Chainalysis Research and Analysis
Compliance teams, regulators, and investigators rely on blockchain analytics to uncover illicit activity and support enforcement actions, but every outcome depends on the quality of the underlying data. A single incorrect attribution can discredit related insights, derail investigations, and trigger wrongful customer terminations. Evaluating a provider requires scrutiny of the methodology, evidence, and safeguards behind every conclusion.
– Providers should explain whether common ownership is established deterministically or inferred probabilistically, and demonstrate how techniques adapt to distinct blockchain architectures.
– A label backed by law enforcement-seized data is fundamentally different from one based on an anonymous tip, and grouping logic should hold up even if a label is removed.
– Robust attribution requires differentiating between who interacts with an address and who ultimately controls it, particularly for exchange deposit addresses and nested custodial entities.
– Providers should be transparent about whether their methods have satisfied legal standards like Daubert and how they distinguish machine learning outputs from evidence-based conclusions.
– A reliable provider can walk you through exactly how any specific cluster was constructed and what evidence supports it.
Summary
- OFAC updated its ISIS Khorasan (ISIS-K) designation to include 134 cryptocurrency wallet addresses (131 on TRON and 3 on Monero).
- In a separate action, OFAC sanctioned individuals linked to the Latin American criminal organization Primeiro Comando da Capital (PCC), which moved illicit proceeds cross-border using crypto.
On July 1, 2026, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) updated its designation of ISIL Khorasan (ISIS-K) and added 134 cryptocurrency wallets as identifiers. ISIS-K is the Islamic State’s Pakistani and Afghan affiliate.
ISIS-K was first flagged as a Specially Designated Terrorist Group in September 2015. Today’s sanctions update includes 3 Monero (XMR) addresses and 131 TRON (TRX) addresses. Tether has frozen the balances on all 131 TRON addresses.
What is ISIS-K and what is their connection to crypto?
ISIS-K is a regional branch of Islamic State that is active throughout Afghanistan, Pakistan, and several former Soviet Union countries in Central Asia. The group has been responsible for numerous terror attacks targeting civilians in multiple countries, including Afghanistan, Pakistan, and Russia. Their media branch, al-Azaim Media Foundation, spreads propaganda through the publication Voice of Khorasan and has historically solicited crypto through donation campaigns on various websites and messaging platforms. Chainalysis has collected historical donation addresses on Tron, Monero, and Bitcoin.
Like many earlier public terrorist financing campaigns, donations to al-Azaim were historically smaller in size, reflecting individuals’ modest means but demonstrating their incentive to support the group.
On-chain analysis: ISIS-K’s TRON wallets
At the center of Wednesday’s sanctions are 131 TRX addresses controlled by the group. Those wallets have received over $1.4 million since 2023 and sent over $880,000. As shown in the Chainalysis Reactor graph below, the wallets have heavy exposure to mainstream services. Several of the designated wallets also sent funds to Syria-based crypto exchangers.
Past actions against ISIS
U.S. sanctions underscore how ISIS and its affiliates use cryptocurrency to fund their global operations.
In 2023, OFAC sanctioned Maldives-based ISIS-K operative Ali Shafiu; Chainalysis found that Shafiu’s TRON interacted with exchange deposit addresses that also had ties to Iranian exchanges. And just last month, OFAC sanctioned a network of Syrian money service businesses that served as a cash-out for ISIS financiers. Chainalysis’ investigation of the operative at the center of that action, Miloud Abderrahmane, shuttled money from mainstream exchanges to Middle Eastern donation campaigns.
Brazil syndicate separately targeted
In a separate action, OFAC designated two Brazilian nationals and four companies for their links to Primeiro Comando da Capital (PCC), a Latin American criminal group with operatives in the U.S. and São Paulo, its homebase. According to OFAC, the group’s drug traffickers laundered more than $30 million of illicit proceeds generated in the U.S, utilizing cryptocurrency to move funds back to Brazil.
This marks OFAC’s third action against PCC and its operatives, following the December 2021 designation of PCC as an organization and the March 2024 designation of Diego Macedo Gonçalves do Carmo for his role in laundering significant sums for the group.
Impact on cryptocurrency compliance
For global VASPs and financial institutions, these actions require immediate updates to sanctions screening and transaction monitoring protocols.
With Chainalysis’s solutions, organizations can monitor and detect exposure to these high-risk networks. We have labeled the relevant cryptocurrency addresses associated with today’s designations in our product suite to ensure our customers can proactively identify exposure and maintain global compliance standards.
FAQs
What was updated in the ISIS-K designation?
OFAC added 131 TRON wallet addresses and 3 Monero wallet addresses to the existing ISIS-K designation.
What is ISIS-K?
ISIS-K is a regional branch of Islamic State that operates in Central and South Asia. Their media branch Voice of Khorasan has historically solicited donations via crypto.
Who did OFAC designate in the PCC-related action?
OFAC designated two Brazilian nationals, Victor Henrique de Oliveira Shimada and Stella Stefanie Nunes Henrique de Oliveira, along with four companies: Victory Trading, Pixwave, and Wave (Brazil), and Avenidas Flutuantes (Portugal).
How did the PCC network use cryptocurrency?
According to OFAC, the network laundered more than $30 million in illicit proceeds generated in and around multiple U.S. cities, utilizing cryptocurrency to move funds back to Brazil on behalf of PCC.
What are the compliance requirements following these designations?
All U.S. persons must block property and interests in property of the designated individuals and entities. Because the designations carry secondary sanctions risks, foreign financial institutions that facilitate transactions for these parties risk being cut off from the U.S. financial system.