OFAC Identifies Bitcoin Addresses in Sanctions Record for First Time

The U.S. Treasury Department’s Office of Foreign Assets Control on November 28, 2018 designated two Iran-based bitcoin exchangers and, for the first time, published digital-currency addresses as identifiers attached to sanctioned individuals. The move turned two entries on Bitcoin’s public ledger into explicit sanctions-screening data for exchanges, custodians and payment processors subject to U.S. jurisdiction.

OFAC named Ali Khorashadizadeh and Mohammad Ghorbaniyan, saying they converted bitcoin ransom proceeds into Iranian rial for actors behind the SamSam ransomware campaign and deposited rial into Iranian banks. Treasury attached one Bitcoin address to each man in its Specially Designated Nationals record. That attribution—not a change to Bitcoin’s software or transaction rules—was the central development.

What the government record established

Treasury said the two addresses had processed more than 7,000 transactions since 2013, interacted with more than 40 exchangers, including some based in the United States, and sent approximately 6,000 bitcoin worth millions of U.S. dollars. Treasury was careful about scope: it said only that some of the bitcoin moving through the addresses was derived from SamSam. The release did not provide a transaction-by-transaction allocation, a valuation timestamp or a reproducible tracing method, so those aggregate figures should be treated as government findings rather than an independently recalculated on-chain total.

The designation was made under Executive Order 13694, as amended, which addressed malicious cyber-enabled activity. Its immediate legal effect was conventional even though the identifier was new: property and interests in property of the designated people within U.S. possession or control were blocked, and U.S. persons were generally prohibited from dealing with them.

OFAC had already said in guidance issued on March 19, 2018 that sanctions obligations were the same whether a transaction used digital currency or fiat currency, and that listed addresses would not necessarily be exhaustive. November 28 supplied the first concrete addresses to which that framework could be applied.

The related SamSam case

In a coordinated action, the Justice Department unsealed a six-count indictment against Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri. Prosecutors alleged that the two men created and deployed SamSam against more than 200 victims, including hospitals, municipalities and public institutions, beginning in December 2015.

The indictment alleged more than $6 million in ransom payments and more than $30 million in additional victim losses. Those amounts described the broader alleged hacking and extortion campaign; they were not measurements of the value passing through only the two OFAC-listed addresses. The charges were allegations on November 28, 2018, not findings of guilt. The Treasury designees and the two defendants were also different pairs of people: the former were alleged financial facilitators, while the latter were accused of operating the ransomware scheme.

Why the address listing mattered

The action joined sanctions law to a structured feature of a public blockchain. Compliance teams could screen the two published strings and investigate connections to them. At the same time, a Bitcoin address is not a complete legal identity, and OFAC’s own framework warned that published addresses might cover only part of a designated person’s activity.

That distinction mattered for the digital-asset market in 2018. The government was not blocking coins at the protocol layer, reversing transfers or declaring Bitcoin itself prohibited. It was applying existing sanctions duties to named people and identifiable transaction endpoints. The practical burden therefore fell on regulated intermediaries and other persons within OFAC’s reach, making address analytics and customer controls more consequential without changing Bitcoin’s decentralized settlement rules.