Among the $7 billion in laundered money, over $455 million was stolen by the Lazarus Group, a Democratic People’s Republic of Korea (DPRK) state-sponsored hacking group sanctioned by the United States in 2019 in the largest known virtual currency heist to date (worth almost $620 million).
As a virtual currency mixer, Tornado Cash “operates on the Ethereum blockchain and indiscriminately facilitates anonymous transactions by obfuscating their origin, destination, and counterparties, with no attempt to determine their origin,” OFAC stated in its press release. “Tornado receives a variety of transactions and mixes them together before transmitting them to their individual recipients.”
“Despite public assurances otherwise, Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors on a regular basis and without basic measures to address its risks,” said Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian Nelson. “Treasury will continue to aggressively pursue actions against mixers that launder virtual currency for criminals and those who assist them.”
Tornado Cash has been added to OFAC’s Specially Designated Nationals (SDN) and Blocked Persons List, meaning all property and interests in property associated with Tornado Cash in the United States or in the possession or control of U.S. persons is blocked and must be reported to OFAC. In addition, any entities that are owned, directly or indirectly, 50 percent or more by one or more blocked persons are also blocked.
“All transactions by U.S. persons or within (or transiting) the United States that involve any property or interests in property of designated or otherwise blocked persons are prohibited unless authorized by a general or specific license issued by OFAC, or exempt,” OFAC stated.
Broader Industry Threat
“While most virtual currency activity is licit, it can be used for illicit activity, including sanctions evasion through mixers, peer-to-peer exchangers, darknet markets, and exchanges,” OFAC stated. “This includes the facilitation of heists, ransomware schemes, fraud, and other cybercrimes.”
According to the Treasury Department’s “2022 National Money Laundering Risk Assessment” report, criminals have increased their use of anonymity-enhancing technologies, including mixers, to help hide the movement or origin of funds.
OFAC’s action against Tornado Cash was taken pursuant to Executive Order 13694, as amended. The action follows OFAC’s first-ever sanctions, announced May 6, against a virtual currency mixer, Blender.io (Blender). In that case, Blender was used by the DPRK “to support its malicious cyber activities and money-laundering of stolen virtual currency,” including the processing of $20.5 million in illicit proceeds stolen by the Lazarus Group, according to OFAC.
OFAC’s enforcement activity targeting virtual currency mixers is being conducted in concert with other local and foreign enforcement agencies. For example, the Financial Crimes Enforcement Network (FinCEN) in October 2020 assessed a $60 million civil money penalty against the owner and operator of virtual currency mixer Helix for BSA violations—FinCEN’s first ever enforcement action against a bitcoin mixer.
Sanctions Compliance Takeaways
From a sanctions compliance standpoint, compliance officers in the virtual-currency industry play a critical role in complying with Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) and sanctions obligations to prevent sanctioned persons and other illicit actors from exploiting virtual currency to undermine U.S foreign policy and national security interests.
“As part of that effort, the industry should take a risk-based approach to assess the risk associated with different virtual currency services, implement measures to mitigate risks, and address the challenges anonymizing features can present to compliance with AML/CFT obligations,” OFAC stated.
As the Tornado Cash action and others like it demonstrates, OFAC stated, “mixers should, in general, be considered a high risk by virtual currency firms, which should only process transactions if they have appropriate controls in place to prevent mixers from being used to launder illicit proceeds.” 
Jaclyn Jaeger is a contributing editor at Compliance Chief 360° and a freelance business writer based in Manchester, New Hampshire.