Loading story…
The U.S. Department of the Treasury sanctioned the Ethereum-based crypto mixer Tornado Cash, barring U.S. persons from using it and requiring any U.S.-linked assets associated with the service to be reported to the Office of Foreign Assets Control. Treasury said the mixer was used to launder proceeds from major cryptocurrency thefts, including the $625 million Axie Infinity/Ronin hack that the FBI attributed to North Korea’s Lazarus Group, and said the service failed to implement effective controls to stop repeated abuse by malicious cyber actors.
Dutch judges later convicted Tornado Cash co-founder Alexey Pertsev of money laundering and sentenced him to five years and four months in prison, concluding that the platform was designed in a way that enabled concealment and was well suited for criminal use. Prosecutors said Tornado Cash laundered $1.2 billion tied to at least 36 hacks, including thefts from Axie Infinity and KuCoin, extending a broader crackdown that also included U.S. action against co-founders Roman Storm and Roman Semenov.
See the reporting duties and controls this puts on the clock.
9 events from the most recent confirmed update back to the earliest known activity.
During Roman Storm's federal criminal trial in the Southern District of New York, jurors told the court they were deadlocked on some counts after several days of deliberations. Judge Katherine Polk Failla issued an Allen charge directing them to continue deliberating, while indicating the court could accept a partial verdict and leave unresolved counts open to retrial.
After closing arguments in the Southern District of New York, Roman Storm's criminal case over Tornado Cash was handed to the jury for deliberations. The step marked the formal end of the trial phase before jurors later reported deadlock on some counts.
The U.S. government removed OFAC sanctions on Tornado Cash, reversing the 2022 designation that had barred U.S. persons from transacting with the crypto mixer. The move marked a major change in the legal and regulatory status of Tornado Cash after years of litigation and enforcement actions.
A Dutch court convicted Tornado Cash co-founder Alexey Pertsev of money laundering and sentenced him to five years and four months in prison. Prosecutors said Tornado Cash laundered $1.2 billion from at least 36 hacks, and the court found the platform was suited for criminal use.
U.S. prosecutors unsealed an indictment charging Tornado Cash co-founders Roman Storm and Roman Semenov with money laundering conspiracy, sanctions violations, and operating an unlicensed money transmitting business. Authorities announced Storm's arrest in Washington, while Semenov remained at large, alleging the mixer facilitated more than $1 billion in illicit transactions including Lazarus Group laundering.
A U.S. federal district court ruled in favor of the Treasury Department in litigation challenging OFAC's 2022 sanctions on Tornado Cash. The decision marked a major legal development by finding the sanctions authority could apply to the mixer despite arguments from users and advocates.
Dutch fiscal investigators arrested a suspected Tornado Cash developer in the Netherlands on suspicion of involvement in concealing criminal financial flows and facilitating money laundering through the mixer. The arrest came days after the U.S. Treasury sanctioned Tornado Cash.
The U.S. Department of the Treasury sanctioned the Tornado Cash cryptocurrency mixer, barring U.S. persons from transacting with it and requiring U.S.-based related assets to be reported to OFAC. Treasury said the service had been used to launder proceeds from major hacks and had failed to implement effective controls against abuse.
After the March 2022 theft of about $625 million from the Axie Infinity blockchain, the stolen cryptocurrency was laundered through Tornado Cash. U.S. authorities later attributed the hack to North Korea's Lazarus Group.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
16 references tracked. Mallory keeps watching after this page renders.
thedefiant.io
Open sourcethedefiant.io
Open sourcethedefiant.io
Open sourcetherecord.media
Open sourcetechcrunch.com
Open sourceweb.archive.org
Open sourcehome.treasury.gov
Open sourcefbi.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities attributed the theft from the Ronin Network bridge used by the **Axie Infinity** ecosystem to North Korea-linked actors, identifying **Lazarus Group** and **APT38** as responsible for one of the largest cryptocurrency heists on record. The breach drained roughly **$540 million to $615 million** in **ETH** and **USDC**, and the U.S. Treasury’s Office of Foreign Assets Control sanctioned an Ethereum address tied to the operation. The case reinforced longstanding warnings that DPRK-backed cyber units are using large-scale cryptocurrency theft to generate revenue outside the formal financial system. Blockchain investigators reported that the stolen assets were laundered in stages, with attackers converting **USDC** into **ETH** through decentralized exchanges before routing funds through **Tornado Cash** to hinder tracing and evade token freezes, AML screening, and KYC controls at centralized exchanges. Researchers and law enforcement said the Ronin theft fit a broader pattern of North Korean crypto operations that had expanded from targeting centralized exchanges to attacking DeFi platforms and cross-chain bridges, while later recovery efforts showed that coordinated action by the crypto community could make cashing out stolen funds more difficult.
Jun 29, 2026
The U.S. Treasury Department sanctioned eight alleged Tren de Aragua (TdA) members, two Mexico-based companies, and seven **TRON** cryptocurrency addresses over an ATM-jackpotting operation that allegedly stole more than **$40 million** from U.S. banks. Treasury said the Mexico- and Venezuela-based network used custom malware to force ATMs and interactive teller machines to dispense cash without debiting accounts, causing reported losses of $40.73 million in more than 1,500 attacks through August 2025. Among those designated is alleged malware developer and FBI Top Ten fugitive Anibal Alexander Canelon Aguirre, known as “Prometheus,” as well as alleged senior TdA leader Juan Gabriel Rivas Nunez. Authorities said the group laundered cash-out proceeds through complex cryptocurrency channels to TdA leadership. The seven sanctioned exchange-hosted TRON deposit addresses received approximately $6.1 million from March 2022 and transferred funds onward to TdA-linked wallets. The designations, issued under Executive Orders 13581 and 13224, block U.S.-linked property interests and create secondary-sanctions exposure for foreign financial institutions that knowingly facilitate significant transactions for the listed parties. The Justice Department has indicted 98 people in the alleged nationwide conspiracy since October 2025 on charges including bank fraud, bank burglary, money laundering, and material support.
Oct 2, 2026
U.S. prosecutors and courts advanced multiple cases tied to large-scale cryptocurrency fraud and laundering operations that targeted American victims through fake trading platforms and social-engineering lures. In one California case, **Jingliang Su**, a Chinese national, was sentenced to 46 months in prison after admitting he helped launder more than **$36.9 million** stolen from 174 victims by a scam network operating from Cambodia; the court also ordered more than **$26.8 million** in restitution. Authorities said the fraud used unsolicited messages, calls, texts, dating platforms, and bogus crypto-investment websites to persuade victims to transfer funds, which were then routed through U.S. shell companies, bank accounts, Deltec Bank in the Bahamas, and **Tether (`USDT`) wallets** controlled abroad. In a related prosecution, **Daren Li**, a dual citizen of China and St. Kitts and Nevis, pleaded guilty to conspiracy to commit money laundering after authorities said he and co-conspirators moved more than **$73 million** in victim proceeds through shell companies, U.S. financial accounts, wire transfers, and conversion into `USDT`; he was later sentenced to **20 years in federal prison**. The cases form part of a broader Justice Department crackdown on transnational crypto-enabled investment scams and money-laundering networks, with officials reporting that multiple co-conspirators have pleaded guilty and that the U.S. Secret Service played a central investigative role.
Jun 29, 2026