Tornado Cash Founders Indicted Over Lazarus Laundering
US DOJ indicted Tornado Cash co-founders Roman Storm and Roman Semenov for laundering over $1 billion, including funds for North Korea's Lazarus Group.
Sourcefbi.gov — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The Justice Department unsealed an indictment against Roman Storm and Roman Semenov, co-founders of the cryptocurrency mixing service Tornado Cash, charging them with money laundering conspiracy, sanctions violations, and operating an unlicensed money transmitting business. The indictment alleges the pair knowingly allowed the DPRK-sponsored Lazarus Group to launder hundreds of millions of dollars in stolen cryptocurrency through their platform, despite receiving warnings from cybercrime victims and internally acknowledging that a supposed sanctions-compliance update to the service would be ineffective.
The case centers on Tornado Cash's failure to implement Know Your Customer (KYC) and Bank Secrecy Act compliance measures required of money services businesses, which investigators say enabled Lazarus Group to move funds from a wallet previously designated as blocked property by the Treasury's Office of Foreign Assets Control. Storm was taken into custody in Washington state on August 23; Semenov, a Russian national, remains at large and is the subject of an active FBI search.
While this is a law-enforcement and legal-accountability story rather than an active technical threat, it reinforces Lazarus Group's continued reliance on cryptocurrency mixers to launder proceeds from cyber theft, and signals continued U.S. enforcement pressure on infrastructure providers who facilitate such laundering.
Mentioned in this report
Source reporting: https://www.fbi.gov/news/stories/tornado-cash-co-founders-accused-of-helping-cybercriminals-launder-stolen-crypto
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs