Losing the Blacklisting Race

Defi

Losing The Blacklisting Race

DataFinnovation - ChainArgos - 4AC

15 min read·

Aug 8, 2026

--

web3 compliance leans heavily on the power to freeze and seize assets. This power is a requirement for stablecoins issued under GENIUS and MICA. Broadly speaking industry advocates support this approach.

Both Tether and Circle have long had the power to freeze their tokens. And this power is routinely referenced by blockchain analysis companies as a key tool in efforts to combat crime. Freezing is not a feature of Bitcoin. But Bitcoin compliance depends heavily on fast and reliable tracing so service providers can reject, rather than freeze, tainted funds. As we will see, there are fundamental problems with compliance schemes built atop both retrospective blacklisting and backward-looking tracing. And there are close connections between those problems which render them inseparably entangled in their ineffectiveness.

In recent research undertaken with collaborators, which will be presented at IEEE BCCA 2026 later this year, we look at the overall effectiveness of blacklisting-based compliance and conclude it is both ineffective in practice and straightforward to evade in theory. By ineffective we mean it fails to capture most of the funds which pass through blocked wallets. If the process fails to capture a meaningful fraction of a bad actor’s funds then it is not an effective disincentive for the bad actor.

We also provide a simple and straightforward model that explains why blacklisting is an ineffective strategy in permissionless environments. This model yields reliable blacklist evasion strategies. And we see, in the real world, behaviour consistent with those strategies. Our model looks to capture how real attackers behave when evading blacklisting efforts in real incidents. The approach is not just ineffective — it is a feeble defense strategy in general. It will not work.

The key finding of our paper is that “fixing” current blacklisting shortcomings is not something where incremental engineering work is likely to prove useful. The ineffectiveness of the current regime emerges as a consequence of the permissionlessness of the underlying payment networks. Unless the feature of being permissionless is addressed the problem will not go away. Our framework is general and assumes almost nothing about the tools involved. These results emerge from simple graph theory. Our contribution is in setting up a race between attackers and tracers and then analyzing that race with well-worn tools to get results which are consistent with data from real attacks.

This work has two components which we will work through in turn. First, we explore the empirical reality of OFAC’s blacklisting efforts. The results there are stark: nearly all addresses are completely empty by the time OFAC manages to blacklist them. This result is robust across time, attacker and type of attack. Second, we construct a simple model to explain why this outcome is inevitable with competent attackers. Evasion strategies which work in our model match those we find employed in the wild.

After covering those two results, we will discuss a few related issues in blockchain analysis. The high level summary is that the current compliance architecture of web3 is broken both in theory and in practice. And that things will not improve unless large scale changes are made. We view the statement that compliance is broken as an empirical observation not an opinion. The data clearly supports this position.

And our model captures what happens in the real world. As attackers continue to escape using these methods and industry advocates continue to push for methods that will inevitably lead to escape, it certainly looks as though the attackers are out thinking the industry. Recovering a marginal % of stolen assets is a positive outcome when viewed outright. But there are costs to those recovery efforts. And perhaps the greatest cost is that of encouraging more attacks by tipping your hand that ineffective defense mechanisms will be employed. More on this at the end.

The paper works through all addresses designated by OFAC over several years and groups them by entity. We are then able to compute the “depletion rate” for each entity: what fraction of the funds that entered the entity’s eventually-blocked addresses managed to escape. For almost all entities this rate is ~100%. As we identify over two dozen entities, we conclude near-total escape is not limited to a certain type of entity or incident or anything else.

We can rule out explanations like “only hackers escape” or “only state-sponsored entities escape” because we see almost everyone escape. Ineffectiveness is, empirically, the reality of current compliance efforts. This is an observation not an opinion. Our claim is not that these compliance efforts are completely useless — it is only that they are sufficiently useless as to be ineffective in practice. For example, a marginal chance of having some stolen funds frozen is not going to disincentivise professional hacking groups.

Nearly all the funds escape for nearly all the bad actors.

Once we establish that most of the funds escape, we design statistics to measure how they escape. The key measure — what will become a critical determinant of success in our later model — is the time gap between an incident occurring (i.e. an exploit or theft) and enforcement (i.e. funds being frozen). We find this gap is generally on the order of 10–20 days. Again this is pretty robust across incidents and entities. And a small spoiler alert: it turns out even compressing this to zero will not fix the problem.

Admittedly it is easier to measure this gap for hacks and thefts relative to, say, terrorism finance. There is usually a single incident we can measure against for theft while terrorism financing is clearly a broader net.

