OFAC Sanctions Russian Firm Operation Zero Over Crypto-Funded Trade Secret Theft (2026)

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has designated Russian firm Operation Zero in connection with trade secret theft funded through cryptocurrency. The designation adds Operation Zero and associated persons to the Specially Designated Nationals and Blocked Persons (SDN) List, triggering immediate transaction prohibitions under the International Emergency Economic Powers Act (IEEPA), 50 U.S.C. §§ 1701–1706.

For cryptocurrency exchanges, virtual asset service providers (VASPs), and compliance teams, this action demands an immediate response: update screening systems, re-scan existing accounts, and assess any Russian-nexus exposure. OFAC sanctions carry strict civil liability — meaning exchanges that inadvertently process a prohibited transaction face penalties regardless of intent.

Key Takeaways

• Operation Zero is now on the SDN List. All U.S. persons — including crypto exchanges and VASPs — are prohibited from transacting with the designated entity and any persons or entities owned 50% or more by it (OFAC’s 50 Percent Rule, 31 C.F.R. § 501.807).
• Cryptocurrency was the funding mechanism for the underlying criminal activity (trade secret theft), reinforcing that OFAC pursues designations wherever digital assets facilitate sanctionable conduct — not only in crypto-native crimes.
• Strict liability applies to sanctions violations. OFAC may impose civil penalties even when the violator did not know or have reason to know the transaction involved a designated party. See OFAC’s Economic Sanctions Enforcement Guidelines, 31 C.F.R. Part 501, Appendix A.
• OFAC may include cryptocurrency wallet addresses in SDN entries, as it has in prior designations — exchanges must screen blockchain addresses, not just traditional identifiers.
• Voluntary self-disclosure is a significant mitigating factor if past transactions with the designated entity are identified (31 C.F.R. Part 501, Appendix A, Section V).

The Designation and Its Legal Basis

OFAC’s authority to designate foreign persons and entities derives from IEEPA and the relevant Executive Orders authorizing specific sanctions programs. For Russia-related designations, the primary authorities include Executive Order 14024, Blocking Property With Respect To Specified Harmful Foreign Activities of the Government of the Russian Federation (April 15, 2021), and its predecessors.

When a person or entity is added to the SDN List, all property and interests in property of that person within U.S. jurisdiction are blocked, and U.S. persons are generally prohibited from engaging in any transactions with them. This prohibition extends to cryptocurrency — OFAC has made clear since at least 2018 that digital assets constitute “property” subject to blocking requirements.

The Operation Zero designation reportedly stems from the firm’s involvement in criminal conduct related to stolen software, with cryptocurrency used to fund the activity. The crypto-funding element brings this enforcement action within the compliance perimeter of every U.S.-touching digital asset business, even though the underlying offense — trade secret theft — is not crypto-specific.

[Note: The specific sanctions program and Executive Order under which Operation Zero was designated should be confirmed against Treasury’s published designation notice. The regulatory prohibitions described here apply regardless of which specific program was used.]

Why This Matters Beyond Ransomware

Most OFAC-crypto enforcement actions to date have involved ransomware payments or direct sanctions evasion. The Suex OTC (2021), Chatex (2021), and Garantex (2022) designations all targeted exchanges facilitating ransomware proceeds. The Tornado Cash designation (2022) — partially reversed by the Fifth Circuit in Van Loon v. Department of the Treasury, No. 23-50669 (5th Cir. 2023) — targeted a mixing protocol used for sanctions evasion.

Operation Zero represents a different pattern: cryptocurrency as a funding mechanism for traditional criminal conduct. This broadens the categories of activity that can bring crypto-linked entities and transactions into OFAC’s crosshairs. Compliance programs calibrated narrowly around ransomware and mixing should take note — the sanctions risk surface is wider than many programs currently address.

The 50 Percent Rule and Screening Obligations

A compliance point frequently overlooked in initial SDN screening: OFAC’s 50 Percent Rule (31 C.F.R. § 501.807) provides that any entity owned 50% or more, directly or indirectly, by one or more blocked persons is itself considered blocked — even if the owned entity does not appear on the SDN List by name. This means that screening for “Operation Zero” alone is insufficient. Compliance teams must also identify and block transactions with any subsidiaries, affiliates, or controlled entities meeting the 50% ownership threshold.

