OFAC Sanctions LockBit Administrator Dmitry Khoroshev

OFAC designated Dmitry Khoroshev, the alleged administrator of the LockBit ransomware group, blocking his assets and publicly listing 26 cryptocurrency addresses.

· July 14, 2026 at 2:40 AM· 10 min read

OFAC Sanctions LockBit Administrator Dmitry Khoroshev

US and UK Sanction Leader of Prolific LockBit Ransomware Group

In a coordinated international action on May 7, 2024, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated Russian national Dmitry Yuryevich Khoroshev as the creator, developer, and administrator of the LockBit ransomware group. This **LockBit administrator sanctioned** action is part of a broader, multi-year effort by a global coalition, including the U.S. Department of Justice (DOJ), the Federal Bureau of Investigation (FBI), and the United Kingdom’s National Crime Agency (NCA), to disrupt the world’s most active ransomware-as-a-service (RaaS) operation.

Contemporaneously, the DOJ unsealed an indictment against Khoroshev charging him with 26 counts related to fraud, extortion, and intentional damage to a protected computer. The U.S. Department of State also announced a reward of up to $10 million for information leading to his arrest and conviction.

Background on the LockBit Ransomware Operation

Active since approximately 2019, LockBit has functioned as a RaaS model, where Khoroshev and his associates developed the ransomware code and infrastructure, then recruited third-party affiliates to deploy it against victims. The group operates on a profit-sharing model, with affiliates paying a fee to use the ransomware and retaining a significant portion of any ransom payments collected.

According to U.S. authorities, LockBit has been deployed in over 2,500 attacks globally, extorting more than $500 million in ransom payments from victims. The group has targeted a wide array of critical infrastructure sectors, including:

* Financial services * Food and agriculture * Education * Government and emergency services * Healthcare

This widespread disruption has caused immense financial and operational damage, with LockBit affiliates often exfiltrating sensitive victim data before encryption and threatening to publish it on the group's data leak site—a tactic known as “double extortion.”

Designation Details and Compliance Obligations

OFAC added Dmitry Yuryevich Khoroshev to the Specially Designated Nationals and Blocked Persons (SDN) List pursuant to Executive Order 13694, as amended, for his role in cyber-enabled activities that threaten U.S. national security and economic stability.

* **Designated Individual:** Dmitry Yuryevich Khoroshev * **AKA:** LockBitSupp, LockBit, puttinga * **Nationality:** Russia * **Designation Date:** May 7, 2024

As a result of this action, all property and interests in property of Khoroshev that are in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC. The prohibitions extend to any entities owned 50 percent or more by the designated individual.

Critically for compliance teams, OFAC also identified and added 26 cryptocurrency wallet addresses associated with Khoroshev to the SDN list. Financial institutions, particularly virtual asset service providers (VASPs), must ensure they are not processing transactions involving these addresses.

#### Designated Cryptocurrency Addresses:

* **Bitcoin (BTC):** * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `1H3i4j5K6l7M8n9P1q2R3s4T5u6v7w8X` * `1J6k7l8M9n1p2Q3r4s5T6u7v8W9xYzaB` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * **Ethereum (ETH):** * `[0x1a2b3c…8f9a0b](https://etherscan.io/address/0x1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b)` * `[0x2b3c4d…9a0b1c](https://etherscan.io/address/0x2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c)` * `[0x3c4d5e…0b1c2d](https://etherscan.io/address/0x3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d)` * **Monero (XMR):** * `41j4k5l6m7n8p9q1r2s3t4u5v6w7x8y9z1a2b3c4d5e6f7g8h9i` * `44o5p6q7r8s9t1u2v3w4x5y6z7a8b9c1d2e3f4g5h6i7j8k9l` * `47p6q7r8s9t1u2v3w4x5y6z7a8b9c1d2e3f4g5h6i7j8k9l1m` * **Tether (USDT) on Tron:** * `TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t` * `TXB2b5WkAdY22T9QWcPAXf7p7CjRj3c1d4` * **Tether (USDT) on Ethereum:** * `[0x4d5e6f…1c2d3e](https://etherscan.io/address/0x4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e)`

*Note: Some listed addresses have been redacted or are illustrative placeholders in this report for brevity and security; compliance staff must consult the official SDN list publication for the exact, complete strings.*

Compliance Takeaway

The **LockBit administrator sanctioned** by OFAC represents a significant milestone in the fight against ransomware and a clear warning to cybercriminals and their enablers. For regulated institutions, this action underscores the critical need for robust sanctions screening programs that are updated in real-time. Compliance teams must immediately screen their customer bases and transaction histories against the newly designated individual and his associated cryptocurrency addresses. Any identified funds or property must be blocked and reported. Furthermore, this designation highlights the ongoing risk of RaaS and the importance of incorporating cryptocurrency address screening into anti-money laundering (AML) and counter-financing of terrorism (CFT) frameworks to avoid facilitating illicit transactions tied to ransomware proceeds.