The US Department of the Treasury has announced sanctions against the virtual currency mixer Tornado Cash, which it claims has helped launder more than $455m for the Lazarus Group, a hacking organisation associated with the North Korean government.
The Treasury Department said in a statement Monday that Tornado Cash has been used to launder more than $7bn worth of virtual currency since it was started in 2019.
“Despite public assurances otherwise, Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors on a regular basis and without basic measures to address its risks,” said Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian E Nelson in the statement.
Today, Treasury sanctioned virtual currency mixer Tornado Cash, which has been used to launder more than $7 billion worth of virtual currency since its creation in 2019. Virtual currency mixers that assist criminals are a threat to U.S. national security. https://t.co/x8sCXsNzUv
— Treasury Department (@USTreasury) August 8, 2022
The US and South Korea have accused North Korea of using hackers to steal funds that can be used to finance its weapons programme, an accusation that North Korea denies. The sanctions prohibit Americans from using the mixer and freeze any of its US assets.
The Lazarus Group – a North Korean state-sponsored hacking group – is under US sanctions and has been responsible for several significant data breaches, including one against Sony Pictures in 2014. Such breaches can be financially or politically motivated.
A report from the blockchain analysis firm Chainalysis found that North Korea launched at least seven attacks on cryptocurrency platforms in 2021, successfully stealing nearly $400m in digital assets.
A United Nations panel that monitors sanctions on North Korea has accused Pyongyang of using stolen funds to support its nuclear and ballistic missile programmes to circumvent sanctions.
Tornado Cash was also used to launder $100m in stolen assets from a hack against the virtual currency firm Harmony, according to the Treasury. The department stated that it gave the mixer opportunities to crack down on such illicit activities, but that it failed to do so.
The Treasury noted that while most virtual currency is used for legitimate purposes, it can also be a tool for those hoping to avoid scrutiny and circumvent laws.
“While most virtual currency activity is licit, it can be used for illicit activity, including sanctions evasion through mixers, peer-to-peer exchangers, darknet markets, and exchanges,” said the statement.
The Treasury imposed sanctions on a currency mixer for the first time in May when it targeted Blender, a software tool that pools and scrambles cryptocurrencies from thousands of addresses.
Hacking has been a persistent issue for crypto platforms, and experts have said that Tornado Cash has played a role in such crimes.
“Tornado is a popular and important tool for cybercriminals and state-backed hacking groups,” Tom Robinson, co-founder of Elliptic, a cryptocurrency analytics firm, told the Reuters news agency. “In total, Elliptic’s analysis shows that at least $1.3bn in proceeds of crime such as ransomware, hacks and fraud have been laundered through Tornado Cash.”
The US Internal Revenue Service (IRS) has said that cryptocurrency and digital assets such as non-fungible tokens, also known as NFTs, have been the subject of “mountains and mountains of fraud”.
The IRS seized $3.5bn worth of cryptocurrencies tied to financial crimes during the 2021 fiscal year, and cryptocurrencies have been consistently criticised for their potential criminal use.
