Tornado Cash Mixer Defies OFAC Blacklist, Aids North Korea-Linked Hackers in Laundering Stolen Crypto Worth Millions

Despite being placed on the OFAC blacklist, the Tornado Cash mixer persists in its operations, facilitating North Korea-linked hackers in laundering millions of pilfered cryptocurrency.

In November 2023, the Lazarus Group, an entity affiliated with the Democratic People's Republic of Korea (DPRK), successfully laundered hundreds of millions of dollars' worth of Ethereum (ETH) stolen from HTX (formerly Huobi) and Heco Bridge. Taylor Monahan, CEO of MyEtherWallet, disclosed in a post on X dated March 28 that the hackers had managed to launder over 48,194 ETH (valued at approximately $170 million) through Tornado Cash. This mixing service, despite being sanctioned by the Office of Foreign Assets Control (OFAC), was employed by the hackers to obfuscate the trail of their transactions.

Monahan provided insight into the tactics utilized by the hackers, revealing that they dispersed their stolen cryptocurrency across numerous transactions spanning multiple wallets. Additionally, they employed a strategy of "hopping" withdrawals across various wallets multiple times to further obscure their activities.

Following the mixing of funds on the Ethereum network, the hackers transferred them to the Bitcoin blockchain via THORSwap, a service facilitating cross-chain asset transfers. The ultimate disposition of the funds remains uncertain, as Lazarus Group typically sells stolen cryptocurrency on over-the-counter (OTC) markets for fiat currency.

In November 2023, HTX and the Heco Chain's Ethereum bridge fell victim to a hacker attack, resulting in the loss of tens of millions of dollars' worth of cryptocurrency. Despite assurances from Justin Sun, an investor at the exchange, that customers would be fully reimbursed, the precise method by which hackers gained control over the exchange's hot wallet remains undisclosed.

OFAC had previously imposed sanctions against Tornado Cash in 2022, citing its role in laundering over $7 billion worth of cryptocurrency since 2019. Among the illicit funds laundered were over $455 million stolen by the Lazarus Group, in addition to funds derived from other cyber heists such as the Harmony Bridge and Nomad, totaling millions of dollars.