Sinaloa Cartel sanctions: $4.4 million of the listed wallets’ money went into Binance, and three of the six are Binance deposit addresses

Treasury’s Office of Foreign Assets Control designated more than a dozen people and companies on 20 May 2026, in two networks linked to the Sinaloa Cartel. One of them, Treasury says, is led by Armando de Jesus Ojeda Aviles and launders the proceeds of fentanyl and other drug sales by turning cash into cryptocurrency. Five Ethereum addresses were listed under his name and one under a second designated person. The action was coordinated with Mexico’s financial intelligence unit.

Treasury published the addresses and nothing about what moved through them. Below is what the chain shows, read by us on 13 October 2026. We counted only real USDT and USDC, by token contract.

Two of the five addresses are wallets someone operated by hand. 0x14779CEC0B117d5194c750C55Ea1f42086631964 and 0x32dA24Ca413F3E7B53145D4737e172C3bdF81e3e received $852,000 in USDC withdrawn from Coinbase between December 2022 and May 2023, swapped it for USDT on Uniswap, usually within three to five minutes, and passed the USDT to the other listed addresses. In total $966,000 of USDC was swapped this way.

The other three do one thing. 0x038989cBB1710C72b9920Dc4Fa529158f463e72c received $1.10 million between November 2022 and January 2023, including $317,000 withdrawn from Kraken, $102,000 from Coinbase and $10,000 from Bitso. 0x4F428c11Dc82388fa5136D636e613ad923Eb700B received $1.70 million between March and November 2023 from 23 senders we cannot name. 0xF2235D55b2950a0B1317469d72d07Ae65b2e27CB received $1.59 million between August 2024 and March 2025 from 17 more. Every dollar of that left for the same place.

All three sent their entire balance to 0x28C6c06298d514Db089934071355E5743bf21d60, a hot wallet of Binance, and to nothing else: 16, 40 and 74 transfers, with a median wait of 8, 15 and 5 minutes after the money arrived. A customer cannot pay into an exchange’s hot wallet. Only the exchange moves funds there, when it collects deposits. So these three are deposit addresses of Binance accounts, not wallets the network held keys to.

That changes what the listing does. Freezing or blocking a deposit address stops nothing by itself: the money is already inside the exchange, credited to an account. What matters is the account, and only Binance can see whose it is and where the money went next. Together the three took in $4,388,738.

It also shows the route. Cash became USDC at Coinbase and Kraken, the USDC became USDT on a decentralised exchange, and the USDT went into Binance.

The address listed under the second person, 0xaC4cC4B68ea24BbFAAC8fD127B67Ed445ACcCE22, moved $27,966 in USDC between December 2022 and August 2023. Almost all of it came from a Coinbase wallet and went back to one.

The last deposit into any of the six was on 14 March 2025. The designation came on 20 May 2026, fourteen months later. One small remainder was swept into Binance on 27 April 2026, three weeks before the listing. When the addresses were published, all six were empty.

Nothing had to be marked. All six addresses were already in our database as sanctioned on the day they were listed, taken from the OFAC list itself. We did not mark the 46 unnamed senders: sending money to a listed address is not proof of anything, and some of them are exchange customers.

To check an address yourself, use the address check or the sanctions check.

It does not say that Binance, Coinbase, Kraken, Bitso or Uniswap did anything unlawful, or that they knew whose money this was; the designation came long after the transfers. It does not say who owns the 46 sending addresses. The description of the network is Treasury’s. The reading of the six addresses, the amounts and the conclusion about the deposit addresses are ours, as of 13 October 2026.