Audit log

Every state-changing event for ISIS-K Crypto Wallet Network (TRON/Monero SDN Designations): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-09-18 23:45:41Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 448,235,769

   sig

   2sPvjwVNfhnz…zQVMEHHfcopyexplorer ↗

   hash

   DzgHXjwvT3Te…DiX9bjSDcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (16781 B) ▸

   {"actor":"system:backfill","investigation_id":"36780c87-b603-4aa5-833b-e61759e9d661","kind":"publish","page_slug":"isis-k-crypto-wallet-network-tron-monero-sdn-designations","published_at":"2026-09-18T23:45:41.722Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"ISIS-K Crypto Wallet Network (TRON/Monero SDN Designations)","sections":[{"content":"OFAC updated its counter-terrorism designation of ISIL Khorasan (ISIS-K), the Islamic State's Afghanistan/Pakistan-based affiliate, to add 134 digital currency addresses as identifiers under the existing Executive Order 13224 (as amended by Executive Order 13886) designation. The addition comprised 131 TRON (TRX) addresses and 3 Monero (XMR) addresses. According to Chainalysis, the TRON-based wallets collectively received more than $1.4 million in inflows since 2023 and sent out more than $880,000 over the same period. Chainalysis also reported that the wallets showed 'heavy exposure to mainstream services' and that some addresses transferred funds onward to Syria-based cryptocurrency exchangers. Blockchain research firm NOMINIS separately estimated that 80–90% of funds leaving the sanctioned addresses moved into deposit addresses that were never themselves designated, which it characterized as a compliance gap in the broader network. This is a civil/regulatory sanctions designation, not a criminal conviction; the underlying allegations of terrorism financing have not been adjudicated in a U.S. court as of this writing.","heading":"July 1, 2026 OFAC Crypto Wallet Designation","severity":"critical","sources":[{"credibility":1,"name":"OFAC Recent Actions — Counter Narcotics Designations; Counter Terrorism Designations and Designation Update (July 1, 2026)","type":"regulatory","url":"https://ofac.treasury.gov/recent-actions/20260701"},{"credibility":1,"name":"US Treasury sanctions over 100 ISIS-K crypto addresses in latest enforcement action — CoinDesk","type":"news_article","url":"https://www.coindesk.com/policy/2026/07/02/us-treasury-sanctions-over-100-isis-k-crypto-addresses-in-latest-enforcement-action"},{"credibility":2,"name":"OFAC Sanctions 100+ ISIS-K Crypto Addresses — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/isis-designation-crypto-addresses-july-2026/"},{"credibility":2,"name":"OFAC Sanctions 134 ISIS-K Crypto Wallets: NOMINIS discusses the Full Network","type":"research","url":"https://www.nominis.io/insights/ofac-sanctions-134-isis-k-wallets-nominis-maps-the-wider-network"}]},{"content":"Following the OFAC designation, Tether froze the balances on all 131 TRON-based addresses named in the update, cutting off the group's access to funds held on that chain almost immediately after the sanctions list was published. This is possible because Tether, as the centralized issuer of USDT, can programmatically blacklist specific addresses at the smart-contract level. By contrast, the three Monero addresses in the designation cannot be frozen by any issuer or protocol-level authority: Monero uses ring signatures, stealth addresses, and confidential transaction amounts that obscure senders, receivers, and values, and there is no centralized party capable of blacklisting an address. Coverage of the action characterized this as illustrating a structural divergence in sanctions enforceability between transparent, stablecoin-heavy blockchains like TRON and privacy-preserving networks like Monero — TRON's low fees and deep stablecoin liquidity make it attractive for the underlying fundraising, but that same transparency and centralized-issuer structure make post-hoc enforcement far more effective than on Monero.","heading":"Tether's Freeze of TRON Wallets vs. Monero's Untouched Addresses","severity":"high","sources":[{"credibility":2,"name":"Tether Freezes 131 Tron Wallets Tied to ISIS-K After US Sanctions — Unchained","type":"news_article","url":"https://unchainedcrypto.com/tether-freezes-over-130-tron-wallets-tied-to-terror-group/"},{"credibility":2,"name":"OFAC Sanctions 134 ISIS-K Crypto Addresses, Tether Freezes All 131 Tron Wallets Instantly — TFTC","type":"news_article","url":"https://www.tftc.io/ofac-isis-k-crypto-addresses-tether-freeze-tron-sdn"},{"credibility":2,"name":"Tether freezes USDT in 131 ISIS-K-linked TRON wallets — crypto.news","type":"news_article","url":"https://crypto.news/tether-freezes-usdt-in-131-isis-k-linked-tron-wallets-chainalysis/"}]},{"content":"Reporting attributes the underlying fundraising activity to ISIS-K's propaganda arm, the al-Azaim Media Foundation, which publishes the periodical Voice of Khorasan and has solicited cryptocurrency donations through affiliated websites and messaging-platform channels across TRON, Monero, and Bitcoin. Coverage describes historical donation campaigns as featuring modest individual contributions, consistent with a low-value, high-volume small-donor fundraising model rather than large institutional transfers. These characterizations rely on Chainalysis's blockchain analysis and news reporting rather than a criminal indictment, and should be treated as allegations pending any further law-enforcement action.","heading":"Al-Azaim Media Foundation and Alleged Fundraising Method","severity":"high","sources":[{"credibility":2,"name":"OFAC Sanctions 100+ ISIS-K Crypto Addresses — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/isis-designation-crypto-addresses-july-2026/"},{"credibility":1,"name":"US Treasury sanctions over 100 ISIS-K crypto addresses in latest enforcement action — CoinDesk","type":"news_article","url":"https://www.coindesk.com/policy/2026/07/02/us-treasury-sanctions-over-100-isis-k-crypto-addresses-in-latest-enforcement-action"},{"credibility":3,"name":"Voice of Khorasan — Wikipedia","type":"other","url":"https://en.wikipedia.org/wiki/Voice_of_Khorasan"}]},{"content":"On June 22, 2026, OFAC designated three individuals and six entities under Executive Order 13224 (as amended) for allegedly facilitating financial transactions on behalf of ISIS across Europe, the Middle East, and West Africa. The individuals named were Miloud Abderrahmane (France), described by Treasury as having conducted transactions with ISIS affiliates in Syria and provided guidance on explosives to supporters; Abdelhakim Boukich, a Syria-based, formerly Dutch national who Treasury said established and controls Bitcoin Xchange, a money-services business; and Mohamad Alhmidan, previously designated by OFAC in March 2016. Treasury's press release states that OFAC identified TRON blockchain wallet addresses associated with Abderrahmane. The six designated entities were Bitcoin Xchange (Syria), Spider Gayrimenkul Ve Genel Ticaret Limited Sirketi and Alkaram Danismanlik Gayrimenkul Ic Ve Dis Genel Ticaret Limited Sirketi (both Türkiye-based money-services businesses), and three Nigeria-based bureaux de change — Nine to Nine Exchange Bureau de Change Limited, Manhattan Bureau de Change Limited, and Generation Currency Bureau de Change Limited — along with Nigeria-based individual Mukhtar Adamu Muhammad, identified as an ISIS-West Africa financial facilitator. Treasury stated the action was intended to disrupt the routing of funds among ISIS's regional affiliates.","heading":"June 22, 2026 Designation of ISIS Financial Facilitators","severity":"high","sources":[{"credibility":1,"name":"Treasury Targets ISIS Facilitators and Disrupts Terrorist Financial Networks — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0537"},{"credibility":1,"name":"Counter Terrorism Designations — OFAC Recent Actions (June 22, 2026)","type":"regulatory","url":"https://ofac.treasury.gov/recent-actions/20260622"},{"credibility":2,"name":"Treasury Sanctions Three Individuals and Six Entities for Routing Crypto to ISIS — The Defiant","type":"news_article","url":"https://thedefiant.io/news/regulation/treasury-sanctions-three-individuals-six-entities-routing-crypto-isis"},{"credibility":2,"name":"OFAC Sanctions ISIS Financial Facilitators — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-isis-financial-facilitators-june-2026/"}]},{"content":"OFAC's July 1, 2026 designation update lists specific TRON and