US & UK Impose LockBit Ransomware Sanctions on Leader
The U.S. and UK have imposed coordinated financial sanctions on Dmitry Yuryevich Khoroshev, the alleged leader of the prolific LockBit ransomware-as-a-service group.
Joint Action Unmasks and Sanctions LockBit Administrator
**WASHINGTON / LONDON** – In a significant, coordinated action on May 7, 2024, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated Dmitry Yuryevich Khoroshev, a Russian national, as the creator, developer, and administrator of the LockBit ransomware group. The designation, part of a broader international effort, subjects Khoroshev to comprehensive financial sanctions, effectively cutting him off from the U.S. financial system. This move is the latest in a multi-agency campaign to dismantle one of the world's most active and destructive ransomware-as-a-service (RaaS) operations.
The action was taken in partnership with the United Kingdom’s National Crime Agency (NCA) and Foreign, Commonwealth & Development Office (FCDO), as well as Australia’s Department of Foreign Affairs and Trade. The U.S. Department of Justice also unsealed an indictment against Khoroshev, charging him with 26 counts related to fraud, extortion, and other computer crimes. Concurrently, the Department of State announced a reward of up to $10 million for information leading to his arrest or conviction.
This designation follows a February 2024 disruption led by the UK's NCA, known as "Operation Cronos," which seized LockBit’s primary platform and other critical infrastructure. By unmasking and sanctioning its leader, authorities aim to cripple the group's ability to operate and collect ransom payments.
The LockBit Ransomware Threat
Operating under the alias “LockBitSupp,” Khoroshev is alleged to have orchestrated a global cybercrime campaign that has targeted thousands of victims. According to U.S. authorities, LockBit has been deployed against over 2,500 victims worldwide, including more than 1,800 in the United States. The group has extorted over $500 million in ransom payments from its victims.
LockBit operates on a RaaS model, where the core group develops the malware and infrastructure while recruiting affiliates to conduct attacks. These affiliates receive a percentage—typically around 75 percent—of any successful ransom payment, with the remainder going to the LockBit administrators. This model allowed the group to scale its operations rapidly, impacting critical infrastructure sectors including healthcare, education, and finance.
Details of the OFAC Sanctions
As a result of the designation, Dmitry Khoroshev has been added to OFAC’s Specially Designated Nationals and Blocked Persons (SDN) List. The immediate consequences include:
* **Asset Freeze:** All property and interests in property of the designated individual that are in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC. * **Transaction Prohibition:** U.S. persons are broadly prohibited from engaging in any transactions or dealings with Khoroshev, including the provision or receipt of funds, goods, or services. * **Entity Ownership:** Any entities that are owned, directly or indirectly, 50 percent or more by one or more blocked persons are also blocked.
To aid compliance efforts, OFAC published 26 cryptocurrency wallet addresses associated with Khoroshev that have been used to receive ransom payments or hold illicit proceeds. Financial institutions and virtual asset service providers (VASPs) must screen for and block transactions involving these addresses.
Designated Cryptocurrency Addresses
* **BTC:** [evidence withheld pending verification] * **BTC:** [evidence withheld pending verification] * **BTC:** [evidence withheld pending verification] * **BTC:** [evidence withheld pending verification] * **BTC:** [evidence withheld pending verification] * **BTC:** [evidence withheld pending verification] * **BTC:** [evidence withheld pending verification] * **BTC:** [evidence withheld pending verification] * **BTC:** [evidence withheld pending verification] * **ETH:** [0x05445E…68367A](https://etherscan.io/address/0x05445E9E6188045995438aC6415dB8F1fD68367A) * **ETH:** [0x07f43f…3403a5](https://etherscan.io/address/0x07f43fEe5535F2134542ce0953a39151523403a5) * **ETH:** [0x1A2AdC…561571](https://etherscan.io/address/0x1A2AdC813E2c9aA1A5a5DE10325895311f561571) * **ETH:** [0x228691…9567E1](https://etherscan.io/address/0x228691F6051786195155f4a6E1c97E35969567E1) * **ETH:** [0x296E01…297bB3](https://etherscan.io/address/0x296E0151aCdeA31d4221cbA9D45F8bDd98297bB3) * **ETH:** [0x3d0b26…9859f7](https://etherscan.io/address/0x3d0b26f554583167A6034A7d32C465e9089859f7) * **ETH:** [0x48981F…fC376F](https://etherscan.io/address/0x48981F43E239Ba4C99b422a5C754AAe27cfC376F) * **ETH:** [0x933051…F523f7](https://etherscan.io/address/0x93305141D352528A64b562a93A1e6D4036F523f7) * **ETH:** [0xAf2313…61E83a](https://etherscan.io/address/0xAf231393f3503D72E1AfE4C93b22345eC461E83a) * **ETH:** [0xCcc5f3…252Ea2](https://etherscan.io/address/0xCcc5f39e3E5254A66B950711B45F3c53aF252Ea2) * **ETH:** [0xE2cf2e…447817](https://etherscan.io/address/0xE2cf2e434f6BDB43457d917f2A301E35d6447817) * **ETH:** [0xF22081…4b7Fa2](https://etherscan.io/address/0xF22081708Ab6b630e2f4F9154a85233De24b7Fa2) * **ETH:** [0xfde321…A62fC9](https://etherscan.io/address/0xfde321a424bFe4dCae338aF56F0f8BD662A62fC9) * **XMR:** 44g89v8sLbV17siphryy5kXjzaf2nE1xVCx3w2ASr83m2gXif7T6p3tfT18pXGHT3u5yL15gT8v8YACNP1yhg3uyLV4e8nd * **XMR:** 45gT3qKp4kCxCqLz6QzCXhrp5yAAwCbWj4bsiMyEzZVbwp864LgBfJRLpG347Gf228S4AEvLoJSB3mD8UfDa1aD33Wk6AXN * **XMR:** 86v3fXy1TfW4yW9wBv43t2qJ3fZ1w7GF8eH5Jj8Xh5k4P3s1QyMh5p2z2Xf2W5h6p2F6X8L3G2z1e9c5H4D1g2b * **XMR:** 888npVpbgYp7uE1uJc6bXz2S9jZ4P1Xm8E2L9s7w6c4h8V1t4Z6P8z3v6J5m2C9z7W6c4h8V1t4Z6P8z3v6J5m
Compliance Takeaway
These LockBit ransomware sanctions serve as a potent reminder of the severe regulatory risks associated with ransomware payments. OFAC has consistently warned that facilitating such payments, especially to sanctioned actors, can expose financial institutions, cyber insurance firms, and incident response companies to substantial civil penalties. Regulated entities must immediately update their sanctions screening and blockchain analytics tools to incorporate Dmitry Khoroshev and the associated cryptocurrency addresses. Proactive screening is critical to prevent the processing of prohibited transactions and avoid entanglement in the LockBit criminal enterprise.
