Treasury sanctions virtual currency mixer Blender for money laundering

Blender was used to launder $20.5 million of the $620 million that the Treasury Department alleges North Korean hackers stole in March.

The Treasury Department said Friday it has sanctioned Blender.io, a so-called virtual currency mixer which Treasury alleges that the North Korean government uses to pay for its hacking program and to launder stolen virtual currency.

The Office of Foreign Assets Control (OFAC) at Treasury issued the sanctions, alleging that on March 23 the North Korean state-sponsored cyber hackers known as the Lazarus Group stole a record-setting $620 million from a blockchain project linked to the Pokemon-inspired blockchain game Axie Infinity.

Blender was used to process more than $20.5 million of the $620 million, which a Treasury Department press release alleged is being used to finance North Korea’s weapons of mass destruction and ballistic missile programs.

Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian Nelson said the sanctions are the first for a virtual currency mixer. Blender operates on the Bitcoin blockchain. The Treasury Department press release said it “indiscriminately facilitates illicit transactions by obfuscating their origin, destination” and more.

Blender, one of the most popular mixers in the cybercrime underground, intermingles many transactions before transmitting them to their ultimate destinations, ostensibly for privacy reasons, the press release said. The anonymity that virtual currency mixers afford makes them popular with hackers and criminals, according to Treasury, which said that Blender has helped transfer more than $500 million in Bitcoin since 2017 when it launched.

“Virtual currency mixers that assist illicit transactions pose a threat to U.S. national security interests,” Nelson said in a statement. “We are taking action against illicit financial activity by the DPRK and will not allow state-sponsored thievery and its money-laundering enablers to go unanswered.”

OFAC sanctioned the Lazarus Group in 2019, alleging it was under the control of North Korean intelligence, which is also involved in the conventional arms trade. The Treasury press release said that in addition to the Lazarus Group, Blender has been used to launder money for Russian-linked malign ransomware groups including Trickbot, Conti, Ryuk, Sodinokibi and Gandcrab.

In recent months, Treasury has also levied other first-of-their-kind crypto sanctions: a cryptocurrency exchange allegedly involved in facilitating ransomware funds and a mining firm.

CyberScoop was not able to immediately reach Blender for comment.

Treasury sanctions First VPN Service, others for abetting ransomware gangs

The designations hit 1VPNS, its alleged Ukrainian administrator and a Belarusian who allegedly sold “cryptors” to disguise ransomware and other malware.

North Korean companies, people sanctioned for money laundering from cybercrime, IT worker schemes

Treasury Department targets Southeast Asia scam hubs with sanctions

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure