Blockchain analytics company Elliptic said in a blog post on Monday that an anonymizing service for crypto transactions that was shut down last year has likely re-launched under a new name.
Wallets of on Bitcoin and Ethereum blockchains were put on a U.S. sanctions list in May 2022 after it turned out North Korean hacker group Lazarus used the service to launder cybercrime proceeds. The U.S. Treasury Department Lazarus was behind the infamous Ronin hack, when $625 million worth of crypto was stolen from a blockchain bridge protocol used by the popular NFT game Axie Infinity.
The hackers then used cross-chain bridges and mixers to launder the proceeds of the hack, and was among them. The mixer ceased operations in April, but Elliptic said a similar service was launched in October, which received crypto from Blender.io-linked wallets and also was used by Lazarus.
Previously, Lazarus used and Tornado Cash, another sanctioned mixer whose developer Andrey Pertsev is now under arrest in Netherlands. Unlike , Tornado Cash is still working, despite its addresses being on the Office of Foreign Control (OFAC) sanctions list, Elliptic said. But Blender shut down and Sinbad seems to take its place, the blog reads.
The North Korean hackers used Tornado Cash and Sinbad to launder the crypto they stole from Horizon, another blockchain bridge allowing users to trade assets between the Harmony blockchain and other chains. $100 million worth of crypto was stolen from Horizon in June, and part of it went to Sinbad, Elliptic said.
There are signs the same people might be behind Sinbad and , Elliptic said. For example, before Sinbad was launched officially, its wallet received bitcoin from a wallet “believed to be controlled by the operator of Blender.” The founders might have been testing the new service, Elliptic suggested.
After Sinbad was launched, most of incoming transactions would come from a wallet linked to , and Sinbad operators rewarded promoters of the new mixer also from a wallet related to Blender. The two mixers had similar patterns of work, Elliptic said, and both have Russian-speaking websites and tech support teams, meaning both might have roots in Russia or Russian-speaking countries.
