Closing the crypto sanctions coverage gap

Crypto sanctions screening is only as effective as the underlying identifiers it can see. Yet many compliance teams are working from datasets that capture only part of the picture.

Sanctions announcements and press releases often contain only a subset of the crypto addresses and other identifiers associated with a designation, while the fuller record sits within the underlying structured data. And the coverage challenge extends beyond OFAC: Israel’s NBCTF has emerged as a major source of designated cryptocurrency identifiers, meaning sanctions programmes focused primarily on traditional lists risk missing significant exposure.

Hoptrail’s Sanctions Actions, delivered through its Rabbit Hole counterparty intelligence platform, brings these fragmented sources together into a clear, concise and real-time view of crypto sanctions activity globally.

Source of truth

When an authority designates an entity, the accompanying announcement typically highlights only a subset of the associated identifiers. The full set — on-chain wallets, exchange accounts, and related infrastructure — lives in the raw structured data attached to the designation. OFAC press releases routinely list a handful of illustrative addresses, while the SDN List XML entry carries the full set of Digital Currency Address identifiers for the entity. The Lazarus, Tornado Cash, and Garantex designations are canonical examples where the SDN entry carries substantially more addresses than any accompanying release.

Any screening list built from press coverage will therefore be systematically incomplete.

OFAC is not the largest publisher

Significantly, the crypto sanctions landscape is getting broader: OFAC is not the only authority publishing crypto-related designations. The UK’s OFSI, the EU, Japan’s Ministry of Finance and South Korea’s MOFA are also identifying crypto addresses and accounts in sanctions actions, making multi-jurisdictional coverage increasingly important. 

NBCTF — Israel's National Bureau for Counter Terror Financing — is the single largest source of designated crypto identifiers globally, accounting for roughly 60% of the total. It is also disproportionately TRON- and USDT-focused, matching where much terror financing actually flows on-chain.

Aggregated across authorities, the leaderboard does not look the way most compliance frameworks assume. In The Rabbit Hole's current dataset:

NBCTF, Israel's National Bureau for Counter Terror Financing, operating under the Ministry of Defense, is the single largest source of designated crypto identifiers globally, accounting for roughly 60% of the total. It is also disproportionately TRON (USDT) focused, which matches where much terror financing actually flows on-chain.

Despite the volume, NBCTF is under-represented in most screening stacks. The reasons are technical rather than jurisdictional:

• No clean XML feed. Where OFAC publishes structured SDN data with dedicated Digital Currency Address fields, NBCTF publishes designation orders as PDFs, sometimes with separate .xlsx appendices.
• Bilingual publication. Orders appear in Hebrew and English, and the two versions are not always identical in structure.
• Anti-scraping countermeasures. NBCTF appendix data embeds zero-width characters and cross-script homoglyphs that will silently corrupt any address copied without normalisation.
• Scanned rather than digital PDFs. Older orders are scans, meaning OCR sits in the middle of the pipeline and every extracted address needs verification against its own checksum before being written to the database.

The practical consequence is that most vendors either don't ingest NBCTF, ingest it partially, or ingest it with silent transcription errors.

How The Rabbit Hole closes the gaps

The Rabbit Hole is Hoptrail's counterparty intelligence platform. Its new Sanctions Actions feed is a searchable, structured record of every crypto-relevant designation event across the authorities that matter, built from raw sources and extracting real-time data.

Coverage

The feed currently indexes 116 designation events across 10 authorities, covering 404 designated entities and 2,693 distinct identifiers. It comprises over 1,800 unique on-chain wallets across 29 chains, plus more than 870 unique exchange account numbers on Binance and OKX. Five authorities (OFAC, NBCTF, OFSI, MoF Japan, and the EU) are pulled via automated daily feeds.

Every action carries jurisdiction and chain metadata, a written synopsis, named entities, primary and secondary sources, and, where applicable, a delisting date. Authority filters and coverage counts build dynamically from the underlying data, so newly added authorities and jurisdictions surface automatically rather than sitting behind a hardcoded list.

Depth

Identifier storage is per-entity, not per-address. The same on-chain address can be named in multiple designation events attached to different entities: an individual and a company they control, two individuals in the same network, an account holder and the organisation whose property they hold. Rabbit Hole stores one row per pair, preserving the full designation history rather than silently re-attributing the address between entities on each ingest run.

Where an order designates property as belonging to a specific organisation — Hamas, Hezbollah, IRGC, ISIS — the attribution reflects the organisation, not the individual account holder listed on the exchange record. Orders that split their tables between "property of a designated organisation" and "property used to perpetrate a terror crime" are stored with the distinction preserved, because the two categories have distinct legal meanings.

Furthermore, exchange account numbers are stored distinguishably from on-chain addresses, so downstream consumers cannot confuse the two identifier classes.

Verification standards

In some cases, a crypto address might visually look normal, but copying it directly could produce an invalid or mismatched address. In The Rabbit Hole, every hand-transcribed on-chain address is checksum-verified before it is written. Addresses read from scanned PDFs are proven by their own checksum rather than trusted on sight. Furthermore, each account number is read independently twice, with only agreed values are written. For more complex sources such as NBCTF, hidden and lookalike characters are detected and normalised before identifiers are stored.

What does this mean for compliance teams?

For institutions running crypto sanctions screening, coverage and data quality matter. Gaps can arise when designated identifiers are omitted from screening lists, authorities are not ingested, or source data contains errors. The Rabbit Hole's Sanctions Actions feed is built to remove those failure modes.

• Broad coverage. Ten authorities, 116 designation events and 2,693 distinct identifiers, including significant NBCTF coverage not present in OFAC-only datasets.
• Primary-source data. Identifiers are taken directly from designation documents rather than press releases or third-party lists.
• Verified identifiers. Addresses and account numbers are checked for accuracy, with hidden or misleading characters cleaned before use.
• Precise attribution. Each identifier retains its designation history and is attributed according to the legal text of the relevant order.
• Current. OFAC, NBCTF, OFSI, Japan's Ministry of Finance and the EU are monitored through automated daily feeds.
• Structured for screening. On-chain addresses and exchange account numbers are stored separately, with jurisdiction, chain and category metadata for downstream use.

The result is a sanctions dataset that can support an actual screening decision: comprehensive, clean, and current.