On May 20, 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned 11 individuals and 2 entities linked to the Sinaloa Cartel, adding their wallet jaddresses to the Specially Designated Nationals (SDN) list. The action targets two distinct networks: a cash-to-crypto laundering cell led by Armando de Jesus Ojeda Aviles, and a longstanding trafficking and laundering organization headed by fugitive Jesus Gonzalez Penuelas. For VASPs, banks, and fintechs operating outside the United States, the dual designation under Executive Orders 14059 and 13224 creates compliance exposure that extends well beyond U.S. persons.
What the action covers
Armando de Jesus Ojeda Aviles runs the primary money laundering network for the Los Chapitos faction of the Sinaloa Cartel. He took over after his predecessor, Mario Alberto Jimenez Castro, was murdered. Jimenez Castro had been sanctioned in September 2023 for using digital currency and wire transfers to move fentanyl proceeds from the United States to Mexico.
The pipeline runs in four steps. U.S.-based couriers collect bulk cash from fentanyl, methamphetamine, and cocaine sales. The cash is converted into cryptocurrency, primarily Tether on Ethereum. Wallets are layered to obscure the trail. Funds reach Mexico-based brokers who settle in local currency for cartel leadership.
The other named figures in the network are as follows. Jesus Alonso Aispuro Felix is the chief money broker, responsible for brokering bulk transfers of drug proceeds through digital currency addresses. Rodrigo Alarcon Palomares coordinated U.S.-based cash pickups. A federal grand jury in the District of Colorado indicted him in April 2024 on three counts of laundering drug proceeds through cryptocurrency. Alfredo Orozco Romero is the network's security advisor and debt collector for cocaine shipments. He controls two designated front entities, Grupo Especial Mamba Negra (a Mexican private security company) and Gorditas Chiwas (a restaurant in Chihuahua), held through his sister and daughter as nominal owners.
Jesus Gonzalez Penuelas is a Sinaloa Cartel cell leader who has run drug production and distribution into the United States since 2007. He is a fugitive from justice with a $5 million DEA reward on his arrest, and a separate State Department reward. His distribution cells operate in California, Texas, Colorado, Washington, Utah, and Nevada.
A point that has been underreported elsewhere: Gonzalez Penuelas was already on the SDN list under the Kingpin Act since May 2021. The May 20 action updated his existing listing to add the Specially Designated Global Terrorist (SDGT) designation under E.O. 13224 and explicit linkage to the Sinaloa Cartel. Compliance teams running static SDN refreshes pulled before May 20 will not catch this update. The risk profile attached to this party has changed, even though the SDN entry itself is not new.
Five associates were added under his network: Castulo Bojorquez Chaparro, Fredi Ismael Garcia Sandoval, Luis Arnulfo Moreno Zamora, Baltazar Saenz Aguilar, and Noe de Jesus Castro Rocha.
Per the official SDN list update, the designated Ethereum addresses are attributed as follows.
Attributed to Armando de Jesus Ojeda Aviles:
Attributed to Rodrigo Alarcon Palomares:
All designated addresses are flagged in Scorechain's platform with a Critical Risk Score (1/100), reflecting direct OFAC SDN status and corresponding action by stablecoin issuers (Circle and Tether) to blacklist these addresses at the smart-contract level. Scorechain's on-chain analysis has also surfaced related cluster addresses that operationally support the same laundering pipeline, even where those wallets are not on the official SDN list.
The following analysis covers cluster activity that pre-dates the May 20 OFAC designation. The figures reflect cumulative transaction volume Scorechain identified on these addresses prior to designation, when they were active as laundering conduits.
Volume composition. Approximately $3.36 million in total transaction value passed through the cluster. Of that volume, roughly 98.8% was denominated in USDT and USDC. Native Ethereum represented around 1.2%, used almost entirely to cover gas fees. The disparity matters. Any compliance program that monitors only native ETH activity on these wallets would have missed approximately 98% of the actual risk exposure. ERC-20 stablecoin tracing is essential.
