U.S. Treasury sanctioned SUEX in a first for cryptocurrency exchanges

The U.S. Treasury Department imposed sanctions on cryptocurrency exchange SUEX OTC, S.R.O. on September 21, 2021, marking the first time the department had designated a virtual-currency exchange under its sanctions authorities.

The Office of Foreign Assets Control added SUEX, also identified as Successful Exchange, to its Specially Designated Nationals and Blocked Persons List. Treasury said the exchange had facilitated financial transactions for ransomware actors and transactions involving illicit proceeds from at least eight ransomware variants.

Treasury further reported that more than 40% of SUEX’s known transaction history was associated with illicit actors. That percentage was an agency characterization of the transactions known to its investigation, not a measurement of every transaction conducted by SUEX or of the cryptocurrency market generally.

Sanctions reached an exchange-level intermediary

OFAC designated SUEX under Executive Order 13694, as amended, for providing material support to the threat posed by criminal ransomware actors. The action shifted the focus beyond individual hackers and wallet holders to an exchange-level intermediary that Treasury considered important to converting, moving or laundering criminal proceeds.

That distinction mattered because ransomware operations depended not only on collecting cryptocurrency but also on finding services willing or able to move it into more liquid or usable forms. Treasury described exchanges such as SUEX as financial nodes whose disruption could reduce the profitability of ransomware attacks.

The designation did not amount to a prohibition on cryptocurrency exchanges as a category. Treasury explicitly said most virtual-currency activity was lawful and distinguished between services exploited by criminals and services that facilitated illicit activity for their own gain. Nor did the action establish a sanctions connection to any particular ransomware-as-a-service operation or variant.

What the designation changed

Property and interests in property belonging to SUEX that were within U.S. jurisdiction became blocked on September 21, 2021. U.S. persons were generally prohibited from transacting with the company, while entities owned 50% or more by designated persons were also subject to blocking rules.

OFAC’s accompanying listing supplied identifying information for SUEX, including Czech registration details, reported addresses in Moscow and Prague, its website and digital-currency addresses associated with XBT, ETH and USDT. Publishing cryptocurrency addresses alongside a sanctions designation gave exchanges, custodians and compliance providers concrete identifiers to incorporate into transaction-screening systems. It did not establish that every person who had previously interacted with a listed address knew of or participated in illicit activity.

OFAC also issued an updated ransomware advisory on September 21. The advisory emphasized sanctions risks surrounding ransomware payments and said prompt reporting, cooperation with law enforcement and stronger cybersecurity practices could count as mitigating factors in a later enforcement assessment. The guidance therefore affected victims, insurers, incident-response companies and payment facilitators as well as cryptocurrency businesses.

Institutional significance

The SUEX action demonstrated how conventional sanctions law could be applied to a cryptocurrency intermediary without requiring a new asset-specific statute. It also made blockchain-address screening a more immediate operational concern for businesses exposed to U.S. jurisdiction.

The central evidence remained Treasury’s investigative findings. Treasury did not publish the underlying transaction-level dataset or define the complete population behind its “known transaction history” calculation, limiting independent verification of the reported 40% share.

Later context

On September 22, 2021, Chainalysis said its tools had assisted the investigation and described SUEX as a nested over-the-counter service using addresses hosted at larger exchanges. Chainalysis reported that SUEX had received more than $481 million in bitcoin from February 2018 through September 2021, valued when transfers occurred. That next-day analysis adds operational context but remains a company attribution based partly on proprietary address clustering rather than an independently reproducible public ledger dataset.