Audit log

Every state-changing event for ISIS-K Crypto Funding Network (OFAC July 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-07-30 12:15:07Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   8jkcaPNPYpnT…UG8tDWCicopysha256 → base58

   verifying row…

   canonical bytes (22185 B) ▸

   {"actor":"system:backfill","investigation_id":"56f08ded-f5be-4f65-a016-2885cdff9393","kind":"publish","page_slug":"isis-k-crypto-funding-network-ofac-july-2026","published_at":"2026-07-30T12:15:07.101Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"ISIS-K Crypto Funding Network (OFAC July 2026)","sections":[{"content":"On July 1, 2026, OFAC expanded its existing ISIS-Khorasan Province (ISKP) SDN entry by appending 134 cryptocurrency identifiers: 131 TRON (TRX) network addresses and 3 Monero (XMR) addresses. This action is described by blockchain analytics firms as the largest single-day terrorist crypto designation of 2026. U.S. persons and entities are prohibited from transacting with any of the designated addresses, and non-U.S. persons face secondary sanctions risk. A separate June 22, 2026 Treasury action targeted ISIS facilitators globally including a Syria-based Bitcoin exchange operator, with Secretary Scott Bessent stating: 'ISIS continues to seek new methods and tools to finance terrorist attacks. The United States will leverage every tool at its disposal to crush ISIS's remaining capabilities and protect American lives.'","heading":"OFAC Designation — July 1, 2026","severity":"critical","sources":[{"credibility":2,"name":"Chainalysis: OFAC Sanctions 100+ ISIS-K Crypto Addresses","type":"research","url":"https://www.chainalysis.com/blog/isis-designation-crypto-addresses-july-2026/"},{"credibility":1,"name":"CoinDesk: US Treasury sanctions over 100 ISIS-K crypto addresses","type":"news_article","url":"https://www.coindesk.com/policy/2026/07/02/us-treasury-sanctions-over-100-isis-k-crypto-addresses-in-latest-enforcement-action"},{"credibility":2,"name":"TRM Labs: OFAC Sanctions 134 ISKP Cryptocurrency Addresses","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-sanctions-134-iskp-cryptocurrency-addresses-tied-to-usd-2-million-in-terrorist-financing"},{"credibility":1,"name":"U.S. Treasury Press Release — ISIS Facilitators (June 22 2026)","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0537"}]},{"content":"Chainalysis and TRM Labs both conducted on-chain analysis of the designated addresses. According to Chainalysis, the 131 TRON wallets received over $1.4 million since 2023 and sent more than $880,000 during the same period. TRM Labs reported total flows across all 134 addresses exceeded $2 million. Individual transaction sizes were typically in the range of $10 to $15,000. The primary asset transacted was USDT (Tether USD) on the TRON network, which has been ISIS-K's dominant cryptocurrency for years due to its low fees and wide exchange support. In late 2023, ISIS-K's fundraising infrastructure began a documented shift toward Monero solicitation alongside its established TRON/USDT channel.","heading":"Transaction Volume and On-Chain Activity","severity":"critical","sources":[{"credibility":2,"name":"Chainalysis: OFAC Sanctions 100+ ISIS-K Crypto Addresses","type":"research","url":"https://www.chainalysis.com/blog/isis-designation-crypto-addresses-july-2026/"},{"credibility":2,"name":"TRM Labs: OFAC Sanctions 134 ISKP Cryptocurrency Addresses Tied to USD 2 Million","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-sanctions-134-iskp-cryptocurrency-addresses-tied-to-usd-2-million-in-terrorist-financing"},{"credibility":2,"name":"Blockonomi: Tether Freezes USDT in 131 ISIS-K-Linked TRON Wallets","type":"news_article","url":"https://blockonomi.com/tether-freezes-usdt-in-131-tron-wallets-as-u-s-sanctions-target-isis-k-crypto-network/"}]},{"content":"The cryptocurrency addresses are linked to the al-Azaim Media Foundation (also referred to as al-Azaim Foundation for Media, or AFM), the official media arm of ISIS-K. AFM publishes the multilingual propaganda magazine Voice of Khorasan (also transliterated as Voice of Khurasan), which is distributed via Telegram and other encrypted platforms. Beginning with issue 31, published on approximately December 22, 2023, AFM began openly soliciting Monero donations, citing the currency's privacy properties. Subsequent issues added Bitcoin solicitation alongside Monero. The publication addresses a global English-speaking audience as well as Russian- and Central Asian-language readerships. Donation addresses were printed directly in the magazine pages and cross-promoted on Telegram channels. OFAC's July 2026 action specifically targeted wallets linked to this solicitation infrastructure. Bitcoin addresses solicited through the same publication were notably not included in the July 1, 2026 designation.","heading":"Al-Azaim Media Foundation and Voice of Khorasan Solicitation Infrastructure","severity":"critical","sources":[{"credibility":2,"name":"MEMRI JTTM: Voice of Khurasan Continues to Solicit Crypto, Adds Bitcoin","type":"research","url":"https://www.memri.org/jttm/newest-issue-iskp-linked-english-magazine-voice-khurasan-continues-solicit-donations-0"},{"credibility":2,"name":"TRM Labs: OFAC Sanctions 134 ISKP Cryptocurrency Addresses","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-sanctions-134-iskp-cryptocurrency-addresses-tied-to-usd-2-million-in-terrorist-financing"},{"credibility":2,"name":"GNET Research: Soliciting Terror — ISKP Digital Communications and Financing via Voice of Khurasan","type":"research","url":"https://gnet-research.org/2024/12/12/soliciting-terror-iskp-digital-communications-and-financing-tactics-through-voice-of-khurasan/"},{"credibility":2,"name":"TFTC: OFAC Sanctions 134 ISIS-K Crypto Addresses, Tether Freezes All 131 Tron Wallets","type":"news_article","url":"https://www.tftc.io/ofac-isis-k-crypto-addresses-tether-freeze-tron-sdn"}]},{"content":"Within hours of the July 1, 2026 OFAC SDN update, Tether Limited froze all USDT balances held across the 131 designated TRON addresses. This freeze required no court intervention and occurred through Tether's administrative key, which allows the company to block token transfers at the smart-contract level. The action prevented any further outgoing USDT transfers from the frozen wallets. Tether has reported freezing over $4.4 billion in digital assets across its history of law enforcement cooperation, with approximately $2.1 billion attributable to U.S. agency requests across more than 2,300 investigations spanning 65 countries. The July 2026 ISIS-K freeze is documented as one of the largest single terrorist-financing freeze actions the company has conducted. Commentators have noted that this enforcement dynamic demonstrates TRON-based stablecoins function as permissioned infrastructure subject to real-time government-directed asset controls.","heading":"Tether Freeze — TRON Wallets","severity":"high","sources":[{"credibility":1,"name":"CoinDesk: US Treasury sanctions over 100 ISIS-K crypto addresses","type":"news_article","url":"https://www.coindesk.com/policy/2026/07/02/us-treasury-sanctions-over-100-isis-k-crypto-addresses-in-latest-enforcement-action"},{"credibility":2,"name":"Blockonomi: Tether Freezes USDT in 131 ISIS-K-Linked TRON Wallets","type":"news_article","url":"https://blockonomi.com/tether-freezes-usdt-in-131-tron-wallets-as-u-s-sanctions-target-isis-k-crypto-network/"},{"credibility":2,"name":"CryptoTimes: