The U.S. Treasury Department has seized the Sinbad cryptocurrency mixing service because it was used as a money laundering tool by the North Korean Lazarus hacking group. A cryptocurrency mixer is a server that allows people to deposit cryptocurrency, which is mixed in many different wallet addresses to help prevent it from being accurately traced. The mixing service takes a commission from the deposited cryptocurrency, and after "mixing" it is sent to another wallet address owned by the customer.
Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) imposed sanctions on Sinbad.io (Sinbad) after the website was allegedly used by North Korean hackers to conduct large-scale cryptocurrency thefts, resulting in hundreds of millions of dollars in losses.
"Sinbad processed millions of dollars' worth of virtual currency in cases involving Lazarus Group cyberattacks, including proceeds from Horizon Bridge and Axie Infinity," the U.S. Treasury Department wrote in a press statement. "Cybercriminals also used Sinbad to obfuscate transactions related to malicious activities, such as sanctions evasion, drug trafficking, the purchase of child sexual abuse material, and other illicit sales on darknet markets."
Lazarus is a notorious North Korean hacking group known for its phishing attacks, fake employee recruitment, and exploiting blockchain vulnerabilities to steal millions of dollars in cryptocurrency, including $620 million from AxieInfinity, $100 million from HarmonyHorizon, the AtomicWallet hack, and $37 million from AtomicWallet.
The FBI said North Korea used the stolen money to fund the country's operations.
According to the Treasury Department, Sinbad was used to commingle the majority of stolen funds from the AtomicWallet, AxieInfinity, and Horizon hacks.
In addition to sanctioning cryptocurrency mixers, the domain name of the Sinbad website was also seized in international law enforcement actions in the United States, the Netherlands, and Poland.
“As part of a coordinated international law enforcement operation by the FBI, the Financial Intelligence and Investigation Bureau (FIOD), and the National Bureau of Investigation against the Sinbad.io cryptocurrency mixing service, the service has been seized by the FBI pursuant to seizure warrants at 18 USC 981 and 982.”
In addition to the public internet sites shown in the image, Sinbad's Tor site is no longer operational, indicating that the origin server of the hybrid service was also seized by law enforcement.
OFAC previously sanctioned North Korean hacking groups including Lazarus in 2019. In 2022, OFAC sanctioned the TornadoCash mixer because North Korean hackers used the mixer to launder stolen funds.