U.S. Sanctions Virtual Currency Mixer Tornado Cash for Alleged Use in Laundering

The U.S. Treasury Department on Monday placed sanctions against
crypto mixing service Tornado Cash, citing its use by the North
Korea-backed Lazarus Group in the high-profile hacks of Ethereum
bridges to launder and cash out the ill-gotten money.

Tornado Cash, which allows users to move cryptocurrency assets
between accounts by obfuscating their origin and destination, is
estimated to have been used to launder more than $7.6 billion worth
of virtual assets since its creation in 2019, the department
said.

Thefts, hacks, and fraud account for $1.54 billion of the total
assets sent through the mixer, according to blockchain analytics
firm Elliptic^[1].

Crypto mixing is akin to shuffling digital currencies through a
black box, blending a certain quantity of digital funds in private
pools before transferring it to its designated receivers for a fee.
The aim is to make transactions anonymous and difficult to
trace.

“Despite public assurances otherwise, Tornado Cash has
repeatedly failed to impose effective controls designed to stop it
from laundering funds for malicious cyber actors on a regular basis
and without basic measures to address its risks,” Brian E. Nelson,
under secretary of the Treasury for terrorism and financial
intelligence, said^[2].

The development comes as North Korea’s Lazarus Group (aka Hidden
Cobra) has been linked to the use of the decentralized crypto mixer
to funnel the proceeds from a string of major hacks targeting
virtual currency services, including that of Axie Infinity^[3]
and Harmony Horizon Bridge^[4]
in recent months.

The theft of $624 million worth of Ethereum from Axie Infinity’s
Ronin network bridge is the largest known
cryptocurrency heist^[5]
to date, with the $190 million hack of Nomad Bridge^[6]
last week taking the fifth spot. The Horizon Bridge theft hack
comes in at 11.

Specifically, the Treasury Department pointed to Tornado Cash’s
role in laundering over $455 million and $96 million worth of
cryptocurrency stolen from the two heists. It has also been
implicated for facilitating the theft of at least $7.8 million
following the attack on Nomad Bridge.

“Tornado receives a variety of transactions and mixes them
together before transmitting them to their individual recipients,”
the agency said. “While the purported purpose is to increase
privacy, mixers like Tornado are commonly used by illicit actors to
launder funds, especially those stolen during significant
heists.”

Also sanctioned^[7]
by the department are 38 Ethereum-based addresses holding Ether
(ETH) and USD Coin (USDC) that are linked to it, effectively
prohibiting U.S. entities from transacting with these wallets.

“As a smart contract-based mixer, Tornado Cash is one of the
most advanced methods available for laundering ill-gotten
cryptocurrency, and cutting it off from compliant cryptocurrency
businesses represents a huge blow for criminals looking to cash
out,” Chainalysis said^[8].

The move makes Tornado Cash the second cryptocurrency mixer to
be blocklisted by the Office of Foreign Assets Control (OFAC)
following the designation of Blender.io^[9]
in May 2022, also for its part in laundering illicit funds siphoned
by the Lazarus Group and cybercrime cartels like TrickBot, Conti,
Ryuk, and Gandcrab.

It’s also the latest escalation in a series of enforcement
actions aimed at tackling cryptocurrency-based crime, in the wake
of similar sanctions imposed by the Treasury on virtual currency
exchanges SUEX, CHATEX, and Garantex^[10] over the past year.

“Tornado Cash community tries its best to make sure it can be
used by good actors by providing compliance tools for example,”
Roman Semenov, one of the co-founders of Tornado Cash, said^[11] in a tweet.
“Unfortunately it’s technically impossible to block anyone from
using the smart contract on the blockchain.”

The sanctions seem to be having further repercussions, what with
Semenov’s GitHub account suspended in the aftermath of the
announcement. “Is writing an (sic) open source code illegal now?,”
he tweeted^[12].