In March, entities associated with the North Korean regime reportedly utilized the privacy protocol Tornado Cash to launder approximately $150 million in stolen cryptocurrency assets, according to a confidential United Nations (UN) report obtained by Reuters. The report reveals that cyberattackers known as the Lazarus Group transferred a dormant cache of stolen crypto assets back to North Korea.

The stolen cryptocurrency assets, valued at $147.5 million, were unlawfully obtained from HTX, a crypto exchange owned by Tron founder Justin Sun, in March 2023. A year later, these funds were funneled into North Korea using Tornado Cash, a popular crypto mixing service. Such services are frequently exploited by hackers and scammers to obscure the origin of stolen crypto assets and make them untraceable.

The UN is currently investigating 97 North Korean cyberattacks, spanning from 2017 to 2024, which collectively drained approximately $3.6 billion worth of cryptocurrencies. In 2024 alone, UN monitors probed 11 cryptocurrency thefts totaling $54.7 million, allegedly involving IT workers from the Democratic People’s Republic of Korea (DPRK) inadvertently hired by small crypto-related companies.

Tornado Cash came under scrutiny in 2022 when the United States sanctioned it for allegedly aiding North Korea in circumventing cross-border remittance sanctions. However, the protocol and its founders have vehemently denied these allegations for over two years. Recently, on May 14, Alexey Pertsev, the developer of Tornado Cash, was found guilty of money laundering and sentenced to five years and four months in prison for allegedly laundering $1.2 billion worth of illicit assets on the platform.

The use of Tornado Cash to launder stolen funds is not exclusive to North Korea but is a prevalent method among hackers globally. On May 14, blockchain investigation firm PeckShield uncovered that stolen Ether worth $53 million from the Poloniex $100 million hack was transferred to Tornado Cash. The hacker consolidated over 17,800 ETH from six different wallets into a single Tornado Cash address, as revealed in PeckShield's analysis.