Closing the crypto sanctions coverage gap: introducing Rabbit Hole's Sanctions Actions feed

Many compliance teams building crypto sanctions controls are working from an incomplete list. The incompleteness is not a matter of update frequency or vendor quality, it is structural. Often, sanctions press releases do not contain the full identifier set attached to a designation; much of the detail sits in the raw structured data behind the announcement. More to the point, OFAC is not the largest publisher of designated crypto identifiers. That title now belongs to Israel's NBCTF.

Hoptrail's Sanctions Actions feed, managed through its Rabbit Hole counterparty intelligence platform, closes both gaps — providing clear, concise and real-time sanctions information globally.

The press release is not the source of truth

When an authority designates an entity, the accompanying announcement typically highlights only a subset of the associated identifiers. The full set — on-chain wallets, exchange accounts, and related infrastructure — lives in the raw structured data attached to the designation. OFAC press releases routinely list a handful of illustrative addresses, while the SDN List XML entry carries the full set of Digital Currency Address identifiers for the entity. The Lazarus, Tornado Cash, and Garantex designations are canonical examples where the SDN entry carries substantially more addresses than any accompanying release.

Any screening list built from press coverage will therefore be systematically incomplete.

OFAC is not the largest publisher

Aggregated across authorities, the leaderboard does not look the way most compliance frameworks assume. In Rabbit Hole's current dataset:

NBCTF — Israel's National Bureau for Counter Terror Financing, operating under the Ministry of Defense — is the single largest source of designated crypto identifiers globally, accounting for roughly 60% of the total. It is also disproportionately TRON (USDT) focused, which matches where much terror financing actually flows on-chain.

Despite the volume, NBCTF is under-represented in most screening stacks. The reasons are technical rather than jurisdictional:

• No clean XML feed. Where OFAC publishes structured SDN data with dedicated Digital Currency Address fields, NBCTF publishes designation orders as PDFs, sometimes with separate .xlsx appendices.
• Bilingual publication. Orders appear in Hebrew and English, and the two versions are not always identical in structure.
• Anti-scraping countermeasures. NBCTF appendix data embeds zero-width characters and cross-script homoglyphs that will silently corrupt any address copied without normalisation.
• Scanned rather than digital PDFs. Older orders are scans, meaning OCR sits in the middle of the pipeline and every extracted address needs verification against its own checksum before being written to the database.

The practical consequence is that most vendors either don't ingest NBCTF, ingest it partially, or ingest it with silent transcription errors.

How Rabbit Hole closes the gaps

The Rabbit Hole is Hoptrail's counterparty intelligence platform. Its new Sanctions Actions feed is a searchable, structured record of every crypto-relevant designation event across the authorities that matter, built from raw sources and extracting real-time data.

Coverage

The feed currently indexes 116 designation events across 10 authorities, covering 404 designated entities and 2,693 distinct identifiers. It comprises over 1,820 unique on-chain wallets across 29 chains, plus more than 870 unique exchange account numbers on Binance and OKX. Five authorities (OFAC, NBCTF, OFSI, MoF Japan, and the EU) are pulled via automated daily feeds.

Every action carries jurisdiction and chain metadata, a written synopsis, named entities, primary and secondary sources, and — where applicable — a delisting date. Authority filters and coverage counts build dynamically from the underlying data, so newly added authorities and jurisdictions surface automatically rather than sitting behind a hardcoded list.

Depth

Identifier storage is per-entity, not per-address. The same on-chain address can be named in multiple designation events attached to different entities — an individual and a company they control, two individuals in the same network, an account holder and the organisation whose property they hold. Rabbit Hole stores one row per (identifier, entity) pair, preserving the full designation history rather than silently re-attributing the address between entities on each ingest run.

Attribution follows the legal text of the order. Where an order designates property as belonging to a specific organisation — Hamas, Hezbollah, IRGC, ISIS — the attribution reflects the organisation, not the individual account holder listed on the exchange record. Orders that split their tables between "property of a designated organisation" and "property used to perpetrate a terror crime" are stored with the distinction preserved, because the two categories have distinct legal meanings.

Listing dates reflect the date the authority actually designated the entity, not the date the pipeline first observed it. Historic designations — including Japan's 2022 Lazarus designation — carry their real dates, so downstream time-series analysis is not distorted by ingest timing.

Exchange account numbers are stored distinguishably from on-chain addresses, so downstream consumers cannot confuse the two identifier classes.

Verification standards

Every hand-transcribed on-chain address is checksum-verified (base58check and bech32) before it is written. Addresses read from scanned PDFs are proven by their own checksum rather than trusted on sight; where verification fails, the address is skipped and reported rather than guessed.

Exchange account numbers, which carry no checksum, are dual-transcribed. Each account number is read independently twice from a 300dpi-or-better render of the source page; only agreed values are written, and the ingest aborts rather than write on any mismatch.

NBCTF's zero-width character and homoglyph countermeasures are normalised out before extraction. Known false-positive traps in free-text ingestion — such as strings containing "TRON" as a substring of unrelated words, or personal names that happen to include the word "Wallet" — are correctly rejected.

Access

The collapsed feed — category, title, date, authority, jurisdiction, chain — is public and searchable, so the feed remains a complete index of every crypto sanctions action. The intelligence inside each action, including the identifier lists, sits behind commercial access. Gating is enforced server-side: withheld fields are never delivered to the client, rather than blurred in the UI.

Rabbit Hole's Sanctions Actions feed is available now at therabbithole.xyz. Institutions interested in commercial access to the underlying identifier data can request details via the platform.