Flow

Tornado Cash

Security

Tornado

North Korea’s Lazarus Group has resumed using Tornado Cash to launder funds stolen from hacks, despite sanctions against the crypto mixer.&nbsp;
According to on-chain activity <a href="https://www.elliptic.co/blog/north-korean-hackers-return-to-tornado-cash-despite-sanctionshttps://www.elliptic.co/blog/north-korean-hackers-return-to-tornado-cash-despite-sanctions" target="_blank" rel="noopener nofollow">flagged</a> by analytics firm Elliptic, hackers from Lazarus Group have transferred cryptocurrency worth $12 million to Tornado’s wallets since March 13. The funds were stolen in November from the crypto exchange HTX and its cross-chain bridge HTX Eco Chain, or HECO. 
Hot wallets on the HTX exchange were<a href="https://cointelegraph.com/news/htx-exchange-loses-14-million-hot-wallet-hack"> drained for $30 million</a> during an attack on Nov. 22, while the HECO Chain<a href="https://cointelegraph.com/news/heco-chain-bridge-hack-86-million-lost"> was hacked for $86.6 million</a> on the same day. The funds were swapped to Ether (<a href="https://cointelegraph.com/ethereum-price">ETH</a>) through decentralized exchanges and were dormant until this week. 
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-03/612b1610-5890-4730-ab25-e6718c75559c.png" alt="" title="">
 <figcaption style="text-align: center;">
 Flow of funds from HTX/HECO hacks to Tornado Cash. Source: Elliptic
 </figcaption>
</figure>
Tornado Cash is a decentralized and noncustodial privacy tool built on the Ethereum blockchain. The crypto mixer uses smart contracts to accept ETH and ERC-20 token deposits from one address and enables them to be withdrawn by a different address. 
The protocol&nbsp;<a href="https://cointelegraph.com/news/us-treasury-sanctions-usdc-and-eth-addresses-connected-to-tornado-cash">was sanctioned in August 2022</a> by the U.S. Treasury Department for its alleged role in allowing the laundering of over $1 billion in illicit funds, including money linked to the Lazarus Group.
“Tornado Cash continues to operate despite sanctions. The mixer operates through smart contracts running on decentralized blockchains, so it cannot be seized and shut down in the same way that centralized mixers such as Sinbad.io have been,” explained Elliptic. 
The Lazarus Group has apparently switched back to Tornado Cash after losing other mixer options. According to Ellipitc, the hackers chose cross-chain bridges and the Bitcoin (<a href="https://cointelegraph.com/bitcoin-price">BTC</a>) mixer Sindbad to launder stolen money since the sanctions. 
Sindbad, however, was<a href="https://cointelegraph.com/news/us-treasury-sanctions-crypto-mixer-north-korea"> seized by Finnish authorities in November 2023</a> after U.S. sanctions went into effect, removing another mixing option for the hackers. The U.S. crackdown on crypto mixers also includes the<a href="https://cointelegraph.com/news/crypto-mixer-sanctioned-by-us-treasury-for-role-in-axie-infinity-hack"> closing of the Blender platform in May 2022</a>.
Authorities are also targeting developers of such mixers. Tornado Cash’s developers, Roman Storm and Alexey Pertsev, have been&nbsp;<a href="https://cointelegraph.com/news/tornado-cash-co-founders-charged-with-money-laundering-sanctions-violations-ofac">charged with several crimes by U.S. authorities</a>, including conspiracy to commit money laundering, conspiracy to commit sanctions violations, and conspiracy to operate an unlicensed money-transmitting business. The founder of the crypto mixer Bitcoin Fog&nbsp;<a href="https://cointelegraph.com/news/crypto-mixer-bitcoin-fog-roman-sterlingov-convicted-money-laundering">was convicted of money laundering</a> on March 12 in a similar development.
Magazine: <a href="https://cointelegraph.com/magazine/pink-drainer-security-researcher-steals-millions-from-participants/">Inside Pink Drainer — Security analyst defends his crypto scam franchise</a>

Lazarus Group moves $12M from HTX, HECO hacks to Tornado Cash

Cointelegraph

Other articles published on Mar 14, 2024

Biden Administration Proposes 30% Tax on Crypto Mining Electricity to Shape Fiscal Year 2025 Budget

Antler Interactive to Showcase Their Latest Creation, Cloudborn, at GDC

Top Trends: 5 Cryptocurrencies Shining with Significant Uptrends

Solana’s Price Peaks Attracting Crypto Market Attention

Should You Ditch Mining For ETFs? Bitcoin Investment Strategies Shift With $1 Billion Surge

Euphoria Or False Dawn? Why The Ethereum $4,000 Party Might End Soon

Join our free newsletter for daily crypto updates!