Tether Freezes 131 ISIS-K TRON Wallets Post US Sanctions","type":"news_article","url":"https://www.cryptotimes.io/2026/07/02/tether-freezes-131-isis-k-tron-wallets-post-us-sanctions/"}]},{"content":"Three of the 134 designated addresses use the Monero (XMR) network. Monero's protocol-level privacy design — including ring signatures, stealth addresses, and RingCT confidential transactions — means there is no central issuer or administrator capable of freezing balances. Sanctions against these addresses therefore cannot be enforced at the protocol level. Any exchange, OTC desk, or financial institution that unknowingly processes a transaction originating from or destined for one of the three designated Monero addresses remains in potential violation of OFAC regulations, with no real-time automated detection mechanism analogous to Tether's freeze capability. OFAC has not publicly disclosed technical enforcement measures specific to these Monero addresses beyond the SDN listing itself.","heading":"Monero Addresses — Ongoing Counterparty Exposure","severity":"high","sources":[{"credibility":2,"name":"TechTimes: Tether Froze 131 ISIS-K Wallets in Hours — Three Monero Addresses Remain Untouched","type":"news_article","url":"https://www.techtimes.com/articles/319593/20260703/tether-froze-131-isis-k-wallets-hours-three-monero-addresses-remain-untouched.htm"},{"credibility":2,"name":"TFTC: OFAC Sanctions 134 ISIS-K Crypto Addresses, Tether Freezes All 131 Tron Wallets","type":"news_article","url":"https://www.tftc.io/ofac-isis-k-crypto-addresses-tether-freeze-tron-sdn"},{"credibility":2,"name":"CryptDaily: Tether Freezes ISIS-K Tron Wallets — Stablecoin Compliance Just Got Very Real","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/tether-freezes-isis-k-tron-wallets"}]},{"content":"The July 2026 action is OFAC's second direct targeting of ISIS-K cryptocurrency infrastructure. In July 2023, OFAC designated Ali Shafiu, a Maldivian national serving in ISIS-K's media office, along with one TRON address (TVacWx7F5wgMgn49L5frDf9KLgdYy8nPHL) that received approximately $18,000 in USDT_TRX and showed on-chain links to other ISIS-K and ISIS media-unit wallets. In 2023, an ISIS-K financier was arrested in Istanbul. In May/June 2025, Ozgur Altun (known by the alias Abu Yasir al-Turki), identified as a key operator of ISIS-K's media and crypto operations, was apprehended near the Pakistan-Afghanistan border in a joint operation by Pakistan's ISI and Turkey's MIT intelligence service; he was reportedly carrying a significant amount of cryptocurrency at the time of capture. TRM Labs separately traced funds from a wallet that financed attackers in the March 2024 Moscow Crocus City Hall attack — which killed more than 125 people — to an ISIS-K-controlled address within hours of the attacks. TRM also identified that the broader ISKP fundraising network has decentralized further across multiple subgroups following successive disruptions, demonstrating operational resilience.","heading":"Historical Context — Prior Designations and Disruptions","severity":"high","sources":[{"credibility":2,"name":"Chainalysis: OFAC Sanctions ISIS Operative Ali Shafiu, Highlights Crypto Address","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-al-qaeda-isis-ali-shafiu/"},{"credibility":2,"name":"TRM Labs: OFAC Sanctions 134 ISKP Cryptocurrency Addresses","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-sanctions-134-iskp-cryptocurrency-addresses-tied-to-usd-2-million-in-terrorist-financing"},{"credibility":2,"name":"Jamestown Foundation: Ozgur Altun — Turkish Media Mastermind for IS-KP