.
- If you are a U.S. person, or you hold the funds for a business, blocked-property and reporting rules may apply. This is where a lawyer is more useful than a forum post.
- If the funds are sitting at an exchange, contact the exchange's support or compliance team.
If it's your own address that's flagged, and you believe the flag is wrong, treat it as a data question first. Security databases can contain mistakes, and lists change. The scanner names the provider behind each finding, so you know where to look. For U.S. sanctions, OFAC's free Sanctions List Search can search digital-currency addresses directly. If the provider's record is wrong, ask them to correct it.
Nobody legitimate needs your recovery phrase to "unfreeze" your crypto.
People whose funds have just been held by an exchange are a favourite target for recovery scams. A stranger who offers to release frozen or stolen crypto — for an upfront fee, or in exchange for your seed phrase — is almost certainly running one.
09What a scan can — and cannot — tell you
A match means: this address appears on a list we could see, at the moment we checked. That is useful.
A miss means much less than people sometimes assume. It means the address did not appear in the sources checked at that time.
It does not prove that the person behind it is legitimate.
It does not prove that the funds are clean.
It does not prove that the address will still be clear tomorrow.
Plenty of people you should never pay have never been listed anywhere.
OFAC says its own search tool "is not a substitute for undertaking appropriate due diligence." That is why this scanner describes a clean result as "no major risk indicators", not "safe".
A sanctions check tells you about one category of risk, using particular sources, at one particular moment. It is worth running every time. It is not the whole answer.
The rule
Check before you send. Not after.
The blockchain does not care who receives the money. The law may care very much.
An address cannot tell you who is behind it. A sanctions list can tell you only once authorities have identified and designated someone. Somewhere between those two facts sits every crypto payment you make.
A check takes thirty seconds. Thirty seconds is cheap. Untangling a bad transaction is not.
Related: why nobody legitimate ever needs your recovery phrase, and tokens you can buy but can't sell. This article is general information, not legal or financial advice. The address in section 6 is published by the U.S. Treasury on the SDN List; it is shown so you can see a real result, and you should not send anything to it.