Dutch authorities arrest 29-year-old dev with suspected ties to Tornado Cash
(2022/08/15)
- Reference: 1660584673
- News link: https://www.theregister.co.uk/2022/08/15/tornado_cash_suspect_arrested/
- Source link:
Dutch authorities have arrested a software developer suspected of working with Tornado Cash, a cryptocurrency mixing service that only two days earlier was sanctioned by the US government for allegedly laundering money for ransomware operators and other cybercriminals.
The 29-year-old man is accused of being part of the decentralized Ethereum mixing service's operations, including "concealing criminal financial flows and facilitating money laundering through the mixing of cryptocurrencies," officials with the Dutch Fiscal Information and Investigation Service (FIOD) wrote in a [1]statement .
No other information about the subject was released.
[2]
In [3]leveling the sanctions on August 8, the US Treasury Department said Tornado Cash was been used to launder hundreds of millions of dollars stolen by such threat groups as Lazarus Group, a high-profile North Korean-sponsored ransomware gang.
[4]
[5]
The US government has put a focus on crypto mixers – also known as "tumblers" – calling them a national security threat and saying they propagate ransomware attacks by giving the cybercriminals a place to hide and launder their stolen assets and another avenue for enhancing their anonymity.
The move against Tornado Cash came three months after similar sanctions were place on another crypto mixer, [6]Blender.io . The sanctions put a freeze on the assets of both mixing services and prohibit US citizens and companies from doing business with either one without written permission from the US government.
[7]
Other countries, including the Netherlands, also are targeting such services.
"These advanced technologies, such as decentralised organisations that may facilitate money laundering are receiving extra attention from the FIOD," the Dutch agency said in its statement. "Also in the cryptocurrency domain, the FIOD stands for a safe financial Netherlands and investigates with effect and impact."
[8]Cryptocurrency laundromat Blender shredded by US Treasury in sanctions first
[9]US warns North Korean Lazarus gang rising against cryptocurrency outfits
[10]Black Hat and DEF CON visitors differ on physical risk management
[11]Palo Alto bug used for DDoS attacks and there's no fix yet
The agency added that "multiple arrests are not ruled out."
Crypto mixers take digital assets from multiple transactions and mix them together, essentially obfuscating their origins and destinations. After mixing those assets, the services then send them out to recipients. Tornado Cash, which is on the Ethereum blockchain, processes any anonymous transactions, according to the US Treasury, so cryptocurrency stolen by threat groups can be mixed with legitimate digital assets, making them difficult to track.
Ransomware and other extortion schemes were around before the rise of cryptocurrency, but crypto is among the drivers of the skyrocketing use of the malware. In a [12]report [PDF] earlier this year, US Treasury wrote that ransomware groups often target larger enterprises in search of a bigger ransom payment and that services like Tornado Cash and Blender help in laundering all that money.
[13]
"To further obfuscate the laundering of ransomware proceeds, threat actors avoid using the same wallet addresses and use chain hopping, mixing services, and decentralized exchanges," the report's authors wrote.
Tornado Cash allegedly laundered more than $455 million stolen by Lazarus, including more than $96 million in digital assets taken in June from blockchain startup Harmony's Horizon Bridge service.
It also allegedly was used to launder money in high-profile attacks this year against such organizations as Beanstalk Farms, a decentralized finance platform, decentralized autonomous organization Inverse Finance, and Nomad, another cryptocurrency bridge.
FOID officials said the agency's Financial Advanced Cyber Team (FACT) began a criminal investigation of Tornado Cash in June, saying that the mixing service "has been used to conceal large-scale criminal money flows, including from (online) thefts of cryptocurrencies (so-called crypto hacks and scams). These included funds stolen through hacks by a group believed to be associated with North Korea."
Investigating money laundering is a priority for the Dutch government, they said in the statement.