Arrested","type":"news_article","url":"https://jamestown.org/ozgur-altun-turkish-media-mastermind-for-is-kp-arrested/"},{"credibility":2,"name":"TRM Labs: In Wake of Moscow Attack — Understanding ISIS' Use of Cryptocurrencies","type":"research","url":"https://www.trmlabs.com/resources/blog/in-wake-of-moscow-attack-understanding-isis-use-of-cryptocurrencies"},{"credibility":2,"name":"Ukrainska Pravda: Media Outlets Find Crypto Wallet of ISIS Tajikistan Wing Used to Transfer Payment for Moscow Attack","type":"news_article","url":"https://www.pravda.com.ua/eng/news/2024/03/29/7448665/"}]},{"content":"Any cryptocurrency exchange, OTC desk, mining pool, DeFi protocol, or financial institution that processes transactions involving the 134 designated addresses is at risk of OFAC secondary sanctions violations. For the 131 TRON addresses, Tether's freeze effectively neutralizes USDT movement, but non-USDT assets on TRON and any pre-freeze balances that may have been dispersed remain a concern. The 3 Monero addresses present an ongoing unmitigated risk, as no protocol-level controls exist and transaction tracing is technically constrained. Chainalysis documented a broader network of addresses connected to the designated wallets; counterparties transacting with second- or third-degree cluster addresses may also carry exposure. The action underscores that TRON-based USDT functions as permissioned infrastructure subject to government-directed asset controls, a characteristic that differs materially from self-custodied Bitcoin or privacy coins.","heading":"Counterparty Risk for Exchanges and Service Providers","severity":"high","sources":[{"credibility":2,"name":"Chainalysis: OFAC Sanctions 100+ ISIS-K Crypto Addresses","type":"research","url":"https://www.chainalysis.com/blog/isis-designation-crypto-addresses-july-2026/"},{"credibility":2,"name":"CrowdFund Insider: Blockchain Analytics Firm Chainalysis Analyzes OFAC's Expansion of ISIS-K Crypto Sanctions","type":"news_article","url":"https://www.crowdfundinsider.com/2026/07/288998-blockchain-analytics-firm-chainalysis-analyzes-ofacs-expansion-of-isis-k-crypto-sanctions/"},{"credibility":2,"name":"CryptoSlate: Tether Freezes ISIS-K Wallets Proving That Stablecoins Now Sit Inside a Sanctions Machine","type":"news_article","url":"https://cryptoslate.com/tether-freezes-isis-k-wallets-proving-that-stablecoins-now-side-inside-a-sanctions-machine/"}]}],"sources_used":[{"credibility":2,"name":"Chainalysis: OFAC Sanctions 100+ ISIS-K Crypto Addresses","type":"research","url":"https://www.chainalysis.com/blog/isis-designation-crypto-addresses-july-2026/"},{"credibility":1,"name":"CoinDesk: US Treasury sanctions over 100 ISIS-K crypto addresses","type":"news_article","url":"https://www.coindesk.com/policy/2026/07/02/us-treasury-sanctions-over-100-isis-k-crypto-addresses-in-latest-enforcement-action"},{"credibility":2,"name":"TRM Labs: OFAC Sanctions 134 ISKP Cryptocurrency Addresses Tied to USD 2 Million","type":"research","url":"https://www.trmlabs.com/resources/blog/ofac-sanctions-134-iskp-cryptocurrency-addresses-tied-to-usd-2-million-in-terrorist-financing"},{"credibility":2,"name":"TFTC: OFAC Sanctions 134 ISIS-K Crypto Addresses, Tether Freezes All 131 Tron Wallets","type":"news_article","url":"https://www.tftc.io/ofac-isis-k-crypto-addresses-tether-freeze-tron-sdn"},{"credibility":2,"name":"Blockonomi: Tether Freezes USDT in 131 ISIS-K-Linked TRON Wallets","type":"news_article","url":"https://blockonomi.com/tether-freezes-usdt-in-131-tron-wallets-as-u-s-sanctions-target-isis-k-crypto-network/"},{"credibility":2,"name":"CryptoTimes: Tether Freezes 131 ISIS-K TRON Wallets Post US Sanctions","type":"news_article","url":"https://www.cryptotimes.io/2026/07/02/tether-freezes-131-isis-k-tron-wallets-post-us-sanctions/"},{"credibility":2,"name":"CryptDaily: Tether Freezes ISIS-K Tron Wallets — Stablecoin Compliance Just Got Very Real","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/tether-freezes-isis-k-tron-wallets"},{"credibility":2,"name":"TechTimes: Tether Froze 131 ISIS-K Wallets in Hours — Three Monero Addresses Remain Untouched","type":"news_article","url":"https://www.techtimes.com/articles/319593/20260703/tether-froze-131-isis-k-wallets-hours-three-monero-addresses-remain-untouched.htm"},{"credibility":2,"name":"MEMRI JTTM: Voice of Khurasan Continues to Solicit Crypto, Adds Bitcoin","type":"research","url":"https://www.memri.org/jttm/newest-issue-iskp-linked-english-magazine-voice-khurasan-continues-solicit-donations-0"},{"credibility":2,"name":"GNET Research: Soliciting Terror — ISKP Digital Communications and Financing via Voice of Khurasan","type":"research","url":"https://gnet-research.org/2024/12/12/soliciting-terror-iskp-digital-communications-and-financing-tactics-through-voice-of-khurasan/"},{"credibility":2,"name":"Chainalysis: OFAC Sanctions ISIS Operative Ali Shafiu — Highlights Crypto Address","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-al-qaeda-isis-ali-shafiu/"},{"credibility":2,"name":"Jamestown Foundation: Ozgur Altun — Turkish Media Mastermind for IS-KP Arrested","type":"news_article","url":"https://jamestown.org/ozgur-altun-turkish-media-mastermind-for-is-kp-arrested/"},{"credibility":2,"name":"SSPC: Ozgur Altun Turkish Media Mastermind for ISKP Arrested in Pakistan","type":"news_article","url":"https://www.sspconline.org/counter-terrorism-perspectives/ozgur-altun-turkish-media-mastermind-iskp-arrested-pakistan"},{"credibility":2,"name":"TRM Labs: In Wake of Moscow Attack — Understanding ISIS' Use of Cryptocurrencies","type":"research","url":"https://www.trmlabs.com/resources/blog/in-wake-of-moscow-attack-understanding-isis-use-of-cryptocurrencies"},{"credibility":2,"name":"Ukrainska Pravda: Crypto Wallet of ISIS Tajikistan Wing Used to Transfer Payment for Moscow Attack","type":"news_article","url":"https://www.pravda.com.ua/eng/news/2024/03/29/7448665/"},{"credibility":2,"name":"CrowdFund Insider: Chainalysis Analyzes OFAC's Expansion of ISIS-K Crypto Sanctions","type":"news_article","url":"https://www.crowdfundinsider.com/2026/07/288998-blockchain-analytics-firm-chainalysis-analyzes-ofacs-expansion-of-isis-k-crypto-sanctions/"},{"credibility":2,"name":"CryptoSlate: Tether Freezes ISIS-K Wallets Proving That Stablecoins Now Sit Inside a Sanctions Machine","type":"news_article","url":"https://cryptoslate.com/tether-freezes-isis-k-wallets-proving-that-stablecoins-now-side-inside-a-sanctions-machine/"},{"credibility":1,"name":"U.S. Department of the Treasury Press Release: Treasury Targets ISIS Facilitators (June 22 2026)","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0537"},{"credibility":2,"name":"BanklessTimes: Tether Freezes 131 ISIS-K TRON Wallets After OFAC Sanctions Update","type":"news_article","url":"https://www.banklesstimes.com/articles/2026/07/02/tether-blocks-131-isis%E2%80%91k-tron-wallets-in-sweeping-usdt-terror-crackdown/"}],"summary":"On July 1, 2026, the U.S. Treasury's Office of Foreign Assets Control (OFAC) added 134 cryptocurrency wallet addresses to its Specially Designated Nationals (SDN) list under the existing ISIS-Khorasan Province (ISIS-K) designation, representing the largest single terrorist crypto designation of 2026. The 131 TRON-based addresses and 3 Monero addresses collectively moved over $2 million and were used by ISIS-K's media arm, the al-Azaim Media Foundation, to solicit and channel cryptocurrency donations. Tether immediately froze all 131 TRON wallets; the 3 Monero addresses remain technically unfreezable due to the network's privacy architecture.","timeline":[{"date":"2022-01-01","event":"ISIS-K begins documented use of cryptocurrency — primarily Bitcoin, Ethereum, and TRON — to receive donations and move funds, with addresses controlled by the al-Azaim Foundation for Media identified by TRM Labs.