An exact sanctions match, with its boundaries intact

0x7ff9cf…9ee3d9 · 1 range · 32 selected evidence items

Sanctioned EOA 0x7ff9…e3d9: multi-source designation with ETH/USDT flows and dormant recent activity

The analyzed address 0x7ff9cf…9ee3d9 is an externally owned account on Ethereum and Base with a direct OpenSanctions CryptoWallet match and corroborating TRM and GoPlus sanctions/blackmail flags, supporting a publicly-attributed sanctions-dataset finding. Loaded records show concentrated 2022 activity: repeated bidirectional ETH/USDT/DAI flows with counterparty 0x71191C…929A5b (34 interactions), 23 outbound calls to the USDT contract, inbound USDT from several EOAs including redsheep.eth, and outbound ETH to 0x45FB…e64d. Later activity is minimal: two 0.00001 ETH inbound transfers in Oct 2023 and one inbound NLRA token on Base in Jan 2025. Current indexed balances are near-zero ETH, 900 USDT (unverified token contract), and 1 NLRA. Attribution of a natural person is not possible from supplied data; operational-role hypotheses are bounded to a personal or operational wallet with possible automation.

Observed

OpenSanctions' consolidated sanctions dataset contains an exact CryptoWallet.publicKey match for this address, and TRM sanctions screening returned a sanctions match; GoPlus marks the address as sanctioned on both Ethereum and Base.
GoPlus associates this address with blackmail activity on both Ethereum and Base (provider screening claims, medium confidence).
The address is an externally owned account on Ethereum with 266 indexed transactions, 214 token transfers, and a current indexed native balance of 0.00002 ETH; earliest indexed transaction is 2019-10-03.
On Base the address is an EOA with 0 indexed transactions, 1 token transfer, and 0 ETH native balance.
The address had 34 loaded interactions (9 inbound, 25 outbound) with counterparty 0x71191C…929A5b involving ETH, USDT, and DAI between 2022-02-21 and 2022-05-28.
The address made 23 outbound calls to the USDT contract (0xdAC17F…831ec7) between 2022-02-21 and 2022-04-05.
The address sent 7 outbound ETH transfers to 0x45FB09…59e64d between 2022-01-17 and 2022-03-28.
The address received inbound USDT from multiple EOAs including 0x661951C7…, 0x3bdc2B28…, redsheep.eth (0xD92f6d0c…), 0x5027c7e4…, 0x4E996456…, and 0x5fc4b67F… during Feb–Apr 2022.
On 2023-10-28 the address received two inbound transfers of 0.00001 ETH each from 0x9312de…5CD021; a balance observation at block 18450129 records a post-observation balance of 0.00002 ETH.
On 2025-01-22 the address received 1 NLRA (NeoLira Coin) on Base from 0xb063FB…A61d85; current indexed holdings include 1 NLRA on Base and 900 USDT on Ethereum via a token contract that is not the canonical Tether address.
Loaded activity spans 1,101 days and 34 loaded records repeat the same method/counterparty pattern; these are heuristic metrics over the loaded window only.

Interpretation

high
The convergence of an exact OpenSanctions CryptoWallet match, a TRM sanctions match, and GoPlus sanctioned flags on two chains strongly supports that this specific address appears in sanctions datasets; this is a dataset finding about the address, not an unstated real-person identity.
medium
The 2022 flow pattern—inbound USDT from multiple distinct EOAs followed by concentrated bidirectional flows with a single counterparty (0x71191C…) and repeated USDT contract calls—is consistent with collection-and-forwarding or payment-relay behavior, though the loaded window cannot establish purpose.
low
The repetition of 34 records sharing the same method/counterparty pattern raises the possibility of scripted or automated execution, but the heuristic does not establish automation.
medium
The two 0.00001 ETH inbound transfers in Oct 2023 resemble dust-sized top-ups or address probing rather than economically meaningful funding, leaving the address with only a minimal native balance.
medium
The single inbound NLRA token on Base in Jan 2025, with no other Base transactions, is consistent with an unsolicited or spam-style token receipt rather than deliberate portfolio activity; the 900 'USDT' holding sits at a non-canonical token contract and may not represent genuine Tether value.
medium
Activity appears largely dormant after mid-2022, with only three small inbound events across 2023–2025, suggesting the address ceased active operational use within the loaded window.