"By disguising the criminal origin of the proceeds of a crime, perpetrators are able to remain beyond the reach of the investigative authorities and enjoy their undisturbed criminal earnings," they said, adding that money-laundering operations like crypto mixers "is a new phenomenon that is receiving explicit attention from the FIOD." ®
Get our [14]Tech Resources
[1] https://www.fiod.nl/arrest-of-suspected-developer-of-tornado-cash/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YvrCEwXtlgD7TZvklq-bmAAAANU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2022/08/08/treasury_sanctions_tornado_cash_korea/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YvrCEwXtlgD7TZvklq-bmAAAANU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YvrCEwXtlgD7TZvklq-bmAAAANU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2022/05/06/us_treasury_sanctions_blender/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YvrCEwXtlgD7TZvklq-bmAAAANU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2022/05/06/us_treasury_sanctions_blender/
[9] https://www.theregister.com/2022/04/20/lazarus-targets-digital-assets/
[10] https://www.theregister.com/2022/08/15/black_hat_covid/
[11] https://www.theregister.com/2022/08/12/palo_alto_bug/
[12] https://home.treasury.gov/system/files/136/2022-National-Money-Laundering-Risk-Assessment.pdf
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YvrCEwXtlgD7TZvklq-bmAAAANU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
The 29-year-old man is accused of being part of the decentralized Ethereum mixing service's operations, including "concealing criminal financial flows and facilitating money laundering through the mixing of cryptocurrencies," officials with the Dutch Fiscal Information and Investigation Service (FIOD) wrote in a [1]statement .
No other information about the subject was released.
[2]
In [3]leveling the sanctions on August 8, the US Treasury Department said Tornado Cash was been used to launder hundreds of millions of dollars stolen by such threat groups as Lazarus Group, a high-profile North Korean-sponsored ransomware gang.
[4]
[5]
The US government has put a focus on crypto mixers – also known as "tumblers" – calling them a national security threat and saying they propagate ransomware attacks by giving the cybercriminals a place to hide and launder their stolen assets and another avenue for enhancing their anonymity.
The move against Tornado Cash came three months after similar sanctions were place on another crypto mixer, [6]Blender.io . The sanctions put a freeze on the assets of both mixing services and prohibit US citizens and companies from doing business with either one without written permission from the US government.
[7]
Other countries, including the Netherlands, also are targeting such services.
"These advanced technologies, such as decentralised organisations that may facilitate money laundering are receiving extra attention from the FIOD," the Dutch agency said in its statement. "Also in the cryptocurrency domain, the FIOD stands for a safe financial Netherlands and investigates with effect and impact."
[8]Cryptocurrency laundromat Blender shredded by US Treasury in sanctions first
[9]US warns North Korean Lazarus gang rising against cryptocurrency outfits
[10]Black Hat and DEF CON visitors differ on physical risk management
[11]Palo Alto bug used for DDoS attacks and there's no fix yet
The agency added that "multiple arrests are not ruled out."
Crypto mixers take digital assets from multiple transactions and mix them together, essentially obfuscating their origins and destinations. After mixing those assets, the services then send them out to recipients. Tornado Cash, which is on the Ethereum blockchain, processes any anonymous transactions, according to the US Treasury, so cryptocurrency stolen by threat groups can be mixed with legitimate digital assets, making them difficult to track.
Ransomware and other extortion schemes were around before the rise of cryptocurrency, but crypto is among the drivers of the skyrocketing use of the malware. In a [12]report [PDF] earlier this year, US Treasury wrote that ransomware groups often target larger enterprises in search of a bigger ransom payment and that services like Tornado Cash and Blender help in laundering all that money.
[13]
"To further obfuscate the laundering of ransomware proceeds, threat actors avoid using the same wallet addresses and use chain hopping, mixing services, and decentralized exchanges," the report's authors wrote.
Tornado Cash allegedly laundered more than $455 million stolen by Lazarus, including more than $96 million in digital assets taken in June from blockchain startup Harmony's Horizon Bridge service.