Monero addresses as identifiers tied to the ISIL Khorasan SDN entry. A sample of these addresses was independently retrieved from OFAC's official recent-actions notice and cryptographically validated by this investigation: each of the ten sampled TRON addresses passed Base58Check checksum validation (a 25-byte payload with a valid double-SHA256 checksum and the TRON mainnet 0x41 prefix), and the sampled Monero address matches the expected 95-character, prefix-'4' format of a standard Monero mainnet public address. This validation indicates the addresses are well-formed, real blockchain addresses consistent with the official record, though this investigation could not independently confirm the complete list of all 131 TRON and all 3 Monero addresses named in the full designation — secondary sources report the aggregate counts (131 TRON, 3 Monero) without reproducing the full address list, and the authoritative source for the complete, current list remains OFAC's SDN list itself.","heading":"Identified Wallet Addresses","severity":"critical","sources":[{"credibility":1,"name":"OFAC Recent Actions — Counter Narcotics Designations; Counter Terrorism Designations and Designation Update (July 1, 2026)","type":"regulatory","url":"https://ofac.treasury.gov/recent-actions/20260701"},{"credibility":1,"name":"OFAC Sanctions List Search","type":"regulatory","url":"https://sanctionssearch.ofac.treas.gov/"}]},{"content":"Industry and regulatory commentary tied to this action frames TRON's continued appearance in terrorism-financing and sanctions-evasion cases as a function of its low transaction fees and deep stablecoin (primarily USDT) liquidity, which make it attractive for high-volume, low-value transfers of the kind described in the al-Azaim donation campaigns. Coverage of the same July 1, 2026 OFAC action set noted a separate, unrelated designation the same day targeting a Brazil-linked network associated with Primeiro Comando da Capital (PCC) that allegedly used cryptocurrency to move over $30 million in illicit proceeds, which commentators cited as further evidence of TRON/stablecoin rails being used across disparate categories of illicit finance. This section describes an industry pattern and framing rather than a specific finding against TRON the network or the TRON Foundation, which has not itself been named or sanctioned in either action.","heading":"Broader Pattern: TRON and Terrorism/Sanctions-Evasion Financing","severity":"medium","sources":[{"credibility":1,"name":"US Treasury sanctions over 100 ISIS-K crypto addresses in latest enforcement action — CoinDesk","type":"news_article","url":"https://www.coindesk.com/policy/2026/07/02/us-treasury-sanctions-over-100-isis-k-crypto-addresses-in-latest-enforcement-action"},{"credibility":2,"name":"OFAC Sanctions 134 ISIS-K Crypto Wallets: NOMINIS discusses the Full Network","type":"research","url":"https://www.nominis.io/insights/ofac-sanctions-134-isis-k-wallets-nominis-maps-the-wider-network"}]}],"sources_used":[{"credibility":1,"name":"OFAC Recent Actions — Counter Narcotics Designations; Counter Terrorism Designations and Designation Update (July 1, 2026)","type":"regulatory","url":"https://ofac.treasury.gov/recent-actions/20260701"},{"credibility":1,"name":"Counter Terrorism Designations — OFAC Recent Actions (June 22, 2026)","type":"regulatory","url":"https://ofac.treasury.gov/recent-actions/20260622"},{"credibility":1,"name":"Treasury Targets ISIS Facilitators and Disrupts Terrorist Financial Networks — U.S. Department of the Treasury","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sb0537"},{"credibility":1,"name":"OFAC Sanctions List Search","type":"regulatory","url":"https://sanctionssearch.ofac.treas.gov/"},{"credibility":1,"name":"US Treasury sanctions over 100 ISIS-K crypto addresses in latest enforcement action — CoinDesk","type":"news_article","url":"https://www.coindesk.com/policy/2026/07/02/us-treasury-sanctions-over-100-isis-k-crypto-addresses-in-latest-enforcement-action"},{"credibility":2,"name":"OFAC Sanctions 100+ ISIS-K Crypto Addresses — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/isis-designation-crypto-addresses-july-2026/"},{"credibility":2,"name":"OFAC Sanctions ISIS Financial Facilitators — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/ofac-sanctions-isis-financial-facilitators-june-2026/"},{"credibility":2,"name":"OFAC Sanctions 134 ISIS-K Crypto Wallets: NOMINIS discusses the Full Network","type":"research","url":"https://www.nominis.io/insights/ofac-sanctions-134-isis-k-wallets-nominis-maps-the-wider-network"},{"credibility":2,"name":"Tether Freezes 131 Tron Wallets Tied to ISIS-K After US Sanctions — Unchained","type":"news_article","url":"https://unchainedcrypto.com/tether-freezes-over-130-tron-wallets-tied-to-terror-group/"},{"credibility":2,"name":"OFAC Sanctions 134 ISIS-K Crypto Addresses, Tether Freezes All 131 Tron Wallets Instantly — TFTC","type":"news_article","url":"https://www.tftc.io/ofac-isis-k-crypto-addresses-tether-freeze-tron-sdn"},{"credibility":2,"name":"Tether freezes USDT in 131 ISIS-K-linked TRON wallets — crypto.news","type":"news_article","url":"https://crypto.news/tether-freezes-usdt-in-131-isis-k-linked-tron-wallets-chainalysis/"},{"credibility":2,"name":"Treasury Sanctions Three Individuals and Six Entities for Routing Crypto to ISIS — The Defiant","type":"news_article","url":"https://thedefiant.io/news/regulation/treasury-sanctions-three-individuals-six-entities-routing-crypto-isis"},{"credibility":3,"name":"Voice of Khorasan — Wikipedia","type":"other","url":"https://en.wikipedia.org/wiki/Voice_of_Khorasan"}],"summary":"On July 1, 2026, the U.S. Treasury's Office of Foreign Assets Control (OFAC) updated its Specially Designated Nationals (SDN) list entry for ISIS-Khorasan (ISIS-K) to add 134 cryptocurrency wallet addresses — 131 on TRON and 3 on Monero — used to solicit and move donations for the group's propaganda arm. Stablecoin issuer Tether froze the balances on all 131 TRON addresses within the sanctions window, while the three Monero addresses remain functionally beyond the reach of issuer-level freezing due to that network's privacy design. The action followed a June 22, 2026 OFAC designation of individuals and money-service businesses across Europe, the Middle East, and West Africa accused of facilitating ISIS financial transfers.","timeline":[{"date":"2023","event":"According to Chainalysis on-chain analysis, the 131 TRON addresses later designated by OFAC began receiving inflows, ultimately totaling more than $1.4 million by the time of designation.","source":"Chainalysis","source_url":"https://www.chainalysis.com/blog/isis-designation-crypto-addresses-july-2026/"},{"date":"2016-03","event":"Mohamad Alhmidan, later named again in the June 2026 action, was first designated by OFAC.","source":"Treasury Department press release","source_url":"https://home.treasury.gov/news/press-releases/sb0537"},{"date":"2026-06-22","date_evidence":"Date of Action: June 22, 2026","event":"OFAC designated three individuals (Miloud Abderrahmane, Abdelhakim Boukich, Mohamad Alhmidan) and six entities, plus Nigeria-based facilitator Mukhtar Adamu Muhammad, for allegedly routing funds to ISIS across Europe, the Middle East, and West Africa, including TRON wallet addresses tied to Abderrahmane.","source":"U.S. Department of the Treasury / OFAC","source_url":"https://home.treasury.gov/news/press-releases/sb0537"},{"date":"2026-07-01","date_evidence":"Release Date 07/01/2026","event":"OFAC updated the ISIL Khorasan (ISIS-K) SDN designation to add 134 cryptocurrency addresses (131 TRON, 3 Monero) as identifiers.","source":"OFAC Recent Actions","source_url":"https://ofac.treasury.gov/recent-actions/20260701"},{"date":"2026-07","date_original":"2026-07-01","event":"Tether froze the balances on all 131 designated TRON addresses shortly after the OFAC designation was published.","source":"Chainalysis / multiple news outlets","source_url":"https://unchainedcrypto.com/tether-freezes-over-130-tron-wallets-tied-to-terror-group/"},{"date":"2026-07","date_original":"2026-07-02","event":"Mainstream and crypto media (CoinDesk, Unchained, Chainalysis blog, others) reported on the designation and Tether's freeze action.","source":"CoinDesk","source_url":"https://www.coindesk.com/policy/2026/07/02/us-treasury-sanctions-over-100-isis-k-crypto-addresses-in-latest-enforcement-action"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9c0eaa85-965d-4006-ba5d-ca0aebcfd05ecopy