US authorities allege cyber criminals have laundered billions of dollars through a crypto-mixing company, including a state-sponsored hacker group from North Korea. 

«Tornado Cash» a virtual currency mixer allegedly laundered more than $7 billion over the past three years and helped North Korean hackers evade US sanctions, has regularly been used by malicious actors in cyberspace since its inception in 2019, The US Treasury Department's Office of Foreign Assets Control (Ofac) said Monday in a statement.

«Despite public assurances otherwise, Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors on a regular basis and without basic measures to address its risks. Treasury will continue to aggressively pursue actions against mixers that launder virtual currency for criminals and those who assist them», said Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian E. Nelson.

North Korea Hack

The total includes the largest known virtual currency heist to date in which over $455 million was stolen in a hack carried out by the Lazarus Group, a North Korean state-sponsored hacking group that was sanctioned by the U.S. in 2019. Tornado Cash was also used to launder more than $96 million of malicious cyber actors’ funds during the Harmony Bridge Heist on June 24, and at least $7.8 million from the Nomad Heist last week. 

Tornado Cash operates on the Ethereum blockchain, indiscriminately facilitating anonymous transactions by obfuscating their origin, destination, and counter-parties, with no attempt to determine their origin. It receives a variety of transactions, mixing them before transmitting them to their recipients. While the stated purpose is to increase privacy, mixers are commonly used by illicit actors to launder funds, especially those stolen during significant heists, according to Ofac.

 Sanctions Against Blender.io

In May, Ofac imposed sanctions on Blender.io, another crypto-mixer service that allegedly helped Lazarus launder over $20 million in «illicit proceeds.»

The Lazarus Group first gained notoriety in connection with a cyberattack on Sony in 2014. and was sanctioned by the US in 2019.