OFAC Sanctions Network Involved in China-based Manufacturing of Fentanyl and Other Drugs, Highlights Related Cryptocurrency Addresses

On October 3, 2023, the U.S. Treasury’s Office of Foreign Assets Control (OFAC) brought sanctions against several individuals and companies involved in the manufacturing and distribution of fentanyl, other drugs, and associated precursor chemicals. The sanctioned entities make up a drug trafficking network centered primarily in China, but also include one Canadian national and two Canadian businesses under that individual’s ownership. OFAC also identified cryptocurrency addresses for several of the entities sanctioned in this action. Those entities are:

• Shen Xianbiao, part owner of China-based Jinhu Minsheng Pharmaceutical Machinery
• Wang Jiantong, part owner of China-based Jiangsu Bangdeya New Material Technology
• Xia Fengbing, controller of cryptocurrency addresses used to receive payment on behalf of Jiangsu Bangdeya New Material Technology
• Zhang Wei, CEO of China-based Hebei Crovell Biotech
• Wang Mingming, an employee of China-based Hebei Guanlang Biotechnology
• Valerian Labs, a Canada-based chemical manufacturing company owned by Canadian national Bahman Djebelibak, who was also sanctioned.

Several of the individuals and businesses sanctioned were also indicted by the Department of Justice (DOJ), following an investigation involving several U.S. law enforcement agencies. 

These sanctions and indictments represent an important step in the fight against drug trafficking, and in particular its intersection with cryptocurrency. As we’ve covered in previous research, crypto-based sales of fentanyl and its precursor chemicals from labs based primarily in China are on the rise. The opioid crisis has taken a huge toll on U.S. citizens, and these sanctions designations reflect law enforcement agencies’ dedication toward battling this issue. Below, we’ll explore in greater detail the crypto activity of the participants of this now-sanctioned network.

Cryptocurrency activity of sanctioned China-based drug manufacturers and traffickers 

The cryptocurrency addresses associated with individuals and companies designated by OFAC in this round of sanctions span the Bitcoin, Ethereum, and Tron blockchains. Addresses on the latter two blockchains primarily received stablecoins supported by those blockchains, such as USDT and USDC. With the exception of addresses controlled by Valerian Labs, all of the addresses were hosted at one mainstream exchange, which we refer to here as Core Exchange. Those addresses received funds from both personal wallets and mainstream exchanges — more specifically, they received funds primarily from six other mainstream exchanges, as we see on the Chainalysis Reactor graph below

Each of the five individuals referenced above received hundreds of thousands of dollars’ worth of cryptocurrency each to their respective deposit addresses at Core Exchange. The individuals reached those totals not through a few large transactions, but through many smaller transactions in consistent amounts, an indication of the sale of specific goods — in this case, fentanyl and associated precursor chemicals. We can see this on the screenshot below, which shows a subset of the transactions between the deposit addresses shown above and various personal wallets. Valerian Labs’ sanctioned addresses are also included — while Valerian was less active than the others, its incoming transactions follow a similar pattern.

In each case, the personal wallets sent to the sanctioned addresses just once, and almost always within a small range. For instance, most transactions to Shen Xingbiao’s deposit addresses from personal wallets fall between $5,000 and $5,500 worth of crypto.  

These addresses also received significant funds from darknet markets, which may represent vendors on those markets purchasing drugs (or precursor chemicals) from the labs to then sell. We can see examples of this activity on the Reactor graph below.

Several of the most prominent darknet markets currently operating sent significant funds to some of the addresses identified in this round of sanctions, including Mega Market, OMG!OMG! Market, and Blacksprut. In all cases, those funds were first sent to intermediary wallets prior to reaching the sanctioned entities. 

Valerian Labs also displays interesting off-chain activity. Check out the screenshots from its website below.

The first screenshot shows Valerian’s cryptocurrency payment page, which directs users to send crypto to the addresses included in OFAC’s designation of the company. The second screenshot shows some of the products Valerian had for sale, including methylamine hydrochloride, a precursor chemical that can be used to make drugs like methamphetamine and MDMA. OFAC cites Valerian as having received shipments of this controlled substance in its press release. 

Moving back to the on-chain world, if we look at the aggregate activity of all the addresses associated with sanctioned entities within this drug trafficking network, we see the use of Tron in addition to Bitcoin.

While previous fentanyl-related sanctions on crypto-using entities have centered on Bitcoin, this is the first to include Tron addresses.

Cryptocurrency addresses associated with sanctioned China-based drug trafficking network 

Below, we’ll list the addresses included as identifiers on the OFAC SDN List entries for individuals and companies sanctioned as part of this action.

Cryptocurrency addresses associated with Shen Xianbiao

• 3B7S6zrgxQVQUHTU8wstM23tB9afE7ojuX (BTC)
• 0x530a64c0ce595026a4a556b703644228179e2d57 (ETH, USDT-ETH, USDC)
• TEAqwfMhXLaomXhZ8KeMhx3njGmQEDnsUR (TRX, USDT-TRX)

Cryptocurrency addresses associated with Wang Jiantong

• 3NNcbBcMZokPB2JC2dxYuZrpgcetvyGeJn (BTC)
• TMStbg5fgb4uTV7fK1gEYF9hKAzP3siPsG (TRX, USDT-TRX)

Cryptocurrency addresses associated with Xia Fengbing

• 38TftW1heYPqvKbiAhT4ttNBqkUPpooXad (BTC)
• bc1qkfqh5p2qsakseg5gnwen6zh5xf3elmku2xaup29mw3l0wnncy3es880dss (BTC)
• TTKnV2S1295UrPr7N67Tp9ykNL7xX2Z4Uj (TRX, USDT-TRX)

Cryptocurrency addresses associated with Zhang Wei

• TRBACioxdrdsYEZHvJWiUDZcMdBPpEe5Ub (TRX, USDT-TRX)
• 3NU9zkD8CCVGVmYnNNSN7PbU9sSFQBm5UV (BTC)
• 0x961c5be54a2ffc17cf4cb021d863c42dacd47fc1 (ETH, USDT-ETH)

Cryptocurrency addresses associated with Wang Mingming

• 1MLPqwaFFUBZePTjpR3nxRoK19Cv9mPCc7 (BTC)
• 3HePkztPU6UsdENxnyQHFrdZA6eVKeMtvz (BTC)
• TUCsTq7TofTCJRRoHk6RvhMoS2mJLm5Yzq (TRX, USDT-TRX)
• 0xfac583c0cf07ea434052c49115a4682172ab6b4f (ETH, USDT-ETH)

Cryptocurrency addresses associated with Valerian Labs

• bc1qardcxz845jw83vgfvcmewhuxa0ag9gchjwmcfd (BTC)
• 0x983a81ca6FB1e441266D2FbcB7D8E530AC2E05A2 (ETH, USDT-ETH)

Cryptocurrency’s intersection with fentanyl and other drugs is an ongoing problem

The sanctions against the individuals and businesses associated with this criminal network are an important step in preventing the abuse of cryptocurrency by drug traffickers, as well as a reminder of the depth of the problem. The addresses identified by OFAC as part of this action collectively received just under $3.8 million worth of cryptocurrency, representing huge quantities of drugs potentially trafficked into the United States and other countries. Chainalysis will continue to support our customers in the public and private sectors as they combat this activity, and we plan to share more research on crypto-based drug trafficking in the near future.

This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.