US Authorities Shut Down Sinbad Crypto Mixer

The US Department of the Treasury has imposed sanctions on the cryptocurrency mixing service Sinbad, alleging that it was used by the North Korean hacker group Lazarus for money laundering. The Office of Foreign Assets Control (OFAC) stated that sanctions against Sinbad.io (Sinbad) were enacted because the service was allegedly used by North Korean hackers involved in large-scale cryptocurrency thefts, resulting in losses totaling hundreds of millions of dollars.

According to a press release, “Millions of dollars in virtual currency linked to Lazarus heists, including incidents involving Horizon Bridge and Axie Infinity, were laundered through Sinbad. Sinbad was also used by cybercriminals to disguise transactions related to illicit activities such as sanctions evasion, drug trafficking, the purchase of materials related to child sexual abuse, and other illegal deals on darknet marketplaces.”

Background on the Lazarus Group’s Activities

Earlier this year, the FBI reported that it linked the hack of the Harmony Horizon cross-chain bridge to the Lazarus cyber-espionage group. Recently, researchers and law enforcement have attributed several major attacks to this group, including the previously mentioned Axie Infinity hack (with $620 million stolen), the Harmony Horizon attack (with $100 million stolen), as well as breaches of Atomic Wallet and the crypto service CoinsPaid (with $37 million stolen).

Authorities report that North Korean hacking groups steal and launder virtual currency to support state programs for developing ballistic missiles and weapons of mass destruction.

Details of the Sinbad Shutdown

According to the US Department of the Treasury, Sinbad was primarily used to launder funds stolen from Atomic Wallet, as well as during the Axie Infinity and Harmony Horizon hacks. In addition to the sanctions imposed on the crypto mixer, the Sinbad domain was seized, and a special notice on the website states that law enforcement agencies from the US, the Netherlands, and Poland participated in the operation.

It is also worth noting that the Sinbad site on the Tor network is currently offline, suggesting that the service’s servers were also seized by law enforcement.