The key observation remains that attackers know when they attack. So this naturally sets up a race where the attacker has a head start. The paper works through the details of the Lazarus Group escaping with Ronin Network hack proceeds in 2022. We can easily see the hackers running ahead of waves of OFAC enforcement in exactly the way our model predicts rational hackers that understand enforcement will behave.

Funds are dispersed before enforcement can freeze them (or make it hard enough to move them that they are effectively stuck). These are just empirical facts. OFAC catches only fraction of the funds in eventually-frozen addresses and OFAC takes a few weeks to act. Again: observation not opinion.

Of course OFAC freezes can only impact freezeable tokens. Many tokens are not freezeable. And we find, unsurprisingly at this point, that when unfreezeable tokens are present at the time of blacklisting they get sent onwards in short order. So OFAC designation does not have a strong effect on the willingness of parties to accept funds from OFAC designated addresses at least within a short timeframe following designation. We find that timeframe is sufficient to dispose of all the assets, again demonstrating ineffectiveness.

And “strong effect” is perhaps overstating the case. There is not really any observable effect. OFAC sanctions impose mostly-useless freezes and do not impact the ability of sanctioned entities to rapidly dispose of their non-freezeable assets. Blocking an empty address is useless as it does not impose any pain on the sanctioned actor. Creating addresses is cheap, fast and easy. Taking away access to one empty address achieves nothing. To a large extent these sanctions are make-work with no real impact. Whatever signalling value there is must be weighed against the appearance of using sanctions machinery to shut down empty accounts.

This is not a great situation. And many people reading this probably have ideas about how to improve things. Great. Hold those thoughts.

What we are going to do next is outline a simple model which explains not only why funds escape but also why trying to fix this with marginal changes is likely to be a waste of time.

Some incident occurs at time 0. This is identified at time I. For our blockchain assume address creation happens at rate K and transactions like transfers and blacklisting events proceed at rate C, the network’s capacity.

Now we set up a race. Critically the bad entity — the thing that is going to get sanctioned — knows about the incident immediately while the authorities find out with some lag. That lag is I. During I units of time the attacker can send funds to min(KI, CI) fresh addresses. For a permissionless network K is infinite. There is no consensus process approving new wallets in networks like Bitcoin and Ethereum. The attacker can prepare as many addresses as they like. Bandwidth is the only constraint.

So the attacker gets to spread their funds out across CI addresses by the time authorities identify the incident.

The paper has full details but intuitively once KI is a lot larger than C, an attacker can escape with most, or all, of the funds. This is so simply because they can continue dispersing funds, and finding off-ramps, from a number of addresses that will take the authorities time to block even if the attacker stood still. Because these networks run 24/7 and there are bandwidth limits attackers are able to convert a head start into a near-guaranteed escape.

Perhaps at this point you are thinking this is fine because intermediaries are supposed to block the off-ramping of these funds. We also consider this problem. Put yourself in the position of a service provider trying to assess a fresh deposit. You need to run some kind of blockchain tracing process to figure out if that deposit comes from a known-bad source.

Here we need just a touch of computer science. Again the paper has full details. What matters is that a simple obfuscation strategy can ensure tracing requires time quadratic in the number of addresses the attacker controls. And the attacker can continue to linearly increase their address count. The difference in vocabulary there probably makes the problem clear.

Say your platform only had D units of time to decide whether to accept the funds. What you want to think of here are not manual, human-operated off-chain systems. Those can just hold funds indefinitely and ask for documentation. Think of some kind of protocol that uses some kind of proofs or screening tech or something else to make decisions automatically. If your “DeFi” tool can hold funds indefinitely until a human releases them you do not have DeFi. Anything that is going to look at all like DeFi needs to make a decision within D units of time where D is known in advance. Indefinite holds pending human action are not DeFi even according to industry advocates.

In the paper we derive the condition among these parameters under which an attacker can overwhelm the tracing process. We find under realistic scenarios using the parameters fit above that platforms are not going to be able to run their screening. This escape condition is proportional to D/C. If the attacker can avoid detection for an amount of time proportional to that ratio they can overwhelm the capacity of a tracing system to reliably vet their funds.

When you step back this is not shocking. Tracing is harder than transacting. We mean this in a literal, mathematical, sense: the complexity of funds tracing in dense transaction graphs is higher than that of executing transactions to obfuscate those flows of funds. This is a result in graph theory and has nothing to do with blockchains or finance or compliance. Attackers familiar with basic graph theory can design evasion strategies to exhaust the computational resources of anyone chasing them down when the two groups are in a race.

If you give an attacker weeks to prepare addresses for evasion and then expect a DeFi protocol to trace backwards and make a decision in minutes or hours: that is not fair to the protocol. It is going to lose