Ben Strack

<div id="highlights-block_62d064cacab04" class="highlights">
 <ul>
 <li>Illicit addresses account for 23% of funds sent to mixers so far in 2022, up from 12% in 2021</li>
 <li>Groups associated with the North Korean government are sending about half of the funds going to mixers</li>
 </ul>
 
</div>



More money moving to crypto mixing services in 2022 is coming from addresses associated with illicit activity, as government agencies may be forced to take action against non-compliant mixers or impose more sanctions.&nbsp;&nbsp;



The 30-day moving average of value received by mixers reached an all-time high of nearly $52 million worth of crypto on April 19, according to <a href="https://blog.chainalysis.com/reports/cryptocurrency-mixers/" target="_blank" rel="noreferrer noopener">a report by Chainalysis</a> published Thursday. This figure is roughly double the incoming volume at the same point in 2021.



Perhaps more notably, the blockchain data platform revealed, illicit addresses account for 23% of funds sent to mixers so far in 2022, up from 12% last year.



Mixers or tumblers, such as <a href="https://cms.blockworks.co/tag/tornado-cash/" target="_blank" rel="noreferrer noopener">Tornado Cash</a>, are services providing users the ability to <a href="https://cms.blockworks.co/the-purpose-and-perils-of-crypto-privacy-tools/" target="_blank" rel="noreferrer noopener">conceal the transaction history</a> of certain cryptocurrencies by pooling and mixing them together with other users’ funds. Industry watchers have noted that while they can be used for illegal activity, many believe that it is a crucial tool for financial privacy.



Nearly 10% of all funds sent from illicit addresses are sent to mixers, the report showed. No other address type — such as one associated with various kinds of exchanges or gambling platforms — reached a 0.3% mixer sending share.



Russian darknet market <a href="https://home.treasury.gov/news/press-releases/jy0701" target="_blank" rel="noreferrer noopener">Hydra</a> accounts for half of all funds moving to these services from sanctioned entities this year, according to Chainalysis. Nearly all of the remaining funds going to mixers are North Korean government-associated Lazarus Group and Blender.io, accounting for about 30% and 19%, respectively. 



<a href="https://cms.blockworks.co/tag/chainalysis/" target="_blank" rel="noreferrer noopener">Chainalysis</a> Director of Research <a href="https://www.linkedin.com/in/kimberly-grauer-a9501144/" target="_blank" rel="noreferrer noopener">Kim Grauer</a> said the most striking takeaway of the report was the large rise in mixer usage by the North Korea-linked cybercriminal groups. 



“This alone is driving a massive increase in the use of mixers this year, and demonstrates that regulators and law enforcement should have the tools and resources they need to better understand the national security risks mixers pose and investigate illicit activity,” she told Blockworks.&nbsp;



Forbes <a href="https://www.forbes.com/sites/laurashin/2022/02/22/exclusive-austrian-programmer-and-ex-crypto-ceo-likely-stole-11-billion-of-ether/?sh=79e0e367f589" target="_blank" rel="noreferrer noopener">reported</a> in February that Chainalysis has a “previously secret forensics tool” that was able to demix transactions tied to The DAO hack of 2016 and track their output to four exchanges.



The Tuesday report noted that Chainalysis “continues to refine the ability to demix certain mixing transactions and see users’ original source of funds.”



Grauer declined to comment on the company’s demixing capabilities.&nbsp;



Several mixers — including Tornado Cash — and other decentralized finance platforms are taking advantage of privacy-preserving technology, such as <a href="https://www.investopedia.com/terms/z/zksnark.asp" target="_blank" rel="noreferrer noopener">zk-SNARK</a>, to ensure anonymity remains intact, NetSPI Chief Technology Officer Travis Hoyt said.  



“If Chainalysis can in fact reverse or deduce transactions protected with this type of technology, it would question some of the fundamental mechanics of how some blockchains work, as well as some of the mixing and [decentralized finance] platforms,” Hoyt told Blockworks.



<h3 class="wp-block-heading">Combatting mixer usage for illegal activities</h3>



The hacker who <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">exploited the Ronin Network</a> for roughly $625 million in March initially transferred thousands of ether to Tornado Cash. 



Also that month, federal prosecutors in Florida seized roughly $34 million worth of crypto and German authorities confiscated about $25 million worth of bitcoin. Alleged criminals in both cases used mixing services to mask transactions.



More recently, roughly a third of the $100 million <a href="https://cms.blockworks.co/funds-from-100m-horizon-bridge-exploit-sent-to-tornado-cash-mixing-service/" target="_blank" rel="noreferrer noopener">stolen last month from Horizon Bridge</a> — a cross-chain interoperability platform between Ethereum, Binance Smart Chain (BSC) and Harmony blockchain networks — was also transferred to a Tornado Cash address.



