The U.S. Treasury’s Office of Foreign Assets Control updated its ISIS-K designation on July 1, 2026, adding digital currency addresses tied to the terrorist network. Tether froze the balances on all 131 TRON addresses named in the update within hours.
Key Takeaways
- ISIS-K (ISIL-Khorasan) designation added 134 crypto wallet identifiers, including 131 TRON addresses and three Monero addresses.
- Tether froze the balances on all 131 TRON addresses tied to the network, cutting off access to the stablecoin holdings same-day.
- The 131 flagged TRON wallets had received more than $1.4 million and sent over $880,000 since 2023, per Chainalysis tracing.
- The three designated Monero addresses cannot be frozen the way USDT on TRON can, since Monero has no central issuer and is far harder to trace.
- The designation carries FTO and SDGT status, with secondary-sanctions risk under Executive Order 13224 as amended by Executive Order 13886.
What Happened?
OFAC’s Recent Actions notice updated the standing ISIL Khorasan sanctions entry, dated July 1, 2026. ISIL Khorasan is the formal designation name for ISIS-K, the Afghanistan-based affiliate of the Islamic State.
The entity is designated under [FTO] [SDGT], carrying secondary-sanctions risk under section 1(b) of Executive Order 13224, as amended by Executive Order 13886. FTO stands for Foreign Terrorist Organization and SDGT for Specially Designated Global Terrorist, OFAC’s two toughest counterterrorism tiers.
The update attached a fresh batch of on-chain identifiers to an existing designation rather than naming a new entity. Chainalysis, the blockchain-analytics firm whose data underpins much of the crypto market data used for sanctions screening industry-wide, confirmed OFAC listed 134 crypto wallet identifiers in total, 131 TRON (TRX) addresses and three Monero (XMR) addresses.
Tether Freezes USDT in All 131 ISIS-K-Linked TRON Wallets
— Wu Blockchain (@WuBlockchain) July 2, 2026
OFAC updated its sanctions list for ISIS-K, adding 134 crypto wallet identifiers, including 131 TRON addresses and three Monero addresses. Chainalysis said the TRON addresses had received more than USD 1.4 million since… pic.twitter.com/53AgCBUGKr
OFAC’s own listing shows the addresses under “Digital Currency Address – TRX” and “Digital Currency Address – XMR” identifiers, the standard format Treasury uses to attach blockchain addresses to a designated entity. Tether moved fast on the TRON side. Tether froze the balances on all 131 TRON addresses named in the update, using the centralized freeze function built into USDT’s TRC-20 smart contract.
The three Monero addresses got no equivalent response, because none is possible. As a privacy coin with no central issuer, the Monero addresses cannot be frozen the way USDT on TRON can, and tracing them is far harder.
The Flows Behind the Freeze
The dollar amounts involved are modest by crypto-enforcement standards. The 131 TRON addresses had received more than $1.4 million and sent over $880,000 since 2023, cumulative flows tracked across roughly two and a half years, not a single frozen balance. Several of the designated wallets showed heavy exposure to mainstream services and also sent funds to Syria-based crypto exchangers, a routing pattern consistent with informal value-transfer networks operating across sanctioned and conflict-adjacent jurisdictions.
The modest size is the point. Terror-financing typologies rarely move eight-figure sums through a single rail; they move small amounts across many addresses and hops, which is why a 131-address, multi-year designation reads as methodical mapping rather than a single seizure.
For virtual asset service providers, or VASPs, the update creates an immediate, mechanical obligation: the 134 new identifiers now sit on OFAC’s Specially Designated Nationals list and must enter every screening pipeline. A transaction that touched one of these wallets before July 1 carries different exposure than one after the listing date, given the secondary-sanctions risk attached to the designation.
Implications for Stablecoin Enforcement
The split outcome (131 addresses neutralized in hours, three left untouched) is the clearest public illustration yet of where sanctions enforcement actually bites in crypto and where it does not. USDT on TRON is fast, cheap, and widely used, but it is also centrally issued, which means Tether can act as a chokepoint the moment Treasury publishes an address list.
Monero was built specifically to remove that chokepoint: no issuer, no freeze function, transaction details obscured by design. The same designation that fully disabled one payment rail could not touch the other at all.
That asymmetry cuts two ways. It hands compliance teams evidence that centralized-issuer stablecoins are enforceable in practice, not just in policy – a point Tether has leaned on before to argue it cooperates with law enforcement. It also hands critics of centralized stablecoins a counterargument: the same freeze capability that stops a terror-financing network today can freeze any wallet tomorrow, on whatever grounds a government invokes.
CoinLaw’s Takeaway
This freeze is best read as evidence of what stablecoin-level sanctions enforcement can and cannot do, not as evidence that crypto is somehow harder to police than cash. Tether’s same-day response to 131 addresses shows the chokepoint model works exactly as designed when the issuer controls the ledger. The three Monero addresses that OFAC listed but nobody can freeze show the model’s hard boundary. Enforcement against privacy-preserving assets currently depends entirely on disrupting the off-ramps and counterparties around them, not the assets themselves.
The more durable signal for compliance teams is the screening obligation, not the freeze. Every VASP with TRON or Monero exposure now needs these 134 identifiers in its sanctions-screening pipeline, and the Syria-exchanger routing Chainalysis flagged suggests OFAC and its data partners are actively mapping adjacent infrastructure, not just the addresses named in this update. Expect follow-on designations that widen the net around whatever moved funds toward or through this cluster of wallets.