For crypto compliance, this rule creates practical challenges. Blockchain analytics tools can identify designated wallet addresses, but corporate ownership structures require off-chain due diligence. Exchanges and VASPs should combine on-chain screening (wallet addresses, transaction patterns) with off-chain KYC data (beneficial ownership, corporate registries) to capture the full scope of the designation.

Secondary Sanctions Risk for Non-U.S. Platforms

Non-U.S. crypto exchanges and VASPs are not exempt from concern. Depending on the specific sanctions program and Executive Order, OFAC may impose secondary sanctions on non-U.S. persons who engage in significant transactions with designated entities. Under Executive Order 14024, § 1(a)(vii), the Secretary of the Treasury may designate persons who have “materially assisted, sponsored, or provided financial, material, or technological support for” a previously designated entity.

Any non-U.S. exchange processing transactions for Operation Zero risks its own designation — and with it, exclusion from the U.S. financial system, including U.S. dollar clearing and correspondent banking relationships. This secondary sanctions risk makes Operation Zero a global compliance concern, not just a U.S. one.

DeFi Protocols and the Post-Tornado Cash Landscape

For DeFi protocols with U.S. persons in their governance or user base, this designation reinforces the compliance pressure that has intensified since the Tornado Cash enforcement action. While the Fifth Circuit’s Van Loon decision held that OFAC exceeded its authority in designating Tornado Cash’s immutable smart contracts — because they were not “property” of a foreign national — that holding does not protect protocols with upgradable contracts, admin keys, or identifiable governance participants.

Many DeFi front-ends implemented OFAC screening after the Tornado Cash designation. The Operation Zero action is a reminder that these screening measures must be kept current — each SDN List update requires fresh ingestion and re-screening.

Practical Implications and What to Do Now

Immediate actions (within 24–48 hours of designation):

1. Ingest the SDN List update. Confirm your screening system has processed the latest OFAC SDN List data, available at Treasury’s SDN page. Check for any cryptocurrency wallet addresses included in the entry.
2. Re-screen existing accounts and pending transactions. Run all current customer accounts, counterparty records, and queued transactions against the updated list.
3. Apply the 50 Percent Rule. Identify any entities that may be owned or controlled by Operation Zero and screen for those as well, even if they are not individually named on the SDN List.
4. Block and report. If you identify property of the designated entity, block it and file a blocked property report with OFAC within 10 business days (31 C.F.R. § 501.603).

Near-term actions (within 30 days):

1. Assess Russian-nexus exposure. Review your customer base, counterparty relationships, and transaction history for exposure to Russian-linked entities and addresses.
2. Audit your OFAC compliance program against OFAC’s Framework for OFAC Compliance Commitments (May 2019), which identifies five essential components: management commitment, risk assessment, internal controls, testing and auditing, and training.
3. Consider voluntary self-disclosure. If you identify past transactions that may have involved the designated entity before the designation date, consult qualified sanctions counsel about whether voluntary self-disclosure to OFAC is appropriate. Self-disclosure is a significant mitigating factor under the Enforcement Guidelines.
4. Document everything. Maintain records of all screening updates, matches, blocks, and compliance decisions for at least five years (31 C.F.R. § 501.601).

Conclusion

OFAC’s designation of Operation Zero confirms that U.S. sanctions enforcement reaches cryptocurrency wherever it serves as a mechanism for funding sanctionable conduct — not just ransomware, not just sanctions evasion, but trade secret theft and other traditional criminal activity. For the crypto industry, the compliance mandate is clear: screen immediately, screen comprehensively (including the 50 Percent Rule), and screen continuously. Strict liability means there is no safe harbor for ignorance, and OFAC’s expanding blockchain analytics capabilities mean that crypto transactions are increasingly traceable back to their participants.

This article is for informational and educational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws and regulations in the cryptocurrency space change rapidly — consult a qualified attorney for advice specific to your situation and jurisdiction. Seth Goettelman is licensed to practice law in Wisconsin and Florida.