Sinbad

Sinbad is a threat actor suspected to be operated by North Korean operatives, primarily for the purpose of laundering stolen cryptocurrency. According to Chainalysis, Sinbad processed $24 million in December and January, indicating its use as a new mixing service. However, it's effectiveness is yet to be determined in comparison to other established services like Tornado Cash. The link between the Sinbad mixer and the Atomic Wallet, as identified by Elliptic, suggests the involvement of Lazarus Group, a notorious North Korean hacking team known for their cyber heists. The US Treasury Department's Office of Foreign Assets Control (OFAC) has sanctioned Sinbad, along with other crypto-mixing services such as Tornado Cash and Blender.io, which were reportedly used by North Korean hacking groups to launder funds stolen in multiple hacks including those of Atomic Wallet, Axie Infinity, Nomad, and Horizon. The Lazarus Group has allegedly used Sinbad to process millions of dollars worth of virtual currency from these crypto heists. Furthermore, researchers have noted that the stolen assets are being laundered using specific services, including Sinbad, which have also been used to launder proceeds from past hacks perpetrated by the Lazarus Group. However, in November, US authorities seized Sinbad, forcing the Lazarus Group to shift back to using Tornado Cash. This action was followed by an increase in the use of another mixer, YoMix, after the takedown of Sinbad. It is believed that the Lazarus Group is using this Bitcoin mixer to launder funds, with inflows growing more than five-fold in 2023. Despite these measures, the trail of $54 million of Bitcoin sent to the Sinbad mixer has gone cold, according to Elliptic.