OFAC Imposes Sinbad Mixer Sanctions for Lazarus Group Laundering

U.S. Treasury designates cryptocurrency mixer Sinbad.io for its role in laundering over $100 million in stolen assets for North Korea's Lazarus Group.

· July 13, 2026 at 9:30 PM· 7 min read

OFAC Imposes Sinbad Mixer Sanctions for Lazarus Group Laundering

U.S. Treasury Designates Sinbad.io Mixer in Crackdown on DPRK Sanctions Evasion

**WASHINGTON** — In a significant enforcement action targeting North Korea’s illicit financing networks, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has designated Sinbad.io (Sinbad), a virtual currency mixer, for its material support to the Democratic People’s Republic of Korea (DPRK). The **Sinbad mixer sanctions**, announced on November 29, 2023, identify the service as a key money laundering tool for the Lazarus Group, a state-sponsored cyber hacking syndicate.

Concurrent with the OFAC designation, the Federal Bureau of Investigation (FBI), along with Dutch and Finnish law enforcement, seized the Sinbad.io website, effectively dismantling its operations. This coordinated action underscores a multi-pronged international effort to disrupt the infrastructure that enables DPRK’s weapons of mass destruction (WMD) and ballistic missile programs, which are funded in large part through stolen cryptocurrency.

According to the Treasury Department, Sinbad processed millions of dollars’ worth of virtual currency from major heists attributed to the Lazarus Group, including the high-profile thefts from Horizon Bridge and Axie Infinity. The mixer served as a direct successor to Blender.io, another mixer sanctioned by OFAC in May 2022 for similar activities.

The Lazarus Group and Illicit Finance

The Lazarus Group is one of the world's most prolific and disruptive state-sponsored cybercrime organizations. Operating under the direction of the DPRK’s primary intelligence agency, the Reconnaissance General Bureau, the group has executed numerous sophisticated cyber operations against financial institutions, cryptocurrency exchanges, and blockchain protocols globally.

Their primary objective is revenue generation for the North Korean regime, which is subject to extensive international sanctions. By stealing and subsequently laundering vast sums of cryptocurrency, the Lazarus Group provides a critical financial lifeline that allows the DPRK to continue advancing its illegal WMD programs. The use of anonymity-enhancing technologies, such as mixers, is a core component of their money laundering typology.

The Role of Sinbad.io in the Laundering Chain

Cryptocurrency mixers are services designed to obscure the trail of digital assets on a blockchain by pooling funds from multiple users and redistributing them. While they can have legitimate privacy use cases, they are frequently exploited for illicit purposes.

Sinbad.io emerged as a preferred mixer for the Lazarus Group following OFAC's designation of Blender.io. Analysts observed significant operational and on-chain overlaps between the two services, suggesting Sinbad was likely created and operated by the same individuals. The Treasury release notes that Sinbad was used to launder a significant portion of the over $100 million in cryptocurrency stolen from the June 2022 Harmony Bridge hack and has been linked to the laundering of funds from several other Lazarus Group exploits.

As part of the **Sinbad mixer sanctions**, OFAC added Sinbad.io to the Specially Designated Nationals and Blocked Persons (SDN) List and published several associated cryptocurrency addresses to aid compliance efforts:

* **Bitcoin (BTC):** `[evidence withheld pending verification]` * **Bitcoin (BTC):** `[evidence withheld pending verification]` * **Bitcoin (BTC):** `[evidence withheld pending verification]` * **Ethereum (ETH):** `[0x5a5740…111111](https://etherscan.io/address/0x5a5740a19452445618b7e289458925c48b111111)` * **Tron (TRX):** `TJF7nE5t2aXNb133Nf52f2s3p3zXvjCq9N` * **Tron (TRX):** `TWm2b2dt9mQjeo9dbuWnCjAbvDAE3NijJj` * **Tron (TRX):** `TTRBAD92fGZPTd29vj1A26kTuT2wzE1d9d` * **Dash (DASH):** `Xpbad45532a673b5a1a1410e353c9ca335` * **Bitcoin Cash (BCH):** `qp5bad9c1e7a57a53099908e2f6946cacde3d9d300`

Compliance Implications for Financial Institutions

The designation of Sinbad.io carries significant compliance obligations for all U.S. persons and entities, as well as potential secondary sanctions risks for foreign financial institutions.

1. **Asset Blocking:** All property and interests in property of Sinbad.io that are in the United States or in the possession or control of U.S. persons must be blocked and reported to OFAC. 2. **Transaction Prohibition:** U.S. persons are broadly prohibited from engaging in any transactions, directly or indirectly, with Sinbad.io. This includes processing transactions that have passed through the service. 3. **Screening Requirements:** Virtual Asset Service Providers (VASPs), exchanges, and other financial institutions must screen customer transactions against the newly designated addresses to prevent exposure to sanctioned funds. 4. **Secondary Sanctions Risk:** Foreign financial institutions that knowingly facilitate significant transactions or provide financial services for Sinbad.io risk being subjected to U.S. corrrespondent account or payable-through account sanctions.

Compliance Takeaway

This action reinforces the increasing focus by U.S. and international regulators on the tools and infrastructure that enable sanctions evasion and money laundering in the digital asset space. Compliance programs for financial institutions and VASPs must incorporate robust blockchain analytics tools capable of identifying exposure to designated mixers and their associated wallet addresses. Proactive screening and a risk-based approach that treats transactions involving mixers as high-risk are no longer optional but essential components of an effective AML/CFT framework.

---

Frequently Asked Questions

What is a cryptocurrency mixer? A cryptocurrency mixer, also known as a tumbler, is a service that obscures the on-chain link between a sender and receiver of digital assets. It achieves this by pooling funds from many users and mixing them together before sending them to their ultimate destinations, making blockchain-based tracing more difficult.