Public-record identity assessment · not identity verificationAddress attribution

Publicly attributed

individual wallethigh

The address is publicly attributed in sanctions datasets: OpenSanctions holds an exact CryptoWallet.publicKey match and TRM reports a sanctions match, corroborated by GoPlus sanctioned flags on Ethereum and Base. This establishes a sanctions-dataset attribution of the address itself, not the identity of any natural person. Onchain data shows an EOA with personal-wallet-style ETH/USDT/DAI flows; no supplied signal names a person or organization as controller.

Candidate entities

OpenSanctions sanctions dataset entry (OFAC-listed wallet)direct public attributionhigh

TRM sanctions screening matchdirect public attributionhigh

Supporting signals

signal-99fcdc9250019eb6e5f30f13
signal-2996154f4f69e8e8d516e3dd
signal-3f38c9d575661f33b50b7d4e
signal-48dd48225041d2498bb07df5

Needed for verification

No supplied signal names a natural person or organization controlling the address
No signed message, KYC record, or public self-attribution linking the address to an identity
The OpenSanctions entity page identity details were not supplied beyond the wallet match

Hypotheses, not factsAttribution & Intent

3 leads

Address attributionhigh

The address is very likely the same wallet referenced in the OpenSanctions/OFAC dataset entry, given the exact publicKey match; this attribution covers the address only and does not extend to any named individual.

Supporting signals

signal-3f38c9d575661f33b50b7d4e
signal-48dd48225041d2498bb07df5

What would verify itVerify against the live OpenSanctions entity page and the current OFAC SDN list; the bundled snapshot is dated Aug 30, 2026 and should be refreshed.

Operational rolemedium

The address plausibly operated as a collection-and-forwarding wallet during early 2022, aggregating inbound USDT from multiple EOAs and routing value through a primary counterparty (0x71191C…) and the USDT contract; this is a bounded role inference from loaded flows only.

Supporting signals

signal-197eef1a2383367164e45341

What would verify itFull history beyond the 101 loaded records and internal transactions would be needed to confirm the forwarding role.

Possible intentlow

Given provider blackmail associations and the sanctions match, the 2022 inbound USDT from multiple unrelated EOAs could represent proceeds collection, but the supplied records alone cannot establish that any specific transfer was coerced or illicit.

Supporting signals

signal-99fcdc9250019eb6e5f30f13

What would verify itOffchain context (victim reports, exchange records, designation basis) is required; onchain flows alone are insufficient.

Risks & uncertainties

Risks

high
The address is matched in sanctions datasets (OpenSanctions exact CryptoWallet match; TRM sanctions match) and flagged as sanctioned by GoPlus on two chains; any interaction with it carries severe sanctions-exposure risk for counterparties and platforms.
high
GoPlus associates the address with blackmail activity on Ethereum and Base, indicating provider-assessed links to extortion-type conduct.
medium
The address received USDT from multiple distinct EOAs in early 2022; counterparties that sent funds to this address may face indirect exposure given the later sanctions designation.
medium
The indexed 900 'USDT' balance sits at token contract 0xB2a0d59F…, not the canonical Tether contract, so the holding may be a lookalike or low-quality token rather than genuine USDT value.
low
The NLRA token received on Base has no established independent market activity and arrived as a single unsolicited-style inbound transfer, consistent with spam-token risk.
medium
The bundled OpenSanctions snapshot is dated Aug 30, 2026 and is more than 72 hours old; designation status should be re-verified against a current dataset before any action is taken.

Uncertainties

evidence
The identity of the natural person or organization controlling the address is unknown; sanctions-dataset matches attribute the address, not a person, and no supplied signal names a controller.
coverage
Only 4 of 101 loaded timeline events were supplied to the model, and the public index reports 481 total evidence; activity outside the loaded snapshot may materially change behavioral and role assessments.
Coverage limitation
coverage
Internal transactions and contract logs were checked only in bounded pages, and offchain actions and unlinked addresses remain outside coverage, so the full flow picture is incomplete.
Coverage limitation
coverage
Ethereum native balance history is partial because 4 malformed public-index records were ignored, and liquid-staking balances were unavailable due to RPC failure; current holdings may be understated.
Coverage limitation
coverage
DeFi position coverage is limited to Morpho and Aave V3 on Ethereum and Base, with Compound III/V2 unavailable on Ethereum; the address may hold positions not reflected here.
Coverage limitation
evidence
Whether the 34 repeated method/counterparty records reflect automation cannot be determined from the heuristic metric alone.
evidence
The basis for the OpenSanctions/OFAC designation (linked entity, program, date) was not supplied, so the designation's scope and any related-entity context remain unverified.
evidence
The nature of the relationship with primary counterparty 0x71191C…929A5b (34 interactions) is unknown; it could be the same operator, a service, or an unrelated counterparty.

