OFAC Sanctions 134 ISKP Crypto Addresses Tied to $2M in Terrorist Financing
On July 1, 2026, the U.S. Office of Foreign Assets Control added 134 cryptocurrency addresses to its Specially Designated Nationals list for the Islamic State Khorasan Province (ISKP), documenting over USD 2 million in on-chain flows. For compliance teams, accounting firms, and CFOs holding or processing digital assets, this action is a direct signal that OFAC's enforcement lens on crypto is widening in scope and granularity, and that existing screening workflows may need immediate review.
What OFAC Actually Designated
The July 1 action updated ISKP's existing SDN listing rather than creating a new entry. The 134 addresses represent years of accumulated on-chain activity, not a single transaction cluster. Collectively they have moved in excess of USD 2 million, with individual transfers ranging from roughly USD 10 at the low end to USD 15,000 at the high end. That range matters for compliance teams: it means ISKP's financiers deliberately kept many transactions small, likely to stay beneath automated threshold alerts.
The role of USDT and Monero
Despite ISKP publicly soliciting Monero donations through its Voice of Khurasan magazine since late 2023, on-chain data has continued to show heavy reliance on USDT. Stablecoins offer speed and liquidity that privacy coins currently cannot match for operational logistics, which is why the majority of the flagged addresses involve USDT flows rather than Monero. For teams managing stablecoin accounting and compliance, this is a concrete illustration of why stablecoin transaction monitoring cannot be treated as lower risk than native cryptocurrency.
Al-Azaim Foundation for Media as the fundraising engine
At the center of ISKP's crypto operations sits al-Azaim Foundation for Media, the group's propaganda arm. It publishes Voice of Khurasan in multiple languages specifically to reach a global donor base, and the magazine has been used to broadcast wallet addresses for both USDT and Monero donations. The multilingual reach means donor activity is genuinely global, not confined to any single jurisdiction.
A Pattern of Prior OFAC Action Against ISKP Crypto
July 1, 2026 is not OFAC's first move against ISKP's cryptocurrency network. In July 2023, OFAC designated Maldivian national Ali Shafiu alongside a crypto address under his control. Shafiu held a role in ISIS-K's media office and was designated as the Maldivian representative to ISIS-K leadership in Afghanistan. On-chain analysis at the time showed links between the sanctioned address and other ISIS-K and ISIS media-unit wallets. The 2026 action builds directly on that earlier designation, adding 134 addresses to an SDN profile that now reflects the full documented scale of the network since 2022.
Enforcement Actions That Defined the Network
Several concrete enforcement events have punctuated the evolution of ISKP's crypto financing, and understanding them helps compliance teams calibrate risk models.
The Moscow theater attack, March 2024
Four Tajik nationals attacked a theater in Moscow in March 2024, killing over 125 people. Investigators were able to trace funds from the wallet that financed the attackers to a wallet identified as ISKP-controlled within hours of the attack. The speed of that tracing reflects the transparency of public blockchains: when investigators know what to look for, blockchain data can move at the same pace as the network itself. For compliance professionals, this is precisely why real-time transaction monitoring and rapid wallet-screening capabilities matter operationally, not just for regulatory box-ticking.
The Cologne arrest, June 2024
German authorities arrested an individual holding German, Polish, and Moroccan citizenship at Cologne/Bonn airport in June 2024. The arrest was linked in part to a transfer of nearly USD 1,700 in cryptocurrency to an address associated with ISKP. The individual had applied for a position at the UEFA European Football Championship, held in Germany that summer, during a period when ISKP was actively encouraging supporters to target major sporting events. A transfer of USD 1,700 would not trigger most manual review thresholds, which is exactly the point: structured small-value transfers can carry as much legal and reputational risk as large ones when the counterparty is a sanctioned entity.
Capture of Ozgur Altun, May/June 2025
A joint Pakistani and Turkish operation captured Ozgur Altun, also known as Abu Yasir al-Turki, near the Afghanistan-Pakistan border in mid-2025. Altun was the central figure behind ISKP's media and cryptocurrency operations. Reports indicated he was holding a significant amount of cryptocurrency at the time of capture. His wife, Ayse Altun, was separately accused of using cryptocurrency to fund ISIS families in locations including Syria. The arrest removed a key node, but ISKP's response was instructive: supporters circulated fresh operational-security guidance, and the fundraising infrastructure decentralized further across multiple subgroups rather than collapsing.
Istanbul arrest, 2023
Prior to the Altun capture, on-chain intelligence led to the arrest of a key ISKP financier in Istanbul. That action, combined with the Shafiu designation in the same year, represented a period of concentrated disruption. Yet the network survived both, which is the central compliance lesson: enforcement removes individuals, but a sufficiently decentralized crypto financing network can rebuild around them.
What This Means for Accounting Firms and CFOs
OFAC sanctions carry strict liability in the United States. A U.S. person or entity that processes a transaction involving a designated address can face civil penalties regardless of whether it knew the counterparty was sanctioned. The addition of 134 addresses to the SDN list is therefore a direct operational event, not just a news item.
