OAK — OnChain Attack Knowledge

Worked example · 2013-20

Illicit-Purpose and Designated-Entity Financing Cohort — 2013–2025

OAK Techniques observed
OAK-T7.009, OAK-T7.001, OAK-T7.002, OAK-T8.001
Attribution
unattributed (aggregate cohort of enforcement and designation actions by multiple actors).
Loss
No aggregate illicit-volume figure is sourced in this file (the earlier "tens of billions" estimate was unsourced). Individual designation actions and enforcement operations are the public-record artefacts; per-incident dollar figures are not systematically published due to the sensitive-law-enforcement-data constraint.
Corrected 2026-10-11
Silk Road seizure was ~144,000 BTC (not ~174,000); FATF travel-rule action was June 2019 (not October); SUEX was Czech-registered and Russia-linked; Tornado Cash address count and its March 2025 delisting noted; Binance penalties broken out.
Key teaching point
Illicit-purpose and designated-entity financing is the purpose-based detection layer of the OAK-T7 family: the laundering methods used (mixers, CEX layering, cross-chain bridges, privacy chains) are indistinguishable from other T7 Techniques, and the detection signal is entirely in the destination-address labelling maintained by blockchain-intelligence providers (Chainalysis, TRM Labs, Elliptic) and regulatory designation lists (OFAC SDN, EU, UN). T7.009 is therefore the technique that most cleanly illustrates the method-vs-purpose distinction in cryptocurrency compliance: a CEX screening a deposit from a mixer against its OFAC SDN and Chainalysis illicit-activity labelling feed is performing T7.009 detection at the purpose layer, even though the laundering method (mixer → CEX) is T7.001/T7.002 at the method layer. The compliance stack must operate at both layers simultaneously.

Summary

Timeline

When Event OAK ref
2013-10 Silk Road Bitcoin seizure: the FBI reported seizing about 144,000 BTC in connection with the Silk Road takedown ([wikisilkroadcohort]); the claim that this anchored the later OFAC address framework is OAK interpretation, not sourced T7.009 (designated-entity asset seizure precedent)
2018-11 OFAC SDN cryptocurrency designations begin: U.S. Treasury OFAC designated two Iran-based men, Ali Khorashadizadeh and Mohammad Ghorbaniyan, who converted SamSam ransom bitcoin into rials, and published two bitcoin addresses tied to them (2018-11-28). Commentators describe it as the first time OFAC included digital currency addresses in SDN listings ([wilmer2018]) — the regulatory framework that makes T7.009 screening enforceable at the CEX/VASP compliance layer T7.009
2019-06 FATF adopts an interpretive note to Recommendation 15 requiring originating VASPs to obtain, hold and send originator and beneficiary information to beneficiary VASPs (the virtual-asset travel rule) ([fatfcc2019], [fatfdp2019]) T7.009
2021-09 OFAC sanctions Suex OTC: U.S. Treasury OFAC designated SUEX OTC (2021-09-21), a Czech-registered, Russia-linked virtual currency exchange, under E.O. 13694 for facilitating transactions for ransomware actors; legal analyses call it the first designation of a virtual currency exchange ([mofosuex], [clearysuex]) T7.009
2022-04 OFAC sanctions Hydra market and Garantex: U.S. Treasury OFAC simultaneously designated the Hydra darknet market and the Garantex cryptocurrency exchange on 2022-04-05; Hydra under E.O. 13694 and Garantex under E.O. 14024. Reporting differs on whether the 100+ associated addresses were published that day or still being identified ([nextgovhydra], [merklehydra]). The "two-tier architecture" framing is OAK interpretation T7.009 + T7.001 + T7.002
2022-08 OFAC sanctions Tornado Cash: U.S. Treasury OFAC designated Tornado Cash on 2022-08-08 with associated Ethereum addresses (sources give 40+ and 44) ([orricktornado]). OFAC lifted the sanctions on 2025-03-21 ([venabletornado]) T7.009 + T7.001
2023-01 Bitzlato takedown: U.S. DOJ, French authorities, and Europol took action against Bitzlato; its founder Anatoly Legkodymov was arrested in Miami on 2023-01-17, and prosecutors said it processed about $700M in illicit funds including Hydra-related proceeds; sources differ on whether it was registered in Hong Kong or run from Shenzhen ([kitcobitzlato], [bnnbitzlato]) T7.009 + T7.002
2023-11 Binance OFAC/FinCEN settlement: Binance and founder Changpeng Zhao pleaded guilty and Binance agreed to pay about $4.3B across agencies, including a $3.4B FinCEN penalty and a $968M OFAC penalty, over BSA and sanctions violations that Treasury tied to terrorist groups ([reedbinance]) T7.009
2024-present Unverified: this row's claim of a sustained migration of illicit flows to mixer substitutes after the Tornado Cash designation is not backed by a source cited here. The migration is the structural signal that T7.009 detection must operate at the purpose layer (address labelling) rather than at the method layer (mixer screening), because the method layer adapts faster than the designation layer T7.009 + T7.005

Detection architecture

The T7.009 detection stack is a purpose-layer overlay on the T7 method-layer detection architecture:

  1. Regulatory designation lists (OFAC SDN, EU Consolidated, UN) provide the definitive set of sanctioned addresses — screening against these lists is a legal obligation, not just a risk decision.
  2. Blockchain-intelligence labelling feeds (Chainalysis, TRM Labs, Elliptic) extend detection to addresses not yet on designation lists but linked via cluster analysis to designated entities or illicit-purpose networks.
  3. NGO and law-enforcement coordination (IWF, ICMEC, INTERPOL) provides the operational referral pathway for CSAM-related and terrorism-financing address labelling.
  4. CEX/VASP compliance screening (KYT, blockchain-intelligence API integration, SAR filing workflow) is the operational detection-and-reporting layer.

Public references

Techniques demonstrated (4)