The FBI said North Korean hackers used crypto mixer alternative Railgun to launder $63.5 million stolen from Harmony's Horizon Bridge — which it cited in sanctioning Tornado Cash.
The FBI has confirmed that North Korean hackers used crypto mixer alternative Railgun to launder more than $60 million stolen from Harmony's Horizon Bridge last year.
In the Jan. 23 announcement, the FBI said "North Korea's theft and laundering of virtual currency … is used to support North Korea's ballistic missile and weapons of mass destruction programs."
The FBI said that two North Korean government-sponsored hacking groups, the Lazarus Group and APT38, were involved in the Harmony hack.
Crypto Sanctions
In August, OFAC broke new ground by imposing sanctions on the Tornado Cash mixing service, a fully DAO-controlled decentralized finance project that became the first-ever piece of software hit with sanctions, which had previously only been imposed on people or businesses — which are legally "people."
In doing so, OFAC cited the use of Tornado Cash by Lazarus Group hackers, to launder part of the $100 million stolen in June's Harmony Protocol hack.
"Tornado Cash was subsequently used to launder more than $96 million of malicious cyber actors' funds derived from the June 24, 2022 Harmony Bridge Heist."
Tornado Cash sanctions were preceded by the May 6 designation of virtual crypto mixer Blender.io.
At the time of the Tornado Cash announcement, Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian Nelson warned that OFAC would "continue to aggressively pursue actions against mixers that launder virtual currency for criminals and those who assist them."
A Growing Problem
Unlike a traditional mixing service, Railgun does not seek to obfuscate transactions by mixing multiple transactions together. Instead it uses zk-SNARKS cryptography to make "transactions fully invisible," the service's website said. Railgun Project's website added:
"Every transaction appears on the blockchain as being sent from the Railgun contract address."