OFAC & Partners Issue LockBit Ransomware Sanctions Against Leader

In a coordinated international action, the U.S. Treasury sanctioned Dmitry Khoroshev, alleged leader of the notorious LockBit ransomware group. This briefing details the designations and risks.

· July 14, 2026 at 4:10 AM· 7 min read

OFAC & Partners Issue LockBit Ransomware Sanctions Against Leader

US, UK, and Australia Announce Coordinated LockBit Ransomware Sanctions and Charges

**WASHINGTON** – In a significant move against global cybercrime infrastructure, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has designated Russian national Dmitry Yuryevich Khoroshev as the leader, developer, and administrator of the prolific LockBit ransomware group. The May 7, 2024, action was coordinated with the U.S. Department of Justice (DOJ), the United Kingdom’s National Crime Agency (NCA), and the Australian Signals Directorate.

This designation is the latest step in a sustained campaign by international law enforcement to dismantle the LockBit network, which has operated one of the most active Ransomware-as-a-Service (RaaS) platforms in the world. The new **LockBit ransomware sanctions** follow a February 2024 disruption campaign that saw authorities seize LockBit’s public-facing websites and infrastructure, compromising their criminal enterprise.

According to the Treasury Department, LockBit has targeted over 2,500 victims worldwide—including more than 1,800 in the United States—and has extorted over $500 million in ransom payments. Its victims span a range of critical infrastructure sectors, including financial services, healthcare, education, and government.

Designation Details and Identifiers

OFAC added Khoroshev to the Specially Designated Nationals and Blocked Persons (SDN) List for his role in leading the cybercriminal organization.

* **Issuing Authority:** U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC) * **Designated Individual:** Dmitry Yuryevich Khoroshev * **Known Aliases:** LockBitSupp, LockBit, putinkrab * **Date of Designation:** May 7, 2024 * **Typology:** Ransomware Administrator, State-Sponsored Cybercrime Facilitator * **Nationality:** Russia

Concurrent with the OFAC designation, the DOJ unsealed a 26-count indictment against Khoroshev, and the U.S. Department of State announced a reward of up to $10 million for information leading to his arrest and/or conviction. The United Kingdom and Australia have also imposed parallel sanctions, including asset freezes and travel bans.

As part of the designation, OFAC identified 26 cryptocurrency wallet addresses associated with Khoroshev. Transactions with these addresses are now prohibited for all U.S. persons.

**Published Cryptocurrency Addresses:** * **BTC:** `[evidence withheld pending verification]`, `[evidence withheld pending verification]` * **ETH/USDT (ERC-20):** `[0x384D02…760201](https://etherscan.io/address/0x384D0223A4B95221958614409056463582760201)`, `[0x48588E…5C7a82](https://etherscan.io/address/0x48588E3623D3F28d2243292404BFdF748d5C7a82)`, `[0xa92aA4…A33177](https://etherscan.io/address/0xa92aA4641E7A07644917C1b948F3227978A33177)` * **And 21 other addresses across BTC, ETH, and Monero (XMR) networks as detailed in the official Treasury announcement.**

What are the Compliance Implications of the LockBit Ransomware Sanctions?

The designation of Dmitry Khoroshev carries significant compliance obligations for financial institutions, cryptocurrency exchanges, and other regulated entities globally. The **LockBit ransomware sanctions** are not merely symbolic; they legally prohibit U.S. persons and entities from engaging in virtually any transaction or service that benefits the designated individual.

Key implications include:

* **Asset Blocking:** All property and interests in property of Dmitry Khoroshev that are in the United States or in the possession or control of U.S. persons must be blocked and reported to OFAC. This includes funds held at financial institutions and cryptocurrency balances on exchanges subject to U.S. jurisdiction.

* **Prohibition on Transactions:** The sanctions prohibit making or receiving any contribution or provision of funds, goods, or services to, or for the benefit of, Khoroshev. This specifically includes processing ransom payments related to LockBit attacks, which was already a high-risk activity but is now explicitly prohibited if linked to the designated party.

* **Screening and Due Diligence:** Compliance teams must immediately update their sanctions screening lists to include Dmitry Khoroshev and his known aliases. Furthermore, blockchain analytics and transaction monitoring systems should be configured to flag and block any activity involving the 26 published cryptocurrency addresses.

* **Facilitation Risk:** Any foreign financial institution that knowingly facilitates significant transactions or provides services for Khoroshev could be subject to U.S. correspondent or payable-through account sanctions (secondary sanctions). This extends the risk well beyond U.S. borders.

Compliance Takeaway

For compliance officers, this action reinforces the critical need for robust controls around cybercrime-related financial activity. It is a clear signal from regulators that they will continue to pursue not just the ransomware actors themselves, but also the financial infrastructure that enables them. Institutions should review their risk assessments related to ransomware and ensure they have the tools to identify and block transactions linked to designated individuals and their wallets. Proactive monitoring of OFAC advisories and blockchain analytics are no longer optional, but essential components of a modern financial crime compliance program.

FAQ