# Tornado Cash Founders Indicted Over Lazarus Laundering

Published: 2023-09-07 · Severity: low · Sectors: financial-services
Canonical: https://vorant.io/reports/96e52369-86e8-54e9-9414-7c94a4bcd039/tornado-cash-founders-indicted-over-lazarus-laundering

> US DOJ indicted Tornado Cash co-founders Roman Storm and Roman Semenov for laundering over $1 billion, including funds for North Korea's Lazarus Group.

The Justice Department unsealed an indictment against Roman Storm and Roman Semenov, co-founders of the cryptocurrency mixing service Tornado Cash, charging them with money laundering conspiracy, sanctions violations, and operating an unlicensed money transmitting business. The indictment alleges the pair knowingly allowed the DPRK-sponsored Lazarus Group to launder hundreds of millions of dollars in stolen cryptocurrency through their platform, despite receiving warnings from cybercrime victims and internally acknowledging that a supposed sanctions-compliance update to the service would be ineffective.

The case centers on Tornado Cash's failure to implement Know Your Customer (KYC) and Bank Secrecy Act compliance measures required of money services businesses, which investigators say enabled Lazarus Group to move funds from a wallet previously designated as blocked property by the Treasury's Office of Foreign Assets Control. Storm was taken into custody in Washington state on August 23; Semenov, a Russian national, remains at large and is the subject of an active FBI search.

While this is a law-enforcement and legal-accountability story rather than an active technical threat, it reinforces Lazarus Group's continued reliance on cryptocurrency mixers to launder proceeds from cyber theft, and signals continued U.S. enforcement pressure on infrastructure providers who facilitate such laundering.

## Mentioned in this report

- Threat actors: Lazarus Group

Source reporting: https://www.fbi.gov/news/stories/tornado-cash-co-founders-accused-of-helping-cybercriminals-launder-stolen-crypto

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/96e52369-86e8-54e9-9414-7c94a4bcd039/tornado-cash-founders-indicted-over-lazarus-laundering.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup