Pierluigi Paganini August 23, 2023

The U.S. DoJ charged two men with operating the Tornado Cash service and laundering more than $1 Billion in criminal proceeds.

The U.S. Justice Department charged two Tornado Cash founders ROMAN STORM and ROMAN SEMENOV have been charged with one count of conspiracy to commit money laundering and one count of conspiracy to violate the International Economic Emergency Powers Act.  For these charges, they can face up to 20 years in prison. They have been also charged with conspiracy to operate an unlicensed money transmitting business, for this charge they can face up to 5 years in prison.

The duo operated the Tornado Cash cryptocurrency mixer that facilitated more than $1 billion in money laundering transactions and laundered hundreds of millions of dollars for the Lazarus APT group.

In early August 2022, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) has sanctioned the crypto mixer service.

The mixers are essential components for cybercriminals that use them for money laundering, it was used to launder the funds stolen from the victims.

According to OFAC, Tornado Cash was used to launder more than $7 billion worth of virtual currency since its creation in 2019. The Lazarus APT group laundered over $455 million stolen during the largest known virtual currency heist to date. Tornado Cash was also used to launder more than $96 million of malicious cyber actors’ funds derived from the June 24, 2022 Harmony Bridge Heist, and at least $7.8 million from the recent Nomad crypto heist.

The sanction is being taken pursuant to Executive Order (E.O.) 13694.

“Even after they knew the Lazarus Group was laundering hundreds of millions of dollars’ worth of stolen virtual currency through their mixing service for the benefit of the Kim regime, Tornado Cash’s founders continued to develop and promote the service and did not take meaningful steps to reduce its use for illicit purposes,” said Deputy Secretary of the Treasury Wally Adeyemo. “Today’s actions by IRS Criminal Investigators and OFAC demonstrate Treasury’s commitment to continue going after those who recklessly operate and support dangerous virtual currency mixing services that threaten our national security.” 

“Today’s announcement should remind criminal organizations everywhere in the world that they are neither untraceable nor anonymous.  You can’t hide from us behind a keyboard — whether you’re a hacker or facilitator.  Those charged today engaged in a conspiracy to launder money for cybercriminals, including for a North Korean cybercrime organization seeking to evade sanctions.” FBI Director Christopher A. Wray said “As we have with this operation, the FBI is going to keep dismantling the infrastructure used by cyber criminals to commit and profit from their crimes, and holding anyone who assists those criminals accountable.”

According to the indictment, Tornado Cash service facilitated its use by criminal actors laundering high volumes of criminal proceeds.

This week, the Federal Bureau of Investigation shared details about the activity of six cryptocurrency wallets operated by North Korea-linked threat actors.

The wallets hold roughly 1,580 Bitcoin (roughly $41 million at the current rate) that the feds believe are linked to the recent theft of hundreds of millions of dollars in cryptocurrency

The FBI believes that the North Korea-linked hackers may attempt to cash out the stolen funds.

The investigation conducted by the FBI revealed that the TraderTraitor-affiliated actors moved approximately 1,580 bitcoin from several cryptocurrency heists to six wallets.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Tornado Cash)