OFAC LockBit Sanctions Target Leader Dmitry Khoroshev in Global Takedown

OFAC has sanctioned LockBit ransomware leader Dmitry Khoroshev, designating his person and crypto addresses on the SDN list as part of a coordinated international action.

· July 14, 2026 at 12:40 AM· 8 min read

OFAC LockBit Sanctions Target Leader Dmitry Khoroshev in Global Takedown

US Treasury Imposes OFAC LockBit Sanctions on Key Leader Dmitry Khoroshev

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has designated Dmitry Yuryevich Khoroshev, a Russian national identified as the creator, developer, and administrator of the prolific LockBit ransomware group. The action, announced on May 7, 2024, is part of a coordinated international effort with the U.S. Department of Justice (DOJ), the United Kingdom’s National Crime Agency (NCA), and other global partners to disrupt the world’s most active ransomware-as-a-service (RaaS) operation.

These OFAC LockBit sanctions place Khoroshev on the Specially Designated Nationals and Blocked Persons (SDN) List, effectively cutting him off from the U.S. financial system and criminalizing transactions with him by U.S. persons. The designation underscores a continued focus by authorities on dismantling the financial infrastructure that enables cybercrime.

Who is Dmitry Khoroshev and What is LockBit?

Dmitry Khoroshev, also known online as “LockBitSupp,” is the central figure behind the LockBit RaaS platform. Since its emergence in 2019, LockBit has operated by developing ransomware tools and recruiting a global network of affiliates to deploy them against victims. The group provides the malware and infrastructure, and in return, takes a percentage of the crypto-denominated ransom payments extorted from targets.

According to U.S. authorities, LockBit has been deployed against more than 2,000 victims worldwide, including critical infrastructure in the United States. The group has extorted over $1 billion in ransom demands and has collected more than $500 million in payments.

Victims have ranged from municipalities and hospitals to major corporations and schools. The group's disruptive attacks have encrypted essential data, halted operations, and incurred massive financial and societal costs.

Details of the Sanctions and Designated Crypto Addresses

Acting under Executive Order 13694, OFAC designated Khoroshev for his role in malicious cyber-enabled activities. As a result, all property and interests in property of Khoroshev that are within the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC.

Crucially for compliance teams at Virtual Asset Service Providers (VASPs), OFAC also explicitly identified 26 cryptocurrency addresses associated with Khoroshev. These wallets, which span Bitcoin (BTC), Ethereum (ETH), andMonero (XMR), are now considered blocked property. Any VASP or financial institution processing transactions to or from these addresses risks violating U.S. sanctions.

The designated wallets include:

* **BTC:** [evidence withheld pending verification] * **BTC:** [evidence withheld pending verification] * **ETH:** [0x931a7A…7d079A](https://etherscan.io/address/0x931a7AC18a3C49d883711d9459344131557d079A) * **ETH:** [0x334412…41b83F](https://etherscan.io/address/0x3344122d3b2d184a51A46835aF65E4bC5441b83F) * **XMR:** 45M2sSLgiAEh16V3oTP9E33eB95i6vBw5GH2nWHJ33s3Q7hW4PZaoN2s54rYNCmH93S6UeDBpknjYcmfCspfeXK7T8a2EwD

A full list of the designated addresses is available on OFAC's official sanctions list data files.

Coordinated International Enforcement Action

The sanctions were part of a broader law enforcement operation. The DOJ unsealed a 26-count indictment in the District of New Jersey against Khoroshev, charging him with conspiracy to commit fraud, extortion, and related activity in connection with computers; conspiracy to commit wire fraud; and eight counts of extortion in interstate commerce, among other charges. The U.S. Department of State also announced a reward of up to $10 million for information leading to his arrest or conviction.

This action builds on a previous disruption effort in February 2024, led by the NCA, where authorities seized LockBit’s primary platform and other critical infrastructure. International partners, including the United Kingdom and Australia, have also announced parallel sanctions against Khoroshev.

Compliance Takeaway for Financial Institutions

The designation of Dmitry Khoroshev and his associated crypto wallets presents clear directives for compliance departments at all financial institutions, including banks, money services businesses (MSBs), and crypto exchanges.

Regulated entities must immediately update their screening systems to include Khoroshev's name, aliases, and all 26 specified cryptocurrency addresses. Any existing accounts or assets linked to the sanctioned individual must be blocked, and any attempted transactions involving the designated wallets must be rejected and reported to OFAC. This action serves as another stark reminder that facilitating ransom payments to sanctioned ransomware groups like LockBit can result in severe penalties.

FAQ: Understanding the OFAC LockBit Sanctions

What is the LockBit ransomware group? LockBit is a Ransomware-as-a-Service (RaaS) operation where a central group develops and maintains malware, then recruits affiliates to carry out attacks. The group profits by taking a cut of the crypto ransom payments extorted from victims.