How to Check if a Crypto Wallet Address Is Sanctioned (OFAC SDN)

What "OFAC sanctioned" means for a wallet address

The Office of Foreign Assets Control (OFAC), a bureau of the U.S. Department of the Treasury, administers and enforces U.S. economic and trade sanctions programs. Its flagship tool is the Specially Designated Nationals and Blocked Persons List (SDN List) — individuals, companies, vessels, aircraft, and other entities whose property and interests in property located in the U.S. or held by U.S. persons must be blocked, and with whom U.S. persons are generally prohibited from dealing.

Since 2018, OFAC has periodically added specific digital currency addresses to the "remarks" field of individual SDN entries, most often for entities involved in ransomware operations, sanctions evasion, darknet markets, or state-linked cyber activity (for example, addresses tied to designated mixers, exchanges, or individuals). A wallet address appearing there means OFAC has publicly attributed control of that specific address to a designated person or entity — it is a narrower, more specific claim than "this exchange has flagged the address."

Being listed carries real legal consequences for U.S. persons: transacting with a listed address (knowingly or not, depending on program-specific strict-liability rules) can expose a person or business to civil or criminal sanctions-violation liability. This is why exchanges, wallet providers, and DeFi front-ends increasingly screen deposit and withdrawal addresses against the SDN list before processing a transaction.

The official places OFAC publishes this data

Before trusting any third-party tool — including ours — it helps to know where the data actually originates, because every checker is a reflection of one of these sources:

• OFAC Sanctions List Search (sanctionssearch.ofac.treas.gov) — the authoritative interactive web search across the SDN List and OFAC's other sanctions lists. Built for one-off human lookups by name; it does not have a dedicated "paste a wallet address" field, but a raw address string can be searched as free text and will surface a hit if OFAC has published that exact string.
• Sanctions List Service (sanctionslistservice.ofac.treas.gov) — where OFAC publishes the machine-readable exports: SDN.XML, SDN.CSV, ADD.CSV (addresses), ALT.CSV (aliases), and — importantly for digital-currency identifiers that run long — SDN_COMMENTS.CSV, which continues remarks text that overflows the 1,000-character field in SDN.CSV. A checker built only from SDN.CSV without joining SDN_COMMENTS.CSV can silently miss addresses buried in a continuation record. This service also exposes a "changes" feed documenting what was added, removed, or modified between publications (see our companion guide on tracking list changes).
• OFAC's Recent Actions page (ofac.treasury.gov/recent-actions) — human-readable press-release-style notices announcing new designations, often the fastest way to learn why an address was added, in plain English, the same day it happens.
• Consolidated Screening List (trade.gov/consolidated-screening-list) — a separate, multi-agency list (run by the International Trade Administration) that bundles OFAC's SDN and Non-SDN lists with export-control lists from the Commerce and State Departments. Useful if your compliance obligation extends beyond OFAC alone.

Any legitimate checker — free or paid, ours or a competitor's — is downstream of one or more of these same official sources. The question worth asking of any tool is: which file does it read, how often is it refreshed, and does it join the comments/continuation records so long digital-currency identifiers aren't truncated?

Step-by-step: checking one address

1. Copy the exact address string from its source (a deposit request, an on-chain explorer, an invoice) — do not retype it by hand, since a single mistyped character will produce a false "no match" for a genuinely listed address, or vice versa.
2. Search it verbatim against OFAC's own Sanctions List Search tool, or a checker that reads directly from SDN.XML/SDN.CSV+SDN_COMMENTS.CSV. Address matching should be exact-string, not fuzzy — unlike name matching, there is no legitimate "close enough" for a wallet address.
3. If you get a hit, note the associated SDN entry name, program tag (e.g. a specific sanctions program), and publication/update date. Then verify that same hit independently on OFAC's own site before acting on it.
4. If you get no hit, that only tells you the address isn't in OFAC's current published set — check the data's freshness (cache age), since OFAC can add addresses at any time and a checker running on a stale snapshot can miss same-day additions.
5. Document the check — timestamp, source used, and result — if this is for compliance purposes. Screenshots or exported JSON responses (see the API section below) make an auditable record.