Selected address facts

Address facts captured with this report

Read-only · 17 facts

Account facts2

Ethereum account factsEthereum Blockscout public APIs + Ethereum Blockscout API v2 · Ethereum · Sep 5, 2026, 1:34 AM UTC

Account type: eoa
Indexed transaction count: 266
Indexed token-transfer count: 214
Current native balance (raw): 20000000000000 ETH; decimals 18
Balance observed at block: 25902428
Earliest indexed transaction: 2019-10-03T06:09:03.000Z

Base account factsBase Blockscout public APIs + Base Blockscout API v2 · Base · Sep 5, 2026, 1:34 AM UTC

Account type: eoa
Indexed transaction count: 0
Indexed token-transfer count: 1
Current native balance (raw): 0 ETH; decimals 18
Balance observed at block: 50858555
Earliest indexed transaction: 2019-10-03T06:09:03.000Z

Current assets2

NeoLira CoinBase Blockscout token balances · Base · Sep 5, 2026, 1:34 AM UTC

Asset type: erc-20
Symbol: NLRA
Balance (raw): 1000000000000000000
Amount: 1
Token address: 0x7bD896…796911
Quality: indexed · Public index reputation is ok, but independent market activity was not established · 667 indexed holders; holder count alone is not a quality guarantee
Source reputation: ok

Tether USDEthereum Blockscout token balances · Ethereum · Sep 5, 2026, 1:34 AM UTC

Asset type: erc-20
Symbol: USDT
Balance (raw): 900000000
Amount: 900
Token address: 0xB2a0d5…80D1E0
Quality: indexed · Public index reputation is ok, but independent market activity was not established · 1009 indexed holders; holder count alone is not a quality guarantee
Source reputation: ok

Native balance observations1

Ethereum ETH balanceEthereum Blockscout native balance change history · Ethereum · Oct 28, 2023, 5:16 PM UTC

Post-observation balance (raw): 20000000000000; decimals 18
Balance change (raw): 10000000000000
Block: 18450129
Transaction: 0x13ec2f76a85993b83450202f7f057fc9c0f56caec1a5587be95e59a4b1d4965a
Observation basis: indexed-balance-change

Relationships12

0x71191C…929A5bMemoir deterministic relationship summary · May 28, 2022, 10:43 AM UTC

Counterparty address: 0x71191C…929A5b
Chains: Ethereum
Roles: source · destination
Loaded interactions: 34; 9 inbound; 25 outbound
First loaded interaction: 2022-02-21T13:42:30.000Z
Latest loaded interaction: 2022-05-28T10:43:42.000Z
Assets in loaded flows: ETH · USDT · DAI

USDT StablecoinMemoir deterministic relationship summary · Apr 5, 2022, 2:55 PM UTC

Counterparty address: 0xdAC17F…831ec7
Public labels: USDT Stablecoin
Chains: Ethereum
Roles: destination · contract
Loaded interactions: 23; 0 inbound; 23 outbound
First loaded interaction: 2022-02-21T13:42:30.000Z
Latest loaded interaction: 2022-04-05T14:55:57.000Z

0x45FB09…59e64dMemoir deterministic relationship summary · Mar 28, 2022, 11:33 AM UTC

Counterparty address: 0x45FB09…59e64d
Chains: Ethereum
Roles: destination
Loaded interactions: 7; 0 inbound; 7 outbound
First loaded interaction: 2022-01-17T16:26:33.000Z
Latest loaded interaction: 2022-03-28T11:33:22.000Z
Assets in loaded flows: ETH

0x661951…001726Memoir deterministic relationship summary · Mar 15, 2022, 9:06 PM UTC

