sinbad.io

Sinbad.io, a threat actor identified as a popular money-laundering outlet for state-sponsored crypto thieves, emerged as a significant player in the cybercrime landscape over the past few years. Following U.S. sanctions on Tornado Cash, a previously favored service by North Korean hackers to obfuscate the source of their stolen funds, these actors turned to Sinbad.io and other alternatives. The shift was notable due to an 85% decline in overall volume observed in Tornado Cash usage post-sanctions in August 2022. Sinbad.io, along with cross-chain bridges, became the preferred choice for these hackers, allowing them to continue their illicit activities. However, this respite was short-lived. Sinbad.io, which had become a key tool in the arsenal of the notorious Lazarus Group, was seized by U.S. authorities in November 2023. This operation was carried out with the assistance of Dutch and Polish authorities, following a decision to blacklist the cryptocurrency mixer. Sinbad.io's seizure represented a significant blow to the operations of the Lazarus Group, who were allegedly using the service to launder assets procured through multiple crypto heists. In response to the takedown of Sinbad.io, the Lazarus Group reverted to using Tornado Cash for their operations. Despite previous sanctions, Tornado Cash has continued to operate owing to its decentralized nature, making it immune to seizures like centralized mixers such as Sinbad.io. The Lazarus Group now appears to be laundering funds at scale and obfuscating their transaction trail through Tornado Cash, reflecting the limited number of large-scale mixers currently operating due to law enforcement actions against services like Sinbad.io and Blender.io.