Screening obligations and crypto accounting software
Any crypto accounting software or digital asset accounting software stack used by accounting firms or corporate treasury teams must be able to ingest SDN list updates promptly. The July 1 action adds 134 new data points to what your screening tools must check against. If your firm relies on periodic rather than real-time SDN updates, the window between OFAC publishing an action and your system reflecting it is a period of unmitigated exposure. Firms should confirm with their technology providers exactly how quickly SDN additions flow through to wallet-screening modules.
This is also a reason to revisit VASP due diligence and onboarding frameworks: if a counterparty VASP's own screening is delayed or inadequate, your firm may inherit exposure from transactions that passed through that VASP before the SDN update reached their systems.
Stablecoin-specific exposure
The USDT-heavy nature of ISKP's documented flows sits uncomfortably alongside the expanding role of stablecoins in institutional treasury operations. CFOs who have incorporated USDT or other stablecoins into payment or liquidity workflows need to ensure that those flows pass through the same SDN screening rigor applied to other digital assets. The assumption that stablecoin transactions are lower-risk from an AML perspective is not supportable given the evidence in this designation.
Teams working through the implications of stablecoin compliance more broadly will find additional context in our coverage of MiCA's squeeze on USDT and what stablecoin accounting teams must know.
Record-keeping and audit trail requirements
OFAC expects that firms can demonstrate, on request, that they screened counterparties against the SDN list at the time of a transaction. For digital asset transactions, that means your crypto bookkeeping software needs to capture not just wallet addresses and amounts but also a timestamped record of what screening was performed and against which version of the SDN list. If your current system does not generate that kind of audit trail automatically, the July 1 action is a prompt to close that gap before an examiner asks the question.
Geographic and counterparty risk recalibration
The ISKP network, as documented by OFAC and investigators, spans Afghanistan, Pakistan, Turkey, Germany, the Maldives, Syria, and Russia. That breadth means geographic risk filters alone are insufficient: a counterparty based in a low-risk jurisdiction can still be a node in a sanctioned network. Accounting firms advising clients with cross-border crypto exposures should be reviewing whether their risk models weight wallet-level screening appropriately relative to jurisdiction-level country risk.
Practical Steps for Compliance Teams
Several actions follow directly from the July 1 designation and the pattern of enforcement it reflects.
Immediate: verify SDN feed latency
Confirm how quickly your digital asset accounting software or crypto accounting software ingests OFAC SDN updates. The target should be same-day. If your provider cannot confirm that cadence, escalate it as a contract or procurement issue.
Short-term: audit stablecoin transaction screening
Pull a sample of USDT transactions processed in the past 90 days and verify that each one was screened against the SDN list at the point of processing. Document the results. This is both a compliance exercise and the basis for any future response to a regulatory inquiry.
Medium-term: update AML risk assessments
ISKP's shift toward decentralized subgroup fundraising, combined with the continued use of small-value USDT transfers and public Monero solicitation, represents an evolved threat model. Your firm's AML risk assessment should reflect the specific typologies documented in the July 1 action: small transaction values, stablecoin reliance, multilingual public solicitation, and operational-security adaptation after enforcement disruptions. Teams building or refreshing those frameworks will find structural guidance in our piece on VASP onboarding and AML due diligence frameworks.
Source: TRM Labs
Frequently Asked Questions
What did OFAC actually add to the ISKP SDN listing on July 1, 2026?
OFAC updated the existing ISKP Specially Designated Nationals entry by adding 134 cryptocurrency addresses. Those addresses have collectively moved over USD 2 million in documented on-chain transactions, with individual transfers ranging from roughly USD 10 to USD 15,000.
Why does the ISKP network rely on USDT if it publicly solicits Monero?
Monero offers enhanced privacy, but USDT provides the liquidity and speed that operational logistics require. Despite public Monero solicitation through Voice of Khurasan since late 2023, on-chain data shows USDT has remained the dominant transaction medium for ISKP financing, precisely because it is more practical for moving funds quickly across platforms.
Does OFAC's strict liability standard apply to crypto transactions involving these addresses?
Yes. U.S. persons and entities are prohibited from transacting with SDN-listed addresses. Strict liability means a civil penalty can apply even without knowledge that the counterparty was designated, which is why prompt SDN feed updates in any crypto accounting software or digital asset accounting software stack are operationally critical.
What typologies should compliance teams add to their AML models based on this action?
Key typologies to incorporate include: small-value structured transfers (USD 10 to USD 15,000) in USDT designed to stay beneath alert thresholds; public wallet solicitation through multilingual media channels; Monero donation requests as a supplementary privacy layer; and rapid network decentralization following enforcement disruptions, meaning individual arrests do not collapse the broader infrastructure.
Has this network been disrupted before, and did disruption work?
Partially. The 2023 Istanbul arrest, the 2023 OFAC designation of Ali Shafiu, and the 2025 capture of Ozgur Altun all removed key individuals. Each time, ISKP's fundraising adapted, decentralizing further across subgroups. Disruption has slowed the network and reduced key-person risk concentration, but it has not eliminated the infrastructure, which is why the July 1 designation adds 134 addresses built up since 2022.