Partnered With:

Accused of aiding North Korea's largest hackers, the founder of Tornado Cash has been sanctioned by the US Treasury Department.

Read this article in 11 Minutes

The US Treasury Department, in conjunction with the Department of Justice, has filed a lawsuit to impose sanctions and hold accountable the founder of a mixing service for laundering money for North Korea.

Source: U.S. Department of the Treasury

Original translation: BlockBeats

Today, the Office of Foreign Assets Control (OFAC) of the US Department of the Treasury imposed sanctions on Roman Semenov, one of the three founders of Tornado Cash, a virtual currency mixer. The reason for the sanctions is that he provided substantial support to Tornado Cash and the Lazarus Group, a state-sponsored hacking group supported by the Democratic People's Republic of Korea (DPRK or North Korea). Since its founding in 2019, Tornado Cash has been used for money laundering by criminals, including covering up the theft of hundreds of millions of dollars in virtual currency by the Lazarus Group hackers.

This sanction decision was made in collaboration with the US Department of Justice (DOJ), which has publicly released an indictment against Roman Storm, another founder of Semenov and Tornado Cash. Today, Storm has been arrested by the criminal investigation departments of the Federal Bureau of Investigation and the National Tax Agency. The DOJ has charged Semenov and Storm with conspiracy to commit money laundering, conspiracy to operate an unlicensed money transmitting service, and conspiracy to violate sanctions regulations. Alexey Pertsev, the third founder of Tornado Cash, was arrested by local law enforcement authorities in the Netherlands in August 2022 on charges related to money laundering.

The Lazarus group was sanctioned by the United States in 2019. In March 2022, they launched an attack on Axie Infinity's Ronin cross-chain bridge and stole over $455 million, making it the largest known virtual currency theft to date. Subsequently, the Lazarus group used Tornado Cash for money laundering, including over $96 million from the network theft of Harmony's Horizon bridge on June 24, 2022, and at least $7.8 million from the Nomad theft on August 2, 2022. These revenues provided resources for North Korea, which used them to support its illegal ballistic missile and nuclear weapons programs.

The US Deputy Secretary of the Treasury, Wally Adeyemo, said: "Even though they knew that the Lazarus group was using their mixer service to launder hundreds of millions of dollars worth of stolen virtual currency for the Kim regime, the founder of Tornado Cash continued to develop and promote the service without taking any real action to reduce its use for illegal purposes. Today's actions by the Criminal Investigation Division of the IRS and OFAC demonstrate the Treasury Department's determination to continue tracking those who recklessly operate and support high-risk virtual currency mixing services that threaten our national security."

Today's sanctions and charges are based on earlier actions and aim to expose certain elements in the virtual currency ecosystem that have been used by cybercriminals, including the Lazarus group, to conceal the source and destination of their illicitly obtained funds. This also underscores the Treasury Department's commitment to protecting the integrity of our financial system, including the virtual currency ecosystem, and disrupting North Korea's ability to raise funds through illicit activities.

In 2022, OFAC sanctioned Tornado Cash and Blender.io for providing mixing services to the Lazarus Group. This year, OFAC sanctioned two over-the-counter virtual currency traders who assisted North Korea in collaboration with the Lazarus Group to convert stolen virtual currency into fiat currency. Tomorrow, the Financial Crimes Enforcement Network (FinCEN) of the Treasury Department will host a FinCEN Exchange on combating North Korean abuse of the digital ecosystem, with attendees including personnel from the Treasury Department, law enforcement agencies, and financial institutions. The Treasury Department will continue to use all of its tools to address North Korea's illicit financial threats through the use of networks.

ROMAN SEMENOV: Main Developer of TORNADO CASH

Russian citizen Roman Semenov co-founded Tornado Cash, a mixing service aimed at increasing the anonymity of user transactions. Semenov actively promoted Tornado Cash on media and online platforms, providing advice on how Tornado Cash users can anonymize their transactions. After learning that Tornado Cash was used to launder a large amount of stolen virtual currency for the Lazarus group, he and other founders continued to pay for the infrastructure supporting Tornado Cash services and took measures to increase the anonymity of Tornado Cash services, but did not take appropriate measures to address known illegal use by North Korea.

In April 2022, Semenov learned that an Ethereum address had been publicly attributed to the Lazarus group and was included on the Specially Designated Nationals and Blocked Persons List (SDN List), which included hundreds of millions of dollars in illegal proceeds stolen from the widely reported $620 million Ronin Bridge heist and was being used to send funds through the Tornado Cash service. Semenov and his co-founder established a front-end sanction screening service, but they knew it was easy to circumvent and did not take sufficient measures to effectively address North Korea's abuse. Despite Semenov's access to information from publicly available blockchain analysis and media queries, he has consistently ignored or downplayed evidence of Tornado Cash being used to launder money for North Korea and continued to participate in the operation and maintenance of the Tornado Cash service without taking meaningful action to prevent or mitigate the risk of money laundering from their illegal activities after the theft.

On September 13, 2019, according to Executive Order (E.O.) 13722, OFAC sanctioned the Lazarus Group and identified it as an agency, department, or controlled entity of the North Korean government. The Lazarus Group has been operating for over 10 years and is believed to have stolen over $2 billion worth of digital assets in multiple thefts. Due to the strict sanctions imposed by the United States and the United Nations, North Korea has turned to illegal strategies such as network thefts carried out by the Lazarus Group to raise funds for its illegal mass destruction weapons and ballistic missile projects.

Semenov was designated pursuant to Executive Order 13694, which was subsequently amended by E.O. 13757. He was designated for having provided financial, material, or technological support for, or goods or services to or in support of, activities described in E.O. 13694, as amended by (a)(ii) or (a)(iii)(A), or any person whose property and interests in property were blocked pursuant to E.O. 13694, or for having provided financial, material, or technological support for, or goods or services to or in support of, the Government of North Korea or any person whose property and interests in property were blocked pursuant to E.O. 13722.

Impact of Sanctions

Due to today's action, all property and property rights owned or controlled by designated individuals in the United States or by US persons must be frozen and reported to OFAC. OFAC regulations typically prohibit all transactions involving blocked or designated persons' property or property rights by US persons or within the United States (including transactions that transit the United States).

In addition, individuals who engage in certain transactions with the person designated today may themselves face designated risks.

The power and integrity of sanctions not only come from OFAC's ability to designate individuals and add them to the SDN list, but also from OFAC's willingness to remove individuals from the SDN list in accordance with the law. The ultimate goal of sanctions is not punishment, but to achieve positive behavioral change. For information on the process of seeking removal from OFAC's list (including the SDN list), please refer to OFAC's FAQ 897. For detailed information on submitting a request for removal from OFAC's sanctions list, please refer to OFAC's official website.