Andrew Thurman

One of the great promises of cryptocurrency is the creation of fully open financial rails that can be utilized by anyone, anywhere in the world. But what are the risks to developers if public code is used by criminals?&nbsp;



Taylor Monahan — for my money, one of the two or three best Twitter follows out there if you’re an analytics junkie — published data on Sunday showing that upwards of 65% of decentralized exchange Thorswap’s ETH-to-BTC swap volume over a four-month period came from criminals, including the North Korean-sponsored Lazarus Group.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Welp, the hackers and money launderers—both the Russian/CIS region ones and North Korean ones—are loooooving <a href="https://twitter.com/THORChain?ref_src=twsrc%5Etfw">@ThorChain</a> lately. In fact, in the last four months, ***more than 50%*** of the ETH -&gt; to ThorSwap Router -&gt; to BTC have been stolen funds. 😬😬😬😬😬 rip. <a href="https://t.co/V4KscNilRA">pic.twitter.com/V4KscNilRA</a>&mdash; Tay 💖 (@tayvano_) <a href="https://twitter.com/tayvano_/status/1708630905634664862?ref_src=twsrc%5Etfw">October 1, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Publishing code that happens to be utilized by criminals appears to be becoming a dangerous practice, particularly when the user is North Korean. The US government in particular has a history of coming down hard on developers who become entangled with the Hermit Kingdom: In 2022, Ethereum developer Virgil Griffith was sentenced to over five years on charges related to giving an educational speech at a conference in Pyongyang.&nbsp;



More recently, two privacy mixer Tornado Cash developers were arrested by Dutch and American authorities, and the US Treasury sanctioned dozens of Ethereum smart contracts and addresses associated with the protocol.&nbsp;



I worry that Thorchain developers might soon face a similar situation. What are the material differences between how North Koreans are utilizing <a href="https://blockworks.co/news/tornado-cash-privacy-debate" target="_blank" rel="noreferrer noopener">Tornado Cash</a> and Thorchain? To my untrained legal eye, it wouldn’t be difficult to cobble together similar (and similarly bogus) charges for money laundering and operating an unlicensed money transmitter — and the same applies to any protocol that happens to be used by North Korea. In short, potentially on the chopping block is any team whose code has facilitated an exchange by a user the governments of the world find unsavory.&nbsp;



But how does a piece of code even get sanctioned in the first place? One answer is: Incompetently.&nbsp;



The Treasury’s <a href="https://ofac.treasury.gov/recent-actions/20220808">list</a> of “specially designated nationals” (traditionally only persons or companies) included a list of Ethereum addresses, including some head-scratchers such as Tornado Cash’s Gitcoin donation address. It was later found that officials simply sanctioned every address that happened to be labeled as being associated with the Tornado Cash protocol by Etherscan.&nbsp;



Then again, if you wield a large enough cudgel, it’s okay to be clumsy. Two of the three Tornado Cash founders have been arrested and are awaiting trial. One sat in a Dutch jail for three months without charges, and the other was recently released on a $2 million bond in Seattle. Note that this is all being pursued with novel legal theory — according to one law <a href="https://www.jdsupra.com/legalnews/all-roads-lead-to-roman-alleged-tornado-8554740/">blog</a>, “it is conceivable that different courts will issue different rulings which are in tension with one another, or potentially outright contradict each other.”&nbsp;



Ironically, this strong-arming has arguably only been partially successful. If the goal of the sanctions and charges and imprisonment was to shut down Tornado Cash, they’ve failed — according to a Dune Analytics <a href="https://dune.com/poma/tornado-cash_1">dashboard</a>, as of July, the protocol was still facilitating nearly $6 million in deposits and withdrawals per day.&nbsp;



When you’re trying to bludgeon someone, nuances like legal interpretation or even the accomplishment of coherent goals don’t matter. The Dutch and US governments have succeeded in making the developers’ lives miserable.&nbsp;



This open cruelty from governments pose existential questions for the industry writ large. <a href="https://blockworks.co/price/btc" target="_blank" rel="noreferrer noopener">Embedded in Bitcoin’s genesis block</a> is a shot taken at the British government for their failure to contain a fiscal crisis, and in my view every single Bitcoin transaction since then — from drugs bought on Silk Road to donations to Ukraine to trading on DEXs — have in part been political statements. The goal of financial disintermediation is inherently political.&nbsp;



Read more from our opinion section: <a href="https://blockworks.co/news/cftc-enforcement-defi" target="_blank" rel="noreferrer noopener">C is for crypto, but the CFTC didn’t get the memo</a>



The coalition that peoples the crypto movement is ideologically disparate, from rabid Randian libertarians to “greenpilled” socialists. But regardless of whether a given developer is working on privatizing transactions or on a DAO that grows vegetables, odds are that they’re cooking something that either replicates or undermines nation state power.&nbsp;



Right now, it seems like nation states can only be bothered to care about crypto when some suit in a back office finds some violation or another to be particularly egregious; eventually, governments will get more sophisticated and attempt to push back en masse. And when that point comes, it’s important to remember that political movements can often lead to political prisoners.&nbsp;



The treatment of the Tornado Cash developers by the Dutch and US governments have been capricious and ham-handed displays of blunt carceral force, but in the quest to build permissionless financial rails accessible by anyone — yes, even criminals — I’m growing increasingly worried that such treatment of developers will become the norm, not the exception.&nbsp;



<hr class="wp-block-separator has-alpha-channel-opacity"/>


<div class="wp-block-post-author-biography">Andrew Thurman is a Data Editor based in Washington, DC. He previously wrote for CoinDesk and Cointelegraph, and worked in various roles for Chainlink and Nansen. His analysis has been quoted in The Financial Times, The Washington Post, The Wall Street Journal, Bloomberg, Forbes, Fortune, Reuters, The BBC, CNBC, and elsewhere. Contact Andrew at andrew@blockworks.co.</div>


<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.



Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. <a href="https://blockworks.co/newsletter/onthemargin">Subscribe to the Forward Guidance newsletter</a>.



Get alpha directly in your inbox with the <a href="https://blockworks.co/newsletter/research">0xResearch newsletter</a> — market highlights, charts, degen trade ideas, governance updates, and more.



The Lightspeed newsletter is all things Solana, in your inbox, every day. <a href="https://blockworks.co/newsletter/lightspeed">Subscribe to daily Solana news</a> from Jack Kubinec and Jeff Albus.

Yes, criminals use crypto. No, don’t blame the developers.

Casey Wagner

<div id="highlights-block_63039fe91dcf8" class="highlights">
 <ul>
 <li>Ronin bridge hackers moved funds to the Bitcoin network, new report shows </li>
 <li>Lazarus Group has used various crypto mixing services to conceal funds, including one not yet targeted by OFAC</li>
 </ul>
 
</div>



The hacking collective believed to be behind the $625-million Ronin bridge <a href="https://cms.blockworks.co/us-treasury-sanctions-first-crypto-mixing-service-following-record-hack/" target="_blank" rel="noreferrer noopener">hack</a> has transferred stolen ether into bitcoin using a cryptocurrency mixing service the US Treasury has not yet targeted, according to a new report.&nbsp;



<a href="https://cms.blockworks.co/alleged-crypto-ransomware-money-launderer-extradited-to-us/" target="_blank" rel="noreferrer noopener">Lazarus Group</a>, initially sanctioned by the Office of Foreign Assets Control (OFAC) in 2019, has used OFAC sanctioned cryptocurrency mixing services Blender.io and Tornado Cash to attempt to move and conceal funds.&nbsp;



Hackers have more recently tapped ChipMixer, a mixer founded in 2017 that has yet to be added to OFAC’s blocked list, according to the <a href="https://www.slowmist.com/report/first-half-of-the-2022-report(EN).pdf" target="_blank" rel="noreferrer noopener">report</a>&nbsp; from blockchain security firm SlowMist.&nbsp;



Learn: <a href="https://cms.blockworks.co/crypto-mixers-and-privacy-coins-can-they-resist-censorship/">How Crypto Mixers and Privacy Coins Work</a>



Lazarus Group converted 25.5 million USDC to ETH in March 2022. In the days that followed, hackers moved the ETH to various exchanges, including FTX and Crypto.com before withdrawing to the bitcoin network and mixing it through Blender.io, which the <a href="https://home.treasury.gov/news/press-releases/jy0768" target="_blank" rel="noreferrer noopener">Treasury sanctioned</a> in May.&nbsp;



Between April and May, the group moved funds through <a href="https://cms.blockworks.co/decentralized-or-not-officials-say-tornado-cash-responsible-for-illicit-activity/" target="_blank" rel="noreferrer noopener">Tornado Cash</a>, which was added to OFAC’s blocked list earlier this month.&nbsp;



Many of the funds were mixed through various services, the report said. Roughly half of the laundered bitcoins have been run through ChipMixer, according to SlowMist.&nbsp;



“36.6% of laundered funds are currently held at the hacker&#8217;s address, totalling 2,586 BTC,” the report noted. “6.2% of funds laundered were moved to Blender, with 3.8% of laundered funds moved to CryptoMixer and a small percentage to other unknown entities.”&nbsp;



The report comes as 2022 has seen an uptick in the use of <a href="https://cms.blockworks.co/illicit-crypto-moving-to-mixers-on-pace-to-double-in-2022/" target="_blank" rel="noreferrer noopener">crypto mixing services</a>, which allow users to <a href="https://cms.blockworks.co/the-purpose-and-perils-of-crypto-privacy-tools/" target="_blank" rel="noreferrer noopener">conceal the transaction history</a> of certain cryptocurrencies by pooling and mixing them together with other users’ funds.&nbsp;



The 30-day moving average of value received by mixers reached an all-time high of nearly $52 million worth of crypto on April 19, according to <a href="https://blog.chainalysis.com/reports/cryptocurrency-mixers/" target="_blank" rel="noreferrer noopener">a July report by Chainalysis</a> — or roughly double the volumes at the same time in 2021.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.



Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. <a href="https://blockworks.co/newsletter/onthemargin">Subscribe to the Forward Guidance newsletter</a>.



Get alpha directly in your inbox with the <a href="https://blockworks.co/newsletter/research">0xResearch newsletter</a> — market highlights, charts, degen trade ideas, governance updates, and more.



The Lightspeed newsletter is all things Solana, in your inbox, every day. <a href="https://blockworks.co/newsletter/lightspeed">Subscribe to daily Solana news</a> from Jack Kubinec and Jeff Albus.