How to Check if a Bitcoin Address Is Sanctioned

Pasting a Bitcoin address into a sanctions checker looks like a simple yes/no question: is this string on a list or not. For Bitcoin specifically, that framing hides most of the actual risk. Because of how Bitcoin addresses work, a "clean" result on a single address can still mean very little about the wallet behind it.

This guide covers what makes Bitcoin screening different from screening an Ethereum or Tron address, what OFAC actually lists, and what a proper check needs to cover.

A Bitcoin Address Is Not a Wallet

Ethereum and most account-based chains give each wallet one persistent address. Bitcoin does not work that way.

Bitcoin uses the UTXO (Unspent Transaction Output) model. A wallet doesn't hold a balance at a single address — it holds a collection of UTXOs scattered across many addresses, and modern wallet software generates a new receiving address for every incoming payment by default. Sending funds typically produces a change address too — a brand-new address, generated automatically, that receives whatever wasn't spent in the transaction.

The practical effect: a single person or entity can easily control hundreds of distinct Bitcoin addresses over the life of one wallet, and none of them need to repeat. Screening the one address a counterparty gave you tells you about that address. It doesn't necessarily tell you about every other address the same wallet controls.

What OFAC Actually Lists for Bitcoin

The OFAC SDN list contains over 520 Bitcoin addresses tagged as digital currency identifiers under specific sanctions programs (CYBER2, DPRK3, IRAN, and others). Each entry is an exact address string in one of Bitcoin's three formats:

There is no wildcard matching and no partial-address matching in an official designation — it's an exact string. This is precisely why direct-match screening, while necessary, catches a narrower slice of risk on Bitcoin than people assume: the designated address is one specific UTXO destination out of potentially hundreds controlled by the same actor.

Why a Single Clean Address Doesn't Mean a Clean Wallet

Blockchain analytics uses clustering heuristics to group addresses likely controlled by the same entity — most commonly the common-input-ownership heuristic: if multiple addresses are used as inputs to the same transaction, they were very likely signed by the same wallet, and therefore the same owner.

This is how a wallet with one directly-sanctioned address gets connected to dozens of others that never appear on any list individually. It's also exactly what CoinJoin-style transactions are designed to break: by mixing inputs and outputs from multiple unrelated participants into one transaction, the common-input-ownership heuristic stops reliably indicating shared ownership. That's the intended privacy effect — and it's also why CoinJoin participation is treated as a risk signal in compliance programs, independent of whether any address involved is directly listed.

The State of Bitcoin CoinJoin Services in 2026

For screening purposes, it's worth knowing the current landscape rather than an outdated one:

• Samourai Wallet (Whirlpool, Ricochet) was shut down by the US DOJ in April 2024; its founders were sentenced in November 2025 for operating an unlicensed money-transmitting business.
• Wasabi Wallet's operator, zkSNACKs, discontinued its official coordinator in June 2024, citing the regulatory climate. The Wasabi client still functions through independent community coordinators.
• Ashigaru, a fork of Samourai, relaunched Whirlpool-style CoinJoin coordination independently of the original service.
• JoinMarket continues to operate in a decentralized, peer-to-peer form; its original repository was archived in April 2026, with development continuing under community forks.

None of this makes CoinJoin participation illegal on its own — the enforcement actions targeted the operators of centralized coordination services, not the CoinJoin transaction type itself. But for a compliance program, a wallet with recent CoinJoin activity carries a materially different risk profile than one without, and that distinction only shows up if the screening tool looks for it.

How to Actually Check a Bitcoin Address

Layer 1 — Direct match. Check the address string against the OFAC SDN list, UK OFSI list, and EU-designated entities (screened by name, since the EU list does not currently contain crypto addresses — see our guide to EU crypto sanctions screening for that gap in detail).

Layer 2 — Cluster exposure. Check whether the address has transacted with a sanctioned address in its recent history, even without a direct hit — this is where most real exposure for Bitcoin specifically shows up, given how easily a single actor spans many addresses.

Layer 3 — CoinJoin / mixer exposure. Flag participation in known CoinJoin rounds or interaction with mixer-linked address clusters, and treat it as a documented risk factor requiring review rather than an automatic block.

Method 1: AML Radar (free)

The AML Radar Wallet Screener runs all three layers on any Bitcoin address in seconds: direct match against OFAC, EU, and UK lists, indirect exposure through transaction history, and known mixer/CoinJoin detection — returned as a single 0–100 risk score with a typology label, not just a clear/match flag.

Method 2: Manual OFAC lookup

OFAC's own search tool accepts a pasted address and checks it against the SDN list directly. It only covers OFAC, and it doesn't perform cluster or CoinJoin exposure analysis — useful for a one-off spot check, not for a repeatable compliance process.

Method 3: Raw XML for automated pipelines

For teams building their own screening into a transaction pipeline, OFAC publishes the SDN list as a machine-readable XML feed (sdn_advanced.xml), updated on a rolling basis whenever new designations are made. This is the same feed AML Radar syncs against every 6 hours.

Practical Checklist

• Screen the exact address string against OFAC, UK OFSI, and EU-designated entity names before processing any transaction
• Don't treat a single clean address as clearance for the whole counterparty wallet — check for cluster-level exposure to sanctioned addresses
• Flag CoinJoin or known-mixer interaction as a documented review item, not an automatic pass or automatic block
• Re-screen at transaction time, not only at onboarding — the SDN list updates continuously
• Log the address, the check result, the timestamp, and which list version was in effect for every screening decision

Conclusion

Bitcoin's address model means the question "is this address sanctioned" is necessary but incomplete on its own. A defensible screening process for BTC needs to account for how easily one wallet spans many addresses, and for the specific tools — CoinJoin chief among them — designed to obscure that link.

Try the AML Radar Wallet Screener on a Bitcoin address — direct match, cluster exposure, and CoinJoin detection in one check, free to start.

---

This article is for informational purposes only and does not constitute legal advice. Always consult a qualified compliance professional for guidance specific to your jurisdiction and business.