Which blockchains and address formats are covered

OFAC's digital-currency remarks cover a range of chains, most commonly Bitcoin (BTC), Ethereum and other EVM chains (ETH-style hex addresses are also reused across many EVM-compatible networks), Tron (TRX), Litecoin (LTC), and Monero (XMR), among others OFAC has published over time. A few practical format notes:

• Bitcoin addresses can appear in legacy Base58 form (case-sensitive) or newer Bech32 bc1... form. Per BIP 173, Bech32 addresses are valid in all-lowercase or all-uppercase but not mixed case — a correctness-minded checker should normalize an all-uppercase or all-lowercase Bech32 string to the same match, while still treating mixed-case as a typo, not a match.
• An EVM-style 0x... address published against one chain (say, Ethereum) is technically the same 20-byte value reachable on any EVM-compatible chain, so OFAC's designation should be read as covering that address value broadly, not narrowly scoped to a single network.
• Case sensitivity matters: Base58 (legacy Bitcoin, many others) is fully case-sensitive; hex addresses are conventionally lowercase but are not case-sensitive at the protocol level in most chains (mixed-case "checksum" formatting is a display convention, not a different address).

Common pitfalls and false confidence

• Treating "no match" as a clean bill of health. It only reflects what OFAC has published as of that check. A wallet can be newly compromised, newly associated with a designated party, or simply not yet identified.
• Only checking the SDN list. The separate OFAC Non-SDN Consolidated List, and non-U.S. lists (EU, UK OFSI, UN), are not covered by an SDN-only checker.
• Relying on a stale export. OFAC updates the SDN list on its own schedule, sometimes multiple times a week. A checker built on a snapshot refreshed only occasionally can miss designations from the last few hours or days — always check the data's "as of" or cache-age indicator.
• Dropping the comments/continuation file. As above, digital-currency identifiers that run long are continued in SDN_COMMENTS.CSV; a checker built only from the base SDN.CSV export can under-report real addresses.
• Confusing this with investment or legal advice. A sanctions hit (or non-hit) is a compliance data point, not a determination of guilt, innocence, or legality of a specific transaction — that requires a qualified sanctions attorney and, where relevant, an OFAC license.

Try it: a free live checker

Screen your own wallet list offline

Do it via API (x402 / MCP / RapidAPI)

For programmatic, automated, or agent-driven screening beyond the free tool's daily cap, the same underlying lookup is available as a pay-per-call API — no account or subscription required:

x402 (pay-per-call, USDC on Base)

curl -X POST https://draconic21-x402-api.onrender.com/v1/sanctions_screen \
  -H "content-type: application/json" \
  -d '{"wallet":"bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh"}'
# unpaid: HTTP 402 + PAYMENT-REQUIRED header (sign with a Base USDC wallet, retry)

$0.006/call. See /v1/sanctions_screen/availability and /v1/sanctions_screen/example for the exact request/response shape before paying.

MCP (any MCP-enabled agent)

Add this origin's MCP server (see /.well-known/mcp.json) and call the sanctions_screen tool with a wallet and/or name argument — no separate account, billed the same as the x402 route.

RapidAPI (billed by card)

A RapidAPI Hub mirror of the same endpoint is available at /rapid/v1/openapi.json for teams that prefer card billing over a crypto wallet.

Change tracking

If you need to know when the list changed rather than re-checking one address repeatedly, POST /v1/sanctions_delta ($0.008) returns SDN entries added, removed, or modified over a date range, derived from OFAC's own change-tracking feed — see the free preview at /tools/ofac-changes.html.

FAQ

Is there one official place to check if a wallet address is sanctioned?

Yes — OFAC's own Sanctions List Search tool, and the raw data files at sanctionslistservice.ofac.treas.gov. Any third-party checker is only as good as how faithfully and how freshly it reflects that same source.

Does a "no match" mean the wallet is definitely clean?

It means the exact address wasn't found in the data as of the last refresh — not a guarantee about the wallet's owner, and not a check of other sanctions lists (EU, UK, UN) or OFAC's separate Non-SDN Consolidated List.

What should I do if I get a match?

Verify it independently on OFAC's own site, note the associated entity and program, and consult a qualified sanctions-compliance professional before acting — this is informational tooling, not legal advice.

Related

Guide: Tracking OFAC sanctions list changes → Free tool: OFAC Sanctions Check → Free download: OFAC crypto address CSV → Free tool: OFAC changes (last 30 days) →