US Treasury Seizes $350K in Crypto from Aeza’s Bulletproof Hosting Network—Here’s Why It Matters

Crypto meets crackdown: The US Treasury just froze $350,000 tied to Aeza’s alleged bulletproof-hosting empire. No more shadows—feds are turning up the heat on dark-web infrastructure.

Behind the freeze: Bulletproof hosts often shield cybercriminals with 'anonymous' servers. Aeza’s wallet seizure signals a new front in the war on crypto-facilitated crime.

Finance world shrugs: Meanwhile, Wall Street still can’t decide if crypto is the future or a glorified Ponzi scheme. Some things never change.

US Treasury Freezes Aeza Crypto Wallet Used to Obfuscate and Move Funds

Bulletproof hosting refers to internet hosting services that provide infrastructure to cybercriminals, offering servers designed to evade detection and resist takedown efforts.

These services are commonly used by ransomware groups, data thieves, and online drug vendors to carry out and hide illegal operations from law enforcement.

According to Acting Under Secretary of the Treasury for Terrorism and Financial Intelligence Bradley T. Smith, “Cybercriminals continue to rely heavily on BPH service providers like Aeza Group to facilitate disruptive ransomware attacks, steal U.S. technology, and sell black-market drugs.”

The Treasury Department further alleges that the platform enabled attacks on U.S. defense and tech firms and aided the Russian darknet drug market BlackSprut.

Today, OFAC sanctioned Aeza Group for providing bulletproof hosting to cybercriminals conducting ransomware attacks. The designation included 1 crypto address, which Aeza Group used for payments. Read our blog to learn more: https://t.co/fyUHVNZAEp

As part of the sanction, OFAC froze a TRON-based cryptocurrency wallet used by Aeza Group in which Chainalysis revealed to have functioned as a hub for collecting payments, cashing out funds through various exchanges, and occasionally receiving direct customer payments.

The on-chain analysis linked the wallet to over $350,000 in cryptocurrency, with some transactions traced to darknet vendors and malware distributors.

OFAC Efforts to Disrupt Cybercrime Infrastructure

The Treasury’s latest action indicates its continued effort toward dismantling the infrastructure that supports cybercrime, rather than solely pursuing individual hackers after the fact.

“Treasury remains committed to dismantling this ecosystem in close coordination with international partners,” said Bradley T. Smith.

Notably, the OFAC carried out a similar MOVE in February 2025, when it sanctioned ZServers, a known bulletproof hosting provider used by cybercriminals to evade law enforcement.

Also, OFAC sanctions on Aeza Group are not the first time the department has clamped down on Russia-linked crime. On June 12, 2024, OFAC imposed sanctions targeting Russia’s war economy, including restrictions on access to U.S. software and IT services.

The sanction also includes secondary sanctions on foreign firms, particularly Chinese semiconductor suppliers supporting Moscow.

OFAC also sanctioned Russian national Andrey Dmitriyevich Sudakov for allegedly laundering cryptocurrency from Gold sales via front companies in the UAE and Hong Kong.

OFAC has imposed economic sanctions against a Russian national for alleged money laundering through cryptocurrency. What will happen next?#OFAC #Cryptocurrencyhttps://t.co/QuCuGB0LDN

Another notable sanction to curb illicit trades includes OFAC-sanctioned Iranian national Behrouz Parsarad, administrator of the dismantled darknet marketplace Nemesis.

OFAC sanctions Behrouz Parsarad, the Iranian administrator of Nemesis darknet marketplace, targeting 49 cryptocurrency addresses linked to illicit activities.#OFAC #Darknethttps://t.co/2zMpF3Nhh9

The marketplace facilitated $30 million in illegal drug sales, including fentanyl. Parsarad allegedly tried to revive the platform after its March 2024 takedown.

Notably, the sanctions target his crypto infrastructure, including 44 Bitcoin and five Monero addresses.