Concentration in two addresses. Two of the five Ojeda Aviles addresses accounted for more than 95% of the cluster's transaction volume:
The remaining Ojeda Aviles addresses moved comparatively small amounts in USDC. The Alarcon Palomares address showed minimal on-chain activity (no direct ERC-20 stablecoin volume, around 0.013 ETH in native transfers). Its operational role appears closer to coordination than to value movement.
Velocity pattern. Funds moving through the high-volume addresses typically dwelt for less than 10 minutes between receipt and onward transfer to centralized exchange off-ramps. This is consistent with professional pass-through laundering, where wallets serve only as a layering hop rather than as value storage.
February 2026 outflow cluster. Scorechain identified a sustained series of structured USDT outflows from address 0xf2235...27cb to major centralized exchange deposit infrastructure during February 2026. Representative transactions:
Velocity pattern. Funds moving through the high-volume addresses typically dwelt for less than 10 minutes between receipt and onward transfer to centralized exchange off-ramps. This is consistent with professional pass-through laundering, where wallets serve only as a layering hop rather than as value storage.
February 2025 outflow cluster. Scorechain identified a sustained series of structured USDT outflows from address 0xf2235...27cb to major centralized exchange deposit infrastructure during February 2025. Representative transactions:
The transactions show two operational signatures. First, the consistent sizing in the $30,000 to $50,000 range suggests deliberate structuring to stay below specific monitoring thresholds while still moving substantial cumulative volume. Second, a single recurring counterparty (the address 0xfabfce96bf0ff4a45c2f0068657e7efd23ae50b9) funded most of these outflows. That feeder wallet, which is not on the SDN list, was the principal consolidator for the cluster. Compliance teams should flag it as a high-risk related entity even though it is not directly designated.
Counterparty exposure. Scorechain's platform identified direct historical interactions between the cluster and Garantex, the Russian cryptocurrency exchange that OFAC sanctioned in April 2022 and re-designated in March 2025 alongside its successor Grinex. Exposure to a separately sanctioned VASP compounds the compliance picture for any institution that touched these wallets indirectly.
Five things to act on now.
Strict liability applies. Treasury was explicit in the press release: "OFAC may impose civil penalties for sanctions violations on a strict liability basis." Intent is not a defense. Screening failures are violations. Update SDN feeds immediately and run a back-look against the newly designated ETH addresses and the Gonzalez Penuelas listing change.
Secondary sanctions risk for non-U.S. financial institutions. This is the single most consequential point for European VASPs, banks, and fintechs. From the press release: "engaging in certain transactions involving the persons designated pursuant to E.O. 13224, as amended, may risk the imposition of secondary sanctions on participating foreign financial institutions." OFAC can prohibit or impose strict conditions on a foreign financial institution's U.S. correspondent or payable-through accounts if that institution knowingly facilitates significant transactions for the designated parties. Correspondent banking access is on the line, not just OFAC enforcement.
The 50% rule covers the front entities. Any entity owned 50% or more, directly or indirectly, individually or in aggregate, by one or more blocked persons is also blocked. Gorditas Chiwas and Grupo Especial Mamba Negra are textbook examples, held through Alfredo Orozco Romero's sister and daughter as front persons. Compliance teams need to extend beneficial ownership review beyond the named individuals.
Multi-wallet fragmentation requires counterparty screening. Multiple addresses attributed to one person is a deliberate layering pattern. Screening only against the SDN list will miss most of the actual exposure, which sits one or two hops from the designated wallets. The feeder wallet identified above is a working example. It is undesignated, but operationally part of the laundering infrastructure.
The Gonzalez Penuelas listing update is easy to miss. His SDN entry has been on the list since 2021. The May 20 update added SDGT status and explicit Sinaloa Cartel linkage. If a compliance team last refreshed its list before May 20 and treats his entry as unchanged, the additional sanctions exposure (secondary sanctions risk for non-U.S. FIs) will not be in their risk model.