It also allegedly was used to launder money in high-profile attacks this year against such organizations as Beanstalk Farms, a decentralized finance platform, decentralized autonomous organization Inverse Finance, and Nomad, another cryptocurrency bridge.
FOID officials said the agency's Financial Advanced Cyber Team (FACT) began a criminal investigation of Tornado Cash in June, saying that the mixing service "has been used to conceal large-scale criminal money flows, including from (online) thefts of cryptocurrencies (so-called crypto hacks and scams). These included funds stolen through hacks by a group believed to be associated with North Korea."
Investigating money laundering is a priority for the Dutch government, they said in the statement.
"By disguising the criminal origin of the proceeds of a crime, perpetrators are able to remain beyond the reach of the investigative authorities and enjoy their undisturbed criminal earnings," they said, adding that money-laundering operations like crypto mixers "is a new phenomenon that is receiving explicit attention from the FIOD." ®
Get our [14]Tech Resources
[1] https://www.fiod.nl/arrest-of-suspected-developer-of-tornado-cash/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YvrCEwXtlgD7TZvklq-bmAAAANU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2022/08/08/treasury_sanctions_tornado_cash_korea/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YvrCEwXtlgD7TZvklq-bmAAAANU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YvrCEwXtlgD7TZvklq-bmAAAANU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2022/05/06/us_treasury_sanctions_blender/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YvrCEwXtlgD7TZvklq-bmAAAANU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2022/05/06/us_treasury_sanctions_blender/
[9] https://www.theregister.com/2022/04/20/lazarus-targets-digital-assets/
[10] https://www.theregister.com/2022/08/15/black_hat_covid/
[11] https://www.theregister.com/2022/08/12/palo_alto_bug/
[12] https://home.treasury.gov/system/files/136/2022-National-Money-Laundering-Risk-Assessment.pdf
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YvrCEwXtlgD7TZvklq-bmAAAANU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
Re: Nobody legitimate is using a tumbler. So why bother?
Anonymous Coward
Quite a chunky assumption. Someone may wish to divorce their cryptocurrency from a known wallet for the purposes of privacy. For example, a journalist paying a source exposing criminal government corruption.
Re: Nobody legitimate is using a tumbler. So why bother?
Snowy
The assumption that everyone that is using a tumbler has a legitimate use is an even bigger one.
Re: Nobody legitimate is using a tumbler. So why bother?
Anonymous Coward
Which is why I didn't make it.
Re: Nobody legitimate is using a tumbler. So why bother?
Ian Johnston
Or just hand over a wad of used dollar bills.
Good
druck
When I said the people behind Tornado Cash should be up on charges [1]https://forums.theregister.com/forum/all/2022/08/08/treasury_sanctions_tornado_cash_korea , I got down voted by the crypto-shills, luckily no one was listening to them.
[1] https://forums.theregister.com/forum/all/2022/08/08/treasury_sanctions_tornado_cash_korea/#c_4509137
Laundry
HildyJ
First, I am a crypto Hodler via a publicly traded coin trust regulated by the SEC.
Second, major investors buy crypto for a number of reasons. Some of these are nefarious (like buying illegal goods) but most aren't.
Third, users of tumblers, OTOH, are almost all nefarious. Why else accept the significant discount you pay when switching coins? It's the difference between people who use a pawn shop and those who use a fence.
Coincidently, Gizmodo was looking at news they have covered through the years and commented on the Bitcoin Manifesto, calling it "the pipiest of pipe dreams.”
Re: Laundry
Ian Johnston
There are no investors in crypto. There are only gamblers with crypto. Wen lambo?
What I've never understood about tumblers is why.
Every single person using a tumbler is doing it for nefarious reasons - to hide their drug money, etc.
Nobody legitimate is using a tumbler. So why bother?
Surely using Monero or Zcash is more sensible?