Counterparty address: 0x661951…001726
Chains: Ethereum
Roles: source
Loaded interactions: 3; 3 inbound; 0 outbound
First loaded interaction: 2022-03-11T09:41:43.000Z
Latest loaded interaction: 2022-03-15T21:06:10.000Z
Assets in loaded flows: USDT

0x9312de…5CD021Memoir deterministic relationship summary · Oct 28, 2023, 5:16 PM UTC

Counterparty address: 0x9312de…5CD021
Chains: Ethereum
Roles: source
Loaded interactions: 2; 2 inbound; 0 outbound
First loaded interaction: 2023-10-28T16:37:11.000Z
Latest loaded interaction: 2023-10-28T17:16:47.000Z
Assets in loaded flows: ETH

0x3bdc2B…45ba07Memoir deterministic relationship summary · Mar 31, 2022, 9:36 AM UTC

Counterparty address: 0x3bdc2B…45ba07
Chains: Ethereum
Roles: source
Loaded interactions: 2; 2 inbound; 0 outbound
First loaded interaction: 2022-03-15T11:06:51.000Z
Latest loaded interaction: 2022-03-31T09:36:09.000Z
Assets in loaded flows: USDT

redsheep.ethMemoir deterministic relationship summary · Mar 30, 2022, 10:33 AM UTC

Counterparty address: 0xD92f6d…E56589
Public labels: redsheep.eth
Chains: Ethereum
Roles: source
Loaded interactions: 2; 2 inbound; 0 outbound
First loaded interaction: 2022-03-29T09:54:49.000Z
Latest loaded interaction: 2022-03-30T10:33:22.000Z
Assets in loaded flows: USDT

0x3194F3…1D8beAMemoir deterministic relationship summary · Mar 28, 2022, 11:30 AM UTC

Counterparty address: 0x3194F3…1D8beA
Chains: Ethereum
Roles: source
Loaded interactions: 2; 2 inbound; 0 outbound
First loaded interaction: 2022-03-23T14:38:52.000Z
Latest loaded interaction: 2022-03-28T11:30:57.000Z
Assets in loaded flows: ETH

0x5027c7…19D7c5Memoir deterministic relationship summary · Mar 25, 2022, 8:35 AM UTC

Counterparty address: 0x5027c7…19D7c5
Chains: Ethereum
Roles: source
Loaded interactions: 2; 2 inbound; 0 outbound
First loaded interaction: 2022-02-21T13:39:54.000Z
Latest loaded interaction: 2022-03-25T08:35:53.000Z
Assets in loaded flows: USDT

0x4E9964…47B54CMemoir deterministic relationship summary · Mar 23, 2022, 11:06 AM UTC

Counterparty address: 0x4E9964…47B54C
Chains: Ethereum
Roles: source
Loaded interactions: 2; 2 inbound; 0 outbound
First loaded interaction: 2022-03-12T08:31:01.000Z
Latest loaded interaction: 2022-03-23T11:06:07.000Z
Assets in loaded flows: USDT

0xb063FB…A61d85Memoir deterministic relationship summary · Jan 22, 2025, 12:01 PM UTC

Counterparty address: 0xb063FB…A61d85
Chains: Base
Roles: source
Loaded interactions: 1; 1 inbound; 0 outbound
First loaded interaction: 2025-01-22T12:01:59.000Z
Latest loaded interaction: 2025-01-22T12:01:59.000Z
Assets in loaded flows: NLRA

0x5fc4b6…7f219eMemoir deterministic relationship summary · Apr 5, 2022, 2:16 PM UTC

Counterparty address: 0x5fc4b6…7f219e
Chains: Ethereum
Roles: source
Loaded interactions: 1; 1 inbound; 0 outbound
First loaded interaction: 2022-04-05T14:16:08.000Z
Latest loaded interaction: 2022-04-05T14:16:08.000Z
Assets in loaded flows: USDT

Public intelligence

Signals captured with this report

Read-only · 11 signals

official designationcritical

TRM sanctions screening returned a sanctions match for this address.

security alertcritical

GoPlus marks this address as sanctioned.

security alertcritical

GoPlus marks this address as sanctioned.

official designationcritical

OpenSanctions’ consolidated sanctions dataset contains an exact CryptoWallet.publicKey match.

security alerthigh

GoPlus associates this address with blackmail activity.

security alerthigh

GoPlus associates this address with blackmail activity.

