On Monday, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned “virtual currency mixer” Tornado Cash for laundering the proceeds of cybercrimes, including over $455 million stolen by the Lazarus Group, a North Korea-sponsored hacking ring, in largest known virtual currency heist ever.
The press release explained that Tornado Cash operates on the Ethereum blockchain and “indiscriminately facilitates anonymous transactions by obfuscating their origin, destination, and counterparties, with no attempt to determine their origin.” It accomplishes this by receiving various transactions and mixing them together before transmitting them to their individual recipients.
While Tornado Cash does so to ostensibly enhance privacy, the crypto platform is commonly used by bad actors to launder funds, with the tally reaching $7 billion worth of virtual currency to date, the press release said. The funds include more than $96 million from the June 2022 Harmony Bridge Heist and at least $7.8 million from the August 2022 Nomad Heist.
The Treasury sanctioned Tornado Cash pursuant to a 2015 cyber sanctions Executive Order after it made but failed to honor assurances about its platform. In particular, the press release said that Tornado Cash failed to impose effective controls to stop the laundering of funds and must now face a bar from operation in the U.S. The decision comes after OFAC’s first-ever sanction of virtual currency mixer Blender.io in May.