This is the eighth Sinaloa Cartel designation linked to cryptocurrency since September 2023, when OFAC first sanctioned Mario Alberto Jimenez Castro and added the first cartel-linked Ethereum address to the SDN list. The cadence of major designation actions every two to four months is now a stable enforcement rhythm. The typology is also stable. Bulk cash is collected in the United States, converted to stablecoins, layered through multiple wallets, off-ramped to centralized exchanges, and settled in Mexico.
What changed in early 2025 was the overlay. The State Department's February 2025 designation of the Sinaloa Cartel as a Foreign Terrorist Organization brought counter-terrorism authorities into the picture. Every action since, including this one, has applied dual E.O. 14059 and E.O. 13224 framing, which extends sanctions exposure beyond U.S. persons to foreign financial institutions through the secondary sanctions mechanism.
For compliance leads at VASPs, banks, and fintechs operating in the EU, the UK, or LATAM with U.S. correspondent banking exposure, this is not edge-case risk. It is a recurring enforcement pattern with predictable cadence and consistent typology.
Scorechain's KYT monitors real-time transactions against the updated SDN list, including the newly designated Ethereum addresses and the updated Gonzalez Penuelas designation. Wallet Screening flags direct and counterparty exposure, including feeder wallets that sit one or two hops from designated addresses. Transaction Monitoring identifies the multi-wallet fragmentation and high-velocity pass-through patterns that characterize professional cartel laundering operations.
For institutions with exposure to Latin America-facing flows, OTC activity, or high-risk exchange counterparties, the Sinaloa designation underscores why on-chain risk monitoring needs to extend beyond static SDN matching.
What did OFAC designate on May 20, 2026?
OFAC designated 11 individuals and 2 entities linked to the Sinaloa Cartel, which has been a U.S.-designated Foreign Terrorist Organization since February 2025. The action covers two distinct networks: a cash-to-crypto laundering cell led by Armando de Jesus Ojeda Aviles, and a longstanding trafficking and laundering organization led by Jesus Gonzalez Penuelas. Multiple Ethereum addresses were added to the SDN list, alongside related cluster wallets surfaced through on-chain analysis.
Which Ethereum addresses were added to the SDN list, and to whom are they attributed?
The designated addresses are attributed to Armando de Jesus Ojeda Aviles (0x038989cbb1710c72b9920dc4fa529158f463e72c, 0x14779CEC0B117d5194c750C55Ea1f42086631964, 0x32dA24Ca413F3E7B53145D4737e172C3bdF81e3e, 0xf2235d55b2950a0b1317469d72d07ae65b2e27cb, and 0x4F428c11Dc82388fa5136D636e613ad923Eb700B) and to Rodrigo Alarcon Palomares (0xaC4cC4B68ea24BbFAAC8fD127B67Ed445ACcCE22).
How does the Sinaloa Cartel use cryptocurrency for laundering?
U.S.-based couriers collect bulk cash from fentanyl and other drug sales. Brokers convert the cash to stablecoins, primarily USDT on Ethereum. Funds are layered across multiple wallets to obscure the trail, off-ramped to centralized exchanges, and settled in local currency for the cartel in Mexico. Scorechain's analysis of the designated cluster shows 98.8% of volume was in stablecoins, with sub-10-minute dwell times consistent with professional pass-through laundering.
What are the compliance implications for non-U.S. financial institutions?
The dual designation under E.O. 13224 creates secondary sanctions exposure for foreign financial institutions. OFAC can prohibit or impose strict conditions on a foreign institution's U.S. correspondent or payable-through accounts if that institution knowingly facilitates significant transactions for the designated parties. Compliance failures put U.S. correspondent banking access at risk, not just direct enforcement.
Why does the FTO designation matter for crypto compliance?
The Sinaloa Cartel's status as a Foreign Terrorist Organization, in place since February 20, 2025, means knowingly providing material support, including processing transactions linked to the designated cartel networks, is a federal crime under 18 U.S.C. § 2339B. This extends enforcement exposure from drug trafficking and AML statutes into counter-terrorism frameworks, with materially greater penalties.
.png){kind=logo}
