The U.S. Treasury Department’s Office of Foreign Asset Control added a single solitary Ethereum address to its Specially Designated Nationals list, otherwise known as its sanctions list.
The address was tied to the hack of Axie Infinity’s Ronin Bridge, which saw some 173,000 ETH and 25.5 million USDC (worth around $625 million on March 29) stolen from the bridge network.
What’s really interesting is the wallet continued to send funds out after it was added to the sanctions list. Within 24 hours the controller of the wallet – said to be the North Korean hacker organization known as Lazarus – sent nearly 3,000 ETH to coin mixer Tornado Cash, repeating a pattern the hackers began after stealing the ether.
These transfers out continued through earlier this week. In many cases, the funds appear to have gone to an intermediary wallet before being sent to Tornado Cash.
In the past, helping sanctioned parties launder funds using crypto led parties being added to the sanctions list themselves.
Anand Sithian, counsel at Crowell & Morning and a former trial attorney in the money laundering division at the U.S. Department of Justice, said crypto companies should watch for addresses and wallets tied to mixers, and in particular the fact that regulators like the Financial Crimes Enforcement Network have “highlighted the financial crimes risks associated with mixers, which obfuscate the source of transactions, and thereby prevent tracing transactions on the blockchain.”
“To the extent there are U.S. touchpoints, or U.S. persons involved in such transactions, crypto companies could face enforcement from FinCEN, OFAC, and/or the U.S. Department of Justice, depending on the activity at issue and whether any U.S. laws were violated,” he said. “Even without a violation, an investigation can be incredibly taxing on resources and distracting to leadership. As a result, crypto companies may wish to steer clear of mixers, to the extent possible.”
Tornado Cash’s executives have said that sanctions cannot be applied to the protocol itself, former CoinDesker and current Bloomberger Muyao Shen reported last month.
On Friday, the mixer added a Chainalysis compliance tool to its user-facing decentralized application that blocks transactions from the sanctioned address – though, again, the protocol itself is unaffected.
Regulators may not agree, but at least so far, the funds are continuing to move.
Meanwhile, on the North Korea front, the U.S. government is warning that the nation may continue to try and exploit crypto companies (and others) to raise funds.