Grauer said that mixers in the US, like other crypto companies, are required to register as money services businesses (MSBs) under the Financial Crimes Enforcement Network’s guidance.



Tornado Cash is an immutable smart contract, not a business, but the service includes a <a href="https://tornadocash.eth.limo/compliance/" target="_blank" rel="noreferrer noopener">compliance tool</a>, which allows any lawful user to prove the origin and destination of funds if required to do so by law enforcement agencies.



A right to privacy is enshrined in Article 12 of the <a href="https://www.un.org/en/about-us/universal-declaration-of-human-rights" target="_blank" rel="noreferrer noopener">United Nations Declarations on Human Rights</a>, and preserving it is a natural concern of any user of a public, immutable blockchain.



But Chainalysis is unaware of any mixers currently following regulations around anti-money laundering and combating the financing of terrorism that MSBs are subject to in most jurisdictions, Grauer added.



“The increase in usage by nation state actors in particular may lead government agencies to take action against non-compliant mixers or even impose sanctions, as they have in the past,” Grauer said.



The US Treasury’s Office of Foreign Assets Control (OFAC) <a href="https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20220405" target="_blank" rel="noreferrer noopener">sanctioned</a> Hydra in April, adding more than 100 of its crypto addresses to the specially designated national list as identifiers. In May, OFAC <a href="https://home.treasury.gov/news/press-releases/jy0768#:~:text=WASHINGTON%20%E2%80%93%20Today%2C%20the%20U.S.%20Department,laundering%20of%20stolen%20virtual%20currency." target="_blank" rel="noreferrer noopener">sanctioned</a> virtual currency mixer Blender.io. 



“These platforms are agnostic to borders, and while [US] frameworks may apply to certain citizens and the legal jurisdictions they’re in, they will not apply to all,” Hoyt said. “This means that trying to regulate them could be very difficult.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

blender.io

Illicit Crypto Moving to Mixers on Pace to Double in 2022

Casey Wagner

<div id="highlights-block_627586bdeb65b" class="highlights">
 <ul>
 <li>North Korean mixer Blender.io was used to conceal funds from the Ronin Network hack</li>
 <li>The Treasury has already sanctioned the group the FBI said is responsible for the largest cryptocurrency hack to date</li>
 </ul>
 
</div>



The US Treasury Department has levied its first sanctions against a crypto mixing service, or a means of obscuring the origin of a digital asset. 



The Treasury on Friday alleged North Korea-based hacker Lazarus Group — which in March allegedly <a href="https://cms.blockworks.co/fbi-says-north-korea-behind-625m-ronin-hack/" target="_blank" rel="noreferrer noopener">stole $625 million</a> from Ethereum-linked sidechain Ronin Network — used the sanctioned company, Blender.io, to conceal the illicit funds.



Blender was used to launder more than $20.5 million of the hacked cryptocurrency, the Treasury said in a <a href="https://home.treasury.gov/news/press-releases/jy0768" target="_blank" rel="noreferrer noopener">statement</a>. The attack remains the largest crypto hack on record. 



“Virtual currency mixers that assist illicit transactions pose a threat to U.S. national security interests,” said Brian Nelson, under secretary of the Treasury for terrorism and financial intelligence. “We are taking action against illicit financial activity by the DPRK and will not allow state-sponsored thievery and its money-laundering enablers to go unanswered.”



In April, the Treasury in its first move <a href="https://cms.blockworks.co/treasury-sanctions-north-korean-hacker-group-confirms-ties-to-625m-hack/" target="_blank" rel="noreferrer noopener">sanctioned Ethereum addresses</a> linked to Lazarus Group.



The news comes as the digital asset industry continues to evaluate the role and risks of <a href="https://cms.blockworks.co/the-purpose-and-perils-of-crypto-privacy-tools/" target="_blank" rel="noreferrer noopener">mixer services</a>. Hackers used mixing service Tornado Cash to try to conceal 5,400 stolen ether linked to April’s $80 million <a href="https://cms.blockworks.co/hacked-crypto-platform-offers-no-questions-asked-10m-bounty-for-stolen-funds/" target="_blank" rel="noreferrer noopener">Fei Protocol hack</a>, according to BlockSec Chief Technology Officer Lei Wu.



The services, while known to be often linked to money laundering, are not illegal.



“There are legitimate privacy concerns that [mixers] can help address,” Kim Grauer, director of research at Chainalysis, said during a panel at the <a href="https://cornellblockchain.org/" target="_blank" rel="noreferrer noopener">Cornell Blockchain Conference</a> in New York. “There is a lot of hacking happening, which is another bad impact of growing so fast, but there&#8217;s also an opportunity there to build more secure platforms.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>