Sanctions Evasion Reference

ShapeShift: 17,183 exchanges with users in sanctioned countries

A Swiss-incorporated, Denver-run crypto exchange paid OFAC $750,000 in 2025 for exchanging $12.6m of digital assets with users in Cuba, Iran, Sudan and Syria, having collected IP addresses but never screened them.

period

2016–2025

outcome

Settlement

parties

ShapeShift AG

programmes

Islamic Republic of Iran, Cuba, Syrian Arab Republic, Sudan

reviewed

2026-09-20

Cite this page
APA 7 
Sanctions Evasion Reference. (2026, September 20). ShapeShift: 17,183 exchanges with users in sanctioned countries. https://sanctionsevasion.org/cases/shapeshift-exchange-2025/
Chicago 
Sanctions Evasion Reference. “ShapeShift: 17,183 exchanges with users in sanctioned countries.” Last reviewed September 20, 2026. https://sanctionsevasion.org/cases/shapeshift-exchange-2025/.
BibTeX 
@misc{ser-cases-shapeshift-exchange-2025,
  author = {{Sanctions Evasion Reference}},
  title  = {ShapeShift: 17,183 exchanges with users in sanctioned countries},
  year   = {2026},
  note   = {Last reviewed 2026-09-20},
  url    = {https://sanctionsevasion.org/cases/shapeshift-exchange-2025/}
}

The date is when this page was last reviewed, not when it was first published.

Penalties imposed

AuthorityDate AmountNote
OFAC 2025-09-22 $750,000 17,183 exchanges worth $12,570,956 between December 2016 and October 2018; non-egregious, not voluntarily self-disclosed. Base penalty $39,515,000; reduced because the company is defunct with limited assets.

A case in the same family as Bittrex: the data that would have identified the problem was in hand, and nobody looked at it.

What happened

ShapeShift ran a platform on which users swapped one digital asset for another, with ShapeShift as the sole counterparty. At its peak it handled as many as 20,000 transactions a day across at least 79 assets. OFAC says that although the company was incorporated in Switzerland, its main officers, its engineers and its senior leadership were US persons working from Denver.

It had no sanctions compliance programme during the period. Between December 2016 and October 2018 it carried out 17,183 exchanges, worth $12,570,956, with users in Cuba, Iran, Sudan and Syria: 39 apparent violations of the Cuba regulations, 16,839 of the Iran regulations, 33 of the Sudan regulations and 272 of the Syria regulations. OFAC says the company held at least some IP address information the whole time and admitted that IP addresses were “the only available indicator” of a user’s location it collected. It adopted a compliance programme, with SDN screening and IP-based blocking, only after receiving an administrative subpoena from OFAC.

The penalty

Non-egregious and not voluntarily self-disclosed, so the base was the schedule amount, $39,515,000. The settlement was $750,000, which OFAC says reflects that ShapeShift is defunct and has limited assets, having stopped operating in 2021. OFAC also noted that some of the sanctions it enforced have since been revoked, and that revocation does not affect enforcement for earlier conduct.

What the record shows

  • Location data was collected and unused. The exchange had the only signal it was ever going to have, and did not act on it.
  • Incorporation abroad did not matter. OFAC’s basis was that the people running the company were in the United States.

See crypto rails.

Techniques this case demonstrates

Programmes and jurisdictions in this case

  • Iran sanctions — A layered set of US, EU and UN measures dating from 1979 and substantially rebuilt after 2018, covering energy, finance, shipping, and proliferation-related procurement.
  • Cuba sanctions — The oldest US embargo still administered by OFAC: the Cuban Assets Control Regulations of 1963, layered with later statutes, that prohibit most transactions involving Cuba or its nationals unless licensed.
  • Syria sanctions — US, EU and UK measures restricting dealings with the Syrian government, its energy sector and designated parties, with substantial humanitarian carve-outs.
  • Sudan sanctions — A US embargo regime from 1997, revoked in 2017 and followed by targeted measures. Its main relevance here is historical: several of the largest penalties in OFAC's record concern conduct from the years it was in force.

Enforcement documents and sources

  1. Enforcement release: ShapeShift AG Settles with OFAC for $750,000. U.S. Department of the Treasury, Office of Foreign Assets Control, 2025. Enforcement release, 2025-09-22, US$750,000.
  2. Economic Sanctions Enforcement Guidelines, Appendix A to 31 CFR Part 501. U.S. Department of the Treasury, Office of Foreign Assets Control, 2026. Sections I (definitions), II (responses), III (general factors), V.B (penalty calculation).

All enforcement cases