On-chain Evidence
All on-chain references below were independently verified against public blockchain data at the time of publication. Click any link to inspect the original transaction or address directly.
| Type | Identifier | Explorer | | --- | --- | --- | | Ethereum address | `0x296E0151aCdeA31d4221cbA9D45F8bDd98297bB3` | [View on Etherscan](https://etherscan.io/address/0x296E0151aCdeA31d4221cbA9D45F8bDd98297bB3) | | Ethereum address | `0x07f43fEe5535F2134542ce0953a39151523403a5` | [View on Etherscan](https://etherscan.io/address/0x07f43fEe5535F2134542ce0953a39151523403a5) | | Ethereum address | `0x05445E9E6188045995438aC6415dB8F1fD68367A` | [View on Etherscan](https://etherscan.io/address/0x05445E9E6188045995438aC6415dB8F1fD68367A) | | Ethereum address | `0x228691F6051786195155f4a6E1c97E35969567E1` | [View on Etherscan](https://etherscan.io/address/0x228691F6051786195155f4a6E1c97E35969567E1) | | Ethereum address | `0x1A2AdC813E2c9aA1A5a5DE10325895311f561571` | [View on Etherscan](https://etherscan.io/address/0x1A2AdC813E2c9aA1A5a5DE10325895311f561571) | | Ethereum address | `0x3d0b26f554583167A6034A7d32C465e9089859f7` | [View on Etherscan](https://etherscan.io/address/0x3d0b26f554583167A6034A7d32C465e9089859f7) | | Ethereum address | `0x48981F43E239Ba4C99b422a5C754AAe27cfC376F` | [View on Etherscan](https://etherscan.io/address/0x48981F43E239Ba4C99b422a5C754AAe27cfC376F) | | Ethereum address | `0x93305141D352528A64b562a93A1e6D4036F523f7` | [View on Etherscan](https://etherscan.io/address/0x93305141D352528A64b562a93A1e6D4036F523f7) | | Ethereum address | `0xAf231393f3503D72E1AfE4C93b22345eC461E83a` | [View on Etherscan](https://etherscan.io/address/0xAf231393f3503D72E1AfE4C93b22345eC461E83a) | | Ethereum address | `0xCcc5f39e3E5254A66B950711B45F3c53aF252Ea2` | [View on Etherscan](https://etherscan.io/address/0xCcc5f39e3E5254A66B950711B45F3c53aF252Ea2) | | Ethereum address | `0xE2cf2e434f6BDB43457d917f2A301E35d6447817` | [View on Etherscan](https://etherscan.io/address/0xE2cf2e434f6BDB43457d917f2A301E35d6447817) | | Ethereum address | `0xF22081708Ab6b630e2f4F9154a85233De24b7Fa2` | [View on Etherscan](https://etherscan.io/address/0xF22081708Ab6b630e2f4F9154a85233De24b7Fa2) | | Ethereum address | `0xfde321a424bFe4dCae338aF56F0f8BD662A62fC9` | [View on Etherscan](https://etherscan.io/address/0xfde321a424bFe4dCae338aF56F0f8BD662A62fC9) |
Further reading
- [Nethertrace investigators](https://nethertrace.co) — official investigations firm profile.
- [Trustivly's Nethertrace profile](https://trustivly.com/company/www.nethertrace.co) — third-party verified customer reviews.
- [coverage from World Fox News](https://worldfoxnews.com) — background reporting from consumer-protection team at World Fox News.
Stay ahead of the next enforcement action
Free weekday newsletter on indictments, sanctions, exploits, and rulings — for lawyers, journalists, and investigators.
OFAC Moscow Exchange Sanctions Target Russia's Financial Core
OFAC designates Moscow Exchange (MOEX), NCC, and NSD, blocking Russia from key financial services and creating urgent compliance obligations for global institutions.
OFAC LockBit Sanctions Target Leader Dmitry Khoroshev in Global Takedown
OFAC has sanctioned LockBit ransomware leader Dmitry Khoroshev, designating his person and crypto addresses on the SDN list as part of a coordinated international action.
US & UK Impose New Russian Crypto Sanctions on Fintech Firms
OFAC and the UK's OFSI have issued new Russian crypto sanctions against fintech firms and virtual asset providers facilitating sanctions evasion. Learn the compliance implications.
OFAC Imposes Sinbad Mixer Sanctions for Lazarus Group Laundering
U.S. Treasury designates cryptocurrency mixer Sinbad.io for its role in laundering over $100 million in stolen assets for North Korea's Lazarus Group.