US sanctions popular crypto mixer used by N. Korean hackers

N. Korea’s Lazarus Group exploited Tornado Cash to launder over $455 million from largest-ever crypto heist

(123rf)

The US Treasury Department on Monday sanctioned the popular cryptocurrency mixer Tornado Cash for alleged use by North Korea’s notorious hacker group and other actors to launder ill-gotten cryptocurrencies.

The Tornado Cash mixer platform has been exploited by malicious cyber actors to launder more than $7 billion worth of proceeds from cybercrimes since its establishment in 2019, the Treasury Department announced in a statement.

North Korea’s state-sponsored Lazarus Group was notably accused of using Tornado Cash to process over $455 million worth of cryptocurrencies stolen from Axie Infinity’s proprietary Ronin blockchain bridge in March.

The Lazarus Group was attributed by the US government to the theft of $625 million from Ronin Bridge, which is the largest known virtual currency heist to date.

The Lazarus Group -- which was blacklisted by the Treasury Department in 2019 -- sent much of its illegally obtained cryptocurrencies to Tornado Cash to launder them, according to the Treasury Department’s announcement on Monday.

Tornado Cash was subsequently used to launder more than $96 million of illegal funds that derived from the theft from California-based crypto firm Harmony on June 24, the department said without identifying a suspect.

But in June, London-based blockchain analytics firm Elliptic revealed that Lazarus Group was believed to be behind the $100 million cryptocurrency theft from Harmony’s blockchain bridge service, called Horizon Bridge.

The Treasury Department added that unidentified hackers also capitalized on Tornado Cash to launder at least $7.8 million worth of funds stolen from Nomad. Earlier this month, the US crypto firm Nomad said it was hit by $190 million mass theft.

Second designation

A cryptocurrency mixer is a software tool that pools and scrambles cryptocurrencies from thousands of addresses to obfuscate and conceal the flow of transactions.

The Ethereum-based Tornado Cash “indiscriminately facilitates anonymous transactions by obfuscating their origin, destination, and counterparties, with no attempt to determine their origin,” the Treasury Department pointed out in the statement.

The department underscored that decentralized, non-custodial crypto mixers are “commonly used by illicit actors to launder funds, especially those stolen during significant heists.”

Tornado Cash has become the second cryptocurrency mixing service blacklisted by the US Treasury Department for its association with North Korean hackers, following the designation of Blender.io in May.

The Treasury Department’s Office of Foreign Assets Control previously sanctioned virtual currency mixer Blender.io for being used by the Lazarus Group to launder over $20.5 million of illicit proceeds from the Ronin Bridge heist. 

Illegal funds sent to cryptocurrency mixers by cybercriminal groups associated with North Korea “have risen dramatically in 2021 and 2022,” the US Blockchain data platform Chainalysis said in mid-July in an online report. 　

Impactful step against crypto crime

The Treasury Department underlined that cryptocurrency mixers that assist criminals are a “threat to US national security,” pledging to continue its efforts to expose components of the cryptocurrency ecosystem that cybercriminals use to obfuscate the proceeds from illicit activities.

“Despite public assurances otherwise, Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors on a regular basis and without basic measures to address its risks,” Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian Nelson said in the statement.

“Treasury will continue to aggressively pursue actions against mixers that launder virtual currency for criminals and those who assist them.”

New York-headquartered Chainalysis underscored that Monday’s designation is an “impactful step against cryptocurrency-based crime” in an online report issued on the same day.

“For one thing, it’s especially timely: More cryptocurrency is being stolen than ever, and in almost every hack we’ve observed this year, Tornado Cash has received at least some of the stolen funds,” Chainalysis said.

The Treasury Department’s announcement also shows its commitment to staying vigilant and clamping down on advanced cryptocurrency platforms that are used for laundering ill-gotten cryptocurrencies.

Chainalysis underscored that cutting the popular cryptocurrency mixing service Tornado Cash off from compliant cryptocurrency businesses “represents a huge blow for criminals looking to cash out.” 

(dagyumji@heraldcorp.com)

By Ji Da-gyum(dagyumji@heraldcorp.com)