The US Department of the Treasury's Office of Foreign Assets Control (OFAC) included the digital currency addresses of two sanctioned individuals on its Specially Designated Nationals list, according to a November 28 announcement.
OFAC's Specially Designated Nationals list identifies "individuals and companies owned or controlled by, or acting for or on behalf of, targeted countries." These can include suspected terrorists or drug traffickers. Those placed on the list have their assets frozen – and US citizens are "generally prohibited from dealing with them."
Traditionally, OFAC has listed identifying information such as name, aliases, and place and date of birth. This is the first time OFAC has listed digital currency addresses for sanctioned individuals, which can be seen as a warning to let the public know not to send funds to these specific addresses.
Said Sigal Mandelker, the Treasury Under Secretary for Terrorism and Financial Intelligence:
"We are publishing digital currency addresses to identify illicit actors operating in the digital currency space. Treasury will aggressively pursue Iran and other rogue regimes attempting to exploit digital currencies and weaknesses in cyber and [Anti-Money Laundering/ Combating the Financing of Terrorism] (AML/CFT) safeguards to further their nefarious objectives."
The digital currency addresses listed belong to Ali Khorashadizadeh and Mohammad Ghorbaniyan for the role they allegedly played in helping exchange bitcoin into Iranian rial for hackers involved with the SamSam ransomware attack that affected "corporations, hospitals, universities, and government agencies and held over 200 known victims' data hostage for financial gain."
According to the press release, Khorashadizadeh and Ghorbaniyan were integral to the success of the SamSam ransomware plot, using the listed addresses "to process over 7,000 transactions, to interact with over 40 exchangers – including some US-based exchangers – and to send approximately 6,000 bitcoin worth millions of USD, some of which involved bitcoin derived from SamSam ransomware."
According to the Treasury Department, this is the fourth time this month in which the Iranian regime has been targeted by US sanctions; OFAC has sanctioned over "900 individuals, entities, aircraft, and vessels" connected to supporting terrorism in Iran.
"As Iran becomes increasingly isolated and desperate for access to US dollars, it is vital that virtual currency exchanges, peer-to-peer exchangers, and other providers of digital currency services harden their networks against these illicit schemes," stated Mandelker.
Although this is the first time OFAC has listed digital currency addresses, it is not the first time the public has been warned about conducting business with Iran. In October of this year, a division of the US Treasury dubbed the Financial Crimes Enforcement Network (FinCEN) released a document titled "Advisory on the Iranian Regime's Illicit and Malign Activities and Attempts to Exploit the Financial System," which intended to help business owners better understand the risks of doing business with Iran. It also outlined how to detect "potentially illicit transactions related to the Islamic Republic of Iran."