Tornado Cash sanctioned by U.S. over North Korean hacking

The U.S. Treasury blacklisted cryptocurrency platform Tornado Cash for laundering hundreds of millions of dollars of virtual currency stolen by North Korean hackers.

U.S. Secretary of State Antony Blinken speaks in a meeting in South Africa Monday. The U.S. Department of State and Treasury Department announced new sanctions on virtual currency mixer Tornado Cash Monday. [REUTERS/YONHAP]

The U.S. Treasury blacklisted cryptocurrency platform Tornado Cash for laundering hundreds of millions of dollars of virtual currency stolen by North Korean hackers.

The Treasury Department's Office of Foreign Assets Control (OFAC) said in a statement Monday it sanctioned virtual currency mixer Tornado Cash, "which has been used to launder more than $7 billion worth of virtual currency since its creation in 2019."

This allegedly included $455 million stolen by the Lazarus Group, a North Korean-sponsored hacking group that was sanctioned by the United States since 2019, and described by the Treasury as the "largest known virtual currency heist to date."

Tornado Cash, a popular cryptocurrency service that operates on the Ethereum blockchain, allows users to mask their transactions and make the funds' origins and destinations harder to track.

"Today, Treasury is sanctioning Tornado Cash, a virtual currency mixer that launders the proceeds of cybercrimes, including those committed against victims in the United States," said Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian E. Nelson in a statement.

"Despite public assurances otherwise, Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors on a regular basis and without basic measures to address its risks."

He added that the U.S. Treasury will "continue to aggressively pursue actions against mixers that launder virtual currency for criminals and those who assist them."

Tornado Cash was also accused of being used to launder more than $96 million from the hacking of the California-based crypto company Harmony's Horizon blockchain bridge service in June and at least $7.8 million from the U.S. cryptocurrency firm Nomad earlier this month.

According to the Treasury, "while the purported purpose is to increase privacy, mixers like Tornado are commonly used by illicit actors to launder funds, especially those stolen during significant heists."

It added that Tornado's activities have contributed to a "significant threat to the national security, foreign policy, or economic health or financial stability of the United States."

Under the sanctions, Americans will be prohibited from making transactions using the service, and all its assets in the United States will be blocked.

U.S. Secretary of State Antony Blinken in a separate statement Monday said, "The United States is sanctioning virtual currency mixer Tornado Cash for its involvement in laundering a portion of the more than $600 million stolen by Democratic People's Republic of Korea (DPRK) hackers in one of the largest known virtual currency heists to date."

He said the hackers are associated with the Lazarus Group and APT38, or Advanced Persistent Threat 38, a North Korean-sponsored elite hacking group that often targets banks, which was also sanctioned by the United States in 2019.

Blinken added, "The United States will not hesitate to use its authorities against malicious cyber actors, to expose, disrupt, and promote accountability for perpetrators and enablers of criminal activities."

Washington has often accused North Korean hackers of laundering money to fund the Kim Jong-un regime's weapons of mass destruction program.

Lazarus is believed to be operated by the Reconnaissance General Bureau, Pyongyang's foreign intelligence agency, which is currently subject to both U.S. and United Nations sanctions.

In May, the Treasury imposed sanctions on another virtual currency mixer, Blender.io, also allegedly used by North Korean hackers to launder $20.5 million in illicit proceeds out of nearly $620 million stolen by the Lazarus Group from online game Axie Infinity in March.

Tornado Cash is now the second virtual currency mixer blacklisted by the Treasury for its association with North Korean hackers.

BY SARAH KIM [kim.sarah@joongang.co.kr]