Designation Date: 1 July 2026
Issuing Authority: Office of Foreign Assets Control (OFAC), U.S. Department of the Treasury
Legal Basis: Executive Order 13224, as amended (counterterrorism sanctions authority)
Overview
On 1 July 2026, OFAC updated its designation of ISIL Khorasan (ISIS-K), the Islamic State's Afghan and Pakistani affiliate, adding 134 cryptocurrency wallet addresses as identifiers: 131 on TRON and 3 on Monero.
ISIS-K was already a sanctioned organisation, so this is not breaking news, but the on-chain infrastructure is now named. For compliance teams, that distinction matters: the obligation to screen against these addresses took effect the moment they were published to the SDN List.
Tether responded by freezing the balances on all 131 TRON addresses, an issuer-level action that removed the group's access to those funds immediately, without waiting for any exchange or intermediary to act.
On the designation, NOMINIS founder Snir Levi shared, "Publishing wallet addresses to the SDN List changes the game for compliance teams, but only if screening keeps pace. An address added on Wednesday must be blocked on Wednesday, not at the next quarterly list refresh. At NOMINIS we see the gap between designation and detection exploited constantly. That gap is where terrorist financing survives."
About ISIS-K and its Use of Crypto
ISIS-K is a regional branch of Islamic State active across Afghanistan, Pakistan, and several Central Asian states, and has carried out attacks on civilians in multiple countries including Afghanistan, Pakistan, and Russia. ISIS-K was first identified as a Specially Designated Terrorist Group in September 2015.
The group's media branch, al-Azaim Media Foundation, publishes the propaganda outlet Voice of Khorasan and has historically solicited crypto donations through websites and messaging platforms, with historical donation addresses collected on TRON, Monero, and Bitcoin. As with earlier public terrorist financing campaigns, individual donations were typically small, reflecting supporters' modest means rather than a few large transfers.
Observed financial behaviour across the network includes:
- Small-value donation campaigns solicited through propaganda channels and messaging platforms
- Use of TRON-based stablecoins as the primary settlement rail, with Monero as a privacy layer
- Movement of funds through mainstream services alongside regional exchangers
- Transfers to Syria-based crypto exchangers connecting the on-chain network to the same regional cash-out infrastructure named in OFAC's 22 June ISIS action
Crypto here functions as one method within a broader facilitation framework, rather than as a standalone system.
Designated Identifiers
The update adds the following identifiers to the existing ISIS-K designation:
- 131 TRON (TRX) addresses, controlled by the group. These wallets have received more than $1.4 million since 2023 and sent more than $880,000, with heavy exposure to mainstream services. Several also sent funds to Syria-based crypto exchangers.
- 3 Monero (XMR) addresses, reflecting the group's use of privacy coins alongside transparent chains.
Recognising the Full Network
Most of the value never stopped at the named wallets. Around 80 to 90 per cent of the funds leaving the sanctioned addresses moved on into deposit addresses that were never designated. Those deposit addresses are where the money became spendable, and none of them appear on the SDN List. Screening only the 134 published identifiers misses the point where the network actually cashes out.
The following diagram demonstrates the heavy movement of funds over several hops to a deposit address of a well known exchange, which had accepted funds from numerous now sanctioned ISIL Khorasan wallets.
.png)
This is the gap most compliance programmes leave open - when funds arrive from an exchange, many firms treat the exchange as the counterparty and stop there, assuming anything from a regulated venue has already been checked. The wallet behind that deposit is never risk-assessed. That assumption is what lets designated funds re-enter the system one hop later under an exchange's name.
NOMINIS currently assesses the total of these sanctioned addresses to reach roughly $2 million, while the total in connected exposure sitting outside the published list dwarfs the current sanctioned amount as of July 1.
One particular counterparty stands out. Nominis assesses that a single OTC desk funded several of the designated wallets, alongside others that in Nominis's assessment meet the same criteria but have not yet been named. On-chain analysis links that desk to roughly $102,000 in flows, and to counterparties connected to earlier terrorist financing cases, with exposure pointing towards Turkey.
Critically, the fight against terror financing, including the sanctioning of wallets, cannot be effective without shutting down the OTC Desks who allow such movement of terror money to flow.
Taken together, the deposit layer, the OTC desk, and the consolidation wallets form one network rather than a set of isolated addresses. Nominis assesses this network to be larger than the 1 July action reflects.
Clients of NOMINIS will also be warned not to interact with other wallets that have been determined as involved in the terror network.
Compliance Obligations
All property and interests in property of ISIS-K that are in the United States, or in the possession or control of U.S. persons, are blocked and must be reported to OFAC.
Obligations include:
- Screening against the newly published wallet identifiers across all counterparty exposure, including indirect exposure through intermediary hops
- Blocking any property or interests in property linked to the designated addresses
- Reporting blocked holdings to OFAC
- Maintaining ongoing sanctions screening and transaction monitoring that updates as identifiers are added, not on a fixed refresh cycle
Unless authorised or exempt, OFAC's regulations generally prohibit all transactions by U.S. persons, or within or transiting the United States, involving blocked persons' property. Civil penalties may apply on a strict liability basis. Non-U.S. parties face secondary sanctions exposure: foreign financial institutions that facilitate transactions for these parties risk being cut off from the U.S. financial system.
The publication of wallet addresses removes the ambiguity that firms sometimes rely on. Once an address is on the SDN List, exposure to it is no longer a judgement call.
Official Designation Document
OFAC Recent Actions, 1 July 2026: https://ofac.treasury.gov/recent-actions/20260701
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at [email protected].
.jpg)