OFAC Sanctions Sinbad.io Mixer for Laundering Lazarus Group Funds
The U.S. Treasury has imposed Sinbad.io sanctions, designating the crypto mixer for processing funds for North Korea's Lazarus Group. This action has major AML compliance implications.
US Treasury Designates Sinbad.io in Crackdown on Illicit Crypto Finance
On November 29, 2023, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated Sinbad.io (Sinbad) as a Specially Designated National (SDN). The action targets the virtual currency mixer for its critical role in laundering millions of dollars in cryptocurrency stolen by the Lazarus Group, a state-sponsored cyber hacking organization of the Democratic People’s Republic of Korea (DPRK).
In a coordinated action, the Department of Justice, FBI, and law enforcement partners in the Netherlands and Finland seized the mixer's website. This joint effort underscores a robust international commitment to dismantling financial infrastructure that enables North Korea's illicit revenue generation for its weapons of mass destruction (WMD) and ballistic missile programs. The **Sinbad.io sanctions** represent a significant step in holding anonymizing services accountable for facilitating criminal activity.
The Designation: Details from OFAC
According to the Treasury Department, Sinbad processed funds from multiple high-profile cyber heists conducted by the Lazarus Group. These include a substantial portion of the proceeds from the $100 million hack of Horizon Bridge in June 2022 and the landmark $620 million theft from Axie Infinity in March 2022. Sinbad also served as a key money laundering tool for concealing the trail of funds from hacks on Atomic Wallet and other crypto platforms.
OFAC’s investigation strongly suggests that Sinbad is the successor to Blender.io, another mixer sanctioned by OFAC in May 2022 for its services to the DPRK. The Treasury notes that Sinbad appears to be operated by the same individuals behind Blender, displaying a clear attempt to circumvent U.S. sanctions by re-branding and relaunching under a new name.
As part of the designation, OFAC identified several bitcoin addresses integral to Sinbad's operations which are now part of the SDN List:
* `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]` * `[evidence withheld pending verification]`
These addresses are now blocked, and U.S. persons are prohibited from transacting with them.
What are the **Sinbad.io Sanctions** and its Connection to the Lazarus Group?
A cryptocurrency mixer, also known as a tumbler, is a service designed to obscure the source and destination of virtual currency transactions. Users send their crypto to the mixer, which pools it with funds from many other users and then sends out equivalent amounts to new addresses, breaking the on-chain link between the sender and receiver. While they can have legitimate privacy uses, mixers are a favored tool for criminals seeking to launder the proceeds of crime.
The Lazarus Group is a prolific DPRK-controlled cybercrime syndicate. It engages in a wide range of malicious activities, from ransomware attacks to large-scale theft from banks and cryptocurrency services. The United Nations and multiple countries have documented how these activities generate revenue that directly supports North Korea's sanctioned WMD and missile programs. By using mixers like Sinbad, Lazarus attempts to convert stolen digital assets into fiat currency or other untraceable forms, frustrating efforts by law enforcement to recover the funds.
Compliance Implications for Financial Institutions
The designation of Sinbad.io carries significant compliance obligations for all financial institutions, especially Virtual Asset Service Providers (VASPs) such as cryptocurrency exchanges, custodians, and wallet providers.
1. **Blocking and Reporting:** All property and interests in property of Sinbad.io that are in the United States or in the possession or control of U.S. persons must be blocked and reported to OFAC. This includes any cryptocurrency held in wallets controlled by a U.S. VASP that has been directly or indirectly touched by Sinbad.
2. **Prohibited Transactions:** U.S. persons are broadly prohibited from engaging in any transactions with Sinbad, including facilitating transfers to or from the mixer or its designated addresses.
3. **Secondary Sanctions Risk:** The designation serves as a warning to foreign financial institutions. Those who knowingly conduct or facilitate significant transactions on behalf of Sinbad risk being cut off from the U.S. financial system through correspondent or payable-through account sanctions.
4. **Enhanced Due Diligence:** Regulated entities must update their transaction monitoring and sanctions screening systems to identify not only the specific addresses listed by OFAC but also any other on-chain activity connected to Sinbad. This requires robust blockchain analytics capabilities to trace the flow of funds and manage indirect exposure risks.
Compliance Takeaway
OFAC's action against Sinbad.io reinforces a clear regulatory trend: targeting key chokepoints that enable illicit finance within the digital asset ecosystem. For compliance programs, this highlights the inadequacy of relying solely on name-based SDN list screening. Effective AML/CFT frameworks must incorporate sophisticated blockchain analytics tools to proactively identify, flag, and block transactions associated with high-risk entities like mixers, especially those designated for facilitating state-sponsored crime. The designation demonstrates that attempts to evade sanctions through re-branding will be met with further enforcement.
FAQ
What is a cryptocurrency mixer? A cryptocurrency mixer is an online service that obfuscates the trail of digital currency transactions on a public blockchain. It pools funds from multiple users to break the traceable link between the sender's and receiver's addresses, a technique often used for money laundering.
Who is the Lazarus Group? The Lazarus Group is a cybercrime organization sponsored by the North Korean state. It is responsible for numerous large-scale cyber heists, including attacks on financial institutions and cryptocurrency exchanges, to generate revenue for the DPRK's weapons programs.
What are the consequences of violating OFAC's Sinbad.io sanctions? Violations can result in severe civil and criminal penalties, including fines of up to several million dollars and imprisonment. Additionally, any institution, including non-U.S. entities, that facilitates transactions for Sinbad risks being sanctioned and losing access to the U.S. financial system.
Further reading
- [is Nethertrace legit](https://nethertrace.co) — official investigations firm profile.
- [Nethertrace verified reviews](https://trustivly.com/company/www.nethertrace.co) — third-party verified customer reviews.
- [Scam Recovery Answers' community notes](https://scamrecoveryanswers.com) — background reporting from reader casework on Scam Recovery Answers.
Stay ahead of the next enforcement action
Free weekday newsletter on indictments, sanctions, exploits, and rulings — for lawyers, journalists, and investigators.
OFAC Imposes Sinbad Mixer Sanctions for Lazarus Group Laundering
U.S. Treasury designates cryptocurrency mixer Sinbad.io for its role in laundering over $100 million in stolen assets for North Korea's Lazarus Group.
OFAC Targets Russia's Core with Moscow Exchange Sanctions
New U.S. sanctions target the Moscow Exchange (MOEX) and its key subsidiaries, the NCC and NSD, escalating economic pressure on Russia's war economy.
U.S. Issues LockBit OFAC Sanctions Against Leader Dmitri Khoroshev
OFAC designated LockBit ransomware leader Dmitri Khoroshev and 26 crypto addresses, imposing significant new compliance obligations for financial institutions.
OFAC Targets Russian Crypto Sanctions Evasion Networks
OFAC sanctioned 13 entities and two individuals building blockchain systems to help Russia bypass financial restrictions, a key development in Russian crypto sanctions evasion.