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/ofac-sanctions-134-iskp-cryptocurrency-addresses-tied-to-usd-2-million-in-terrorist-financing"},{"date":"2023-07-31","event":"OFAC designates Ali Shafiu (Maldivian national, ISIS-K media office member) and one associated TRON address showing on-chain links to ISIS-K media-unit wallets, marking the first direct U.S. crypto-focused action against ISIS-K.","source":"Chainalysis","source_url":"https://www.chainalysis.com/blog/ofac-sanctions-al-qaeda-isis-ali-shafiu/"},{"date":"2023-12-22","event":"Voice of Khorasan issue 31 published; al-Azaim Media Foundation begins openly soliciting Monero donations, citing the currency's privacy features, alongside existing USDT/TRON solicitation.","source":"MEMRI JTTM","source_url":"https://www.memri.org/jttm/newest-issue-iskp-linked-english-magazine-voice-khurasan-continues-solicit-donations-0"},{"date":"2024-03-22","event":"Four Tajik nationals attack Crocus City Hall in Moscow, killing more than 125 people. TRM Labs traces cryptocurrency funds from the attackers' wallet to an ISIS-K-controlled address within hours of the attack.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/in-wake-of-moscow-attack-understanding-isis-use-of-cryptocurrencies"},{"date":"2025-06-01","event":"Ozgur Altun (alias Abu Yasir al-Turki), identified as ISIS-K's media and crypto operations director, is apprehended near the Pakistan-Afghanistan border in a joint Pakistan ISI and Turkish MIT intelligence operation. He is reportedly carrying significant cryptocurrency at the time of capture.","source":"Jamestown Foundation","source_url":"https://jamestown.org/ozgur-altun-turkish-media-mastermind-for-is-kp-arrested/"},{"date":"2025-07-08","event":"Ayse Altun, wife of Ozgur Altun, is detained in Pakistan and subsequently extradited to Turkey on allegations of using cryptocurrency to finance ISIS-linked families in Syria.","source":"SSPC / Jamestown Foundation","source_url":"https://www.sspconline.org/counter-terrorism-perspectives/ozgur-altun-turkish-media-mastermind-iskp-arrested-pakistan"},{"date":"2026-06-22","event":"U.S. Treasury issues a separate set of ISIS-related designations targeting global facilitators including a Syria-based Bitcoin exchange operator, with Secretary Bessent warning of continued enforcement.","source":"U.S. Department of the Treasury","source_url":"https://home.treasury.gov/news/press-releases/sb0537"},{"date":"2026-07-01","event":"OFAC adds 134 cryptocurrency addresses — 131 TRON and 3 Monero — to the existing ISIS-Khorasan Province SDN entry. This is described as the largest single terrorist crypto designation of 2026. Total flows across the addresses exceed $2 million.","source":"Chainalysis / CoinDesk","source_url":"https://www.coindesk.com/policy/2026/07/02/us-treasury-sanctions-over-100-isis-k-crypto-addresses-in-latest-enforcement-action"},{"date":"2026-07-01","event":"Within hours of the OFAC SDN update, Tether freezes all USDT balances in the 131 designated TRON addresses without court intervention. The 3 Monero addresses remain technically unfreezable.","source":"Blockonomi / CryptoTimes","source_url":"https://blockonomi.com/tether-freezes-usdt-in-131-tron-wallets-as-u-s-sanctions-target-isis-k-crypto-network/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 0264a77a-86d5-4c38-80de-055a12e9a9c7copy