OFAC added six Ethereum wallet addresses to its Specially Designated Nationals (SDN) list as part of the action, marking one of the most detailed on-chain enforcement moves against cartel financial infrastructure to date. Five of the wallets belong to network head Armando de Jesus Ojeda Aviles. The sixth is attributed to associate Liliana Orozco Romero. One of the flagged addresses processed an $894 USDT transaction as recently as April 27, 2026, less than four weeks before the designation.

The action was taken under three legal authorities: the Foreign Narcotics Kingpin Designation Act, Executive Order 14059 on illicit drug proliferation, and Executive Order 13224 on counterterrorism. The invocation of EO 13224 was made possible by the Sinaloa Cartel's formal designation as a Foreign Terrorist Organization (FTO) and Specially Designated Global Terrorist (SDGT) in early 2025, a classification that represents a significant escalation in how the US government legally pursues cartel financial networks.

Treasury Secretary Scott Bessent said in the official statement: "Treasury will continue to target terrorist cartels and their fentanyl trafficking networks to protect our communities."

---

Two Networks, One Enforcement Action

The May 20 action covered two separate but related structures. The first, led by Ojeda Aviles, served the cartel's Los Chapitos faction. According to the Treasury press release, Jesus Alonso Aispuro Felix served as the chief money broker, while Rodrigo Alarcon Palomares physically collected cash in the United States. Alarcon Palomares was indicted in Colorado in April 2024 on three counts related to crypto-based drug laundering. Two front businesses were also designated: Grupo Especial Mamba Negra S. de R.L. De C.V., a Mexican security company, and Gorditas Chiwas, a restaurant in Chihuahua.

The second network is led by Jesus Gonzalez Penuelas, a fugitive who has carried a $5 million DEA reward since January 2024. He was originally indicted in 2017 and 2018 for trafficking methamphetamine, heroin, cocaine, and fentanyl stretching back to at least 2007. The DEA and Homeland Security Task Force coordinated both parts of the action.

In 2025, the DEA seized more than $10 million in crypto assets from Sinaloa Cartel operations broadly, an enforcement escalation that preceded the formal designations.

---

How the Pipeline Works

Based on Chainalysis Reactor analysis, the laundering followed a five-stage process. Operatives first collect physical US dollar proceeds from street-level fentanyl sales. Those funds are then converted into stablecoins, primarily USDT (Tether), through unlicensed money brokers. The wallets then swap between stablecoins using decentralized exchanges (DEXs, which are trading protocols that operate without a central intermediary) to layer and obscure the transaction trail. From there, funds move to centralized exchanges for potential cash-out, and finally settle with cartel-aligned brokers in Mexico who convert to pesos.

Ojeda Aviles holding five separate wallets is itself a technique: spreading funds across multiple addresses, sometimes referred to as wallet fragmentation, is a standard method for making transaction tracing harder. TRM Labs noted that across broader cartel crypto operations, roughly 60 percent of flows use Bitcoin, 30 percent use USDT on the TRON blockchain, and 6 percent use USDT on Ethereum. This action specifically targets the Ethereum layer.

Chainalysis's 2026 crypto crime report found that sanctioned entities received 694 percent more crypto in 2025 than the year prior, and that more than half of all OFAC-designated crypto addresses that year were tied to the illicit drug market. Total illicit crypto received globally in 2025 reached $154 billion, up 162 percent year over year.

---

Regional Compliance Implications

The action carries direct weight outside US borders. On May 21, 2026, one day after the OFAC announcement, Indian authorities in Gujarat broke up a separate crypto network valued at approximately 226 crore rupees (around $27 million). That network used Monero for anonymity, converted proceeds into USDT, and according to Indian investigative reporting, allegedly had links to Hamas, Yemen's Houthis, and Iran's IRGC-Quds Force. One wallet had previously been frozen by Israel's counter-terror financing bureau. Investigators logged 935 complaints against accounts connected to Binance P2P, raising urgent questions about whether peer-to-peer fiat-to-crypto trading rails in South Asia have adequate screening for sanctioned counterparties. India's Financial Intelligence Unit has been tightening enforcement of the Prevention of Money Laundering Act against offshore platforms, adding direct regulatory pressure to that P2P screening urgency.

In South Africa, regulators are preparing to bring crypto assets under the country's Exchange Control Regulations of 1961, which would require South African Reserve Bank approval for cross-border crypto transfers. Exchanges serving South African users, including VALR and Luno, now face added complexity: all six newly designated wallets are on Ethereum mainnet, meaning any DeFi protocol, wallet application, or exchange that interacts with those addresses risks an OFAC violation in many cases, regardless of where it is incorporated.

---

What Comes Next

Ojeda Aviles took over the cartel's money laundering operation from Mario Alberto Jimenez Castro, who was himself sanctioned by OFAC in September 2023 for the same crypto laundering role. The continuity across designations points to a cell structure that absorbs enforcement actions and rebuilds quickly.

The Sinaloa Cartel's FTO and SDGT designations in early 2025 marked a qualitative shift in how the US government classifies and pursues cartel financial networks. Any business with even indirect cartel exposure now faces potential counterterrorism-tier legal liability under EO 13224, a threshold that did not exist before 2025.

FATF's February 2026 plenary expanded its grey list to 23 jurisdictions, most of them in the developing world. With more than 75 percent of jurisdictions still only partially compliant with FATF's anti-money laundering rules for virtual assets, and OFAC penalties on crypto firms reaching $430 million in 2024, the window for exchanges and DeFi protocols to delay SDN screening is narrowing fast. Tether's cumulative freeze total has reached $2.8 billion across more than 4,500 wallets, including $344 million frozen in a single April 2026 operation known as Operation Economic Fury, signaling that stablecoin issuers are accelerating compliance alongside regulators. Compliance teams and developers can use on-chain screening tools such as Chainalysis Reactor and TRM Labs to identify exposure to SDN-listed addresses before transactions clear.