OFAC Sanctions Tron Wallet Tied to Russian Cybercrime Hosting Provider

The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) has imposed sanctions on Tron-wallets linked to the Russian company Aeza Group. The firm has allegedly provided bulletproof hosting services to cybercriminals, fostering illegal activities such as ransomware ensembles, darknet drug markets, etc. 

The OFAC action targeted the infrastructure of Aeza, which has thus far served multiple cybercrime acts like data breach, drug trafficking, and malware distribution. The wallet has processed the transfer of over $350,000 worth of cryptocurrencies that seem to have been laundered across several global exchanges.

Besides the wallet, OFAC named four Aeza executives and four related entities on its Specially Designated Nationals list. Aeza hosted the Russian darknet marketplace BlackSprut, a known fentanyl distribution hub. Furthermore, it offered infrastructure support to Meduza and Lumma—malware groups that attacked U.S. defense and tech firms. According to the Treasury, Aeza served as a key enabler of cross-border cyber threats.

Hosting Cybercrime at Scale

Bulletproof hosting providers like Aeza shield malicious actors from law enforcement scrutiny. They rent infrastructure while ignoring abuse complaints. Consequently, they have become vital to large-scale digital crimes. Chainalysis confirmed the wallet’s cash-out activity matched Aeza’s service pricing, signaling direct payments from cybercriminal clients.

In addition, TRM Labs connected the wallet to Garantex, a Russian crypto exchange that had previously faced sanctions. Analysts found links to infostealers and vendors operating on the darknet. Shortly after these designations, websites associated with Aeza and its partners went offline, indicating that enforcement actions were taking effect.

Global Crackdown on Crypto-Backed Crime

Earlier in 2025, OFAC also sanctioned Zservers for supporting LockBit ransomware. In April, it targeted Yemen’s Houthi-linked crypto wallets. Similarly, in March, it blacklisted 49 wallets tied to Iran’s Nemesis darknet platform. These efforts show a clear global trend—disrupting infrastructure, not just actors. Hence, OFAC continues tightening its grip on crypto-enabled crime networks worldwide.