account factinfo

Ethereum public account data reports an externally owned account, with counters of 266 transactions and 214 token transfers. Its current indexed native balance is 0.00002 ETH.

account factinfo

Base public account data reports an externally owned account, with counters of 0 transactions and 1 token transfers. Its current indexed native balance is 0 ETH.

account factinfo

The earliest configured public-index observation is an external transaction on Ethereum at 2019-10-03T06:09:03.000Z.

behavioral indicatorinfo

Loaded activity spans 1,101 days; this describes the loaded index coverage, not continuous wallet use.

behavioral indicatorinfo

34 loaded records repeat the same method/counterparty pattern; automation is possible but not established.

7 intelligence limitations at analysis time

The bundled OpenSanctions snapshot was generated Aug 30, 2026 and is more than 72 hours old. Update it before relying on a clear result.
A clear result means only that this source returned no match at check time; it is not a safety guarantee.
Public labels and provider flags can be stale, incomplete, disputed, or attached to the wrong address.
Account type, balance, first-seen time, and activity counters are point-in-time public-index facts; indexing lag or unavailable counter channels can change them.
Current protocol-position signals cover the responding position sources only; missing signals are not evidence that the address has no DeFi position.
Behavioral metrics use 101 loaded records from 2015-07-30T15:26:13.000Z to 2026-09-05T01:34:09.589Z; unloaded activity can change them.
A behavioral indicator is not proof of fraud, ownership, identity, or intent.

Selected timeline events

Timeline events captured with this report

Read-only · 4 events

TXEV

Records

When	Event	Content
Jan 22, 2025, 12:01 PM UTC	log	Received 1 NLRA · ERC-20IN · Base · 0xb063FB…A61d85 · 0x5bbd6d…4952a2Base Blockscout token transfer ↗
Oct 28, 2023, 5:16 PM UTC	transaction	Received native asset · 0x9312de…5CD021IN · Ethereum · 0x9312de…5CD021 · 0x13ec2f…d4965aEthereum Blockscout transaction ↗
Oct 28, 2023, 4:37 PM UTC	transaction	Received native asset · 0x9312de…5CD021IN · Ethereum · 0x9312de…5CD021 · 0x7cf2a0…e7a6ddEthereum Blockscout transaction ↗
May 28, 2022, 10:43 AM UTC	transaction	Sent native asset · 0x71191C…929A5bOUT · Ethereum · 0x71191C…929A5b · 0xee0df1…b5e49bEthereum Blockscout transaction ↗

13 coverage limitations at analysis time

The primary cursor covers external transactions and token transfers. Internal transactions and contract logs are checked separately in bounded pages; offchain actions and unlinked addresses remain outside coverage.
Blockscout is queried live without a local Memoir database. Upstream indexing lag, availability, labels, and chain coverage therefore apply.
Ethereum canonical liquid-staking asset balances were unavailable because ethereum-rpc.publicnode.com remained unavailable after 1 attempt. Failed to fetch; indexed holdings remain independent and may still include stETH, wstETH, rETH or cbETH.
Ethereum native balance history is partial because 4 malformed public-index records were ignored.
Ethereum current protocol positions cover Morpho markets and vaults only; absence does not mean the address has no DeFi position.
Base current protocol positions cover Morpho markets and vaults only; absence does not mean the address has no DeFi position.
Ethereum current protocol positions cover Aave V3 markets only; absence does not mean the address has no DeFi position.
Base current protocol positions cover Aave V3 markets only; absence does not mean the address has no DeFi position.
Ethereum Compound III positions were unavailable because ethereum-rpc.publicnode.com remained unavailable after 1 attempt. Failed to fetch.
Base Compound III coverage is limited to the 5 Comet markets pinned to the official registry at f766f51583c2; newly deployed markets, staking and liquidity pools remain unknown.
Ethereum Compound V2 positions were unavailable because ethereum-rpc.publicnode.com remained unavailable after 1 attempt. Failed to fetch.
Compound V2 coverage is limited to markets returned by the official Ethereum Comptroller; forks, retired unlisted contracts and other networks remain unknown.
AI evidence scope: a designed subset of 4 timeline events from the newest natural activity episode, selected from 101 timeline events loaded in memory at capture time. The public index reports 481 total evidence; history outside the loaded snapshot was not supplied to the model.