Background:
On Friday November 29, 2023, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Sinbad.io (“Sinbad”), alleging that the virtual currency mixer serves as a key money-laundering tool of a North Korean state-sponsored malicious cyber group known as the Lazarus Group.1
OFAC has been tracking the Lazarus Group for some time. On September 13, 2019, OFAC designated that entity as a Specially Designated National (“SDN”) for being an agency, instrumentality or controlled entity of the Democratic People’s Republic of Korea (“DPRK”).
OFAC’s press release also explains that industry experts believe Sinbad was used as a successor to the Blender.io mixer, which OFAC previously designated for providing mixing services to the Lazarus Group. In fact this connection was reported by crypto researchers as early as February 2023.2
Seizure of Mixing Service and Equipment
Sinbad’s website reflects the scope of this international law enforcement operation. The logos of the FBI, DOJ, the Dutch FIOD, the Finnish National Bureau of Investigation, and Openbaar Ministerie (the Netherlands' public prosecutor's office) now adorn the seized mixing service as set out below.
As part of the seizure, FIOD’s website also reports that “the servers of Sinbad.io were seized in the Netherlands and Finland.”
Sanctions Imposed and Implications
Sinbad is being designated on two grounds under (1) OFAC’s Cyber-Related Sanctions program, under Executive Order (“E.O.”) 13694, as amended by E.O. 13757; and (2) its North Korea Sanctions program, under E.O. 13722.
Two main implications result from OFAC’s designation.
First, Sinbad has been designated as an SDN, and made subject to blocking sanctions, under which “all property and interests in property of the entity described above that are in the United States or in the possession or control of U.S. persons must be blocked and reported to OFAC.” Once determined that a person within OFAC’s jurisdiction has such blocked property, initial blocked property reports to OFAC are due within 10 business days.
Second, OFAC’s regulations generally prohibit all dealings by U.S. persons or within the United States (including transactions transiting the United States) that involve any property or interests in property of a blocked or designated entity such as Sinbad.
OFAC’s press release also warns that “persons that engage in certain transactions with the entity designated today may themselves be exposed to sanctions” reflecting OFAC’s intention to enforce secondary sanctions against U.S. or non-U.S. persons within the scope of OFAC’s jurisdiction. The latter consequence also expressly includes any “transactions transiting the United States” meaning that OFAC is not cabining its enforcement efforts to U.S. persons, but looking to non-U.S. persons who may “cause” a U.S. person to violate sanctions by virtue of any transactions transiting the United States.
Legal Tokens
From a legal perspective, OFAC’s ability to sanction mixing services remains intact, while legal challenges against its prior designation of Tornado Cash continue to work their way through the U.S. legal system. There are currently at least two cases, Van Loon v. Dep't of Treasury in the U.S. District Court for the Western District of Texas, and Coin Ctr. v. Yellen in the U.S. District Court for the Northern District of Florida, testing whether OFAC’s designation of Tornado Cash will be upheld. Both decisions are on appeal to their respective United States Courts of Appeal (in the Fifth Circuit, for Van Loon, and the Eleventh Circuit, for Coin Ctr).
We will continue to closely monitor developments in this space. For now, anyone utilizing the services of or interacting with crypto mixers should consult with an attorney to make sure that the possible legal implications are considered.
____________________________________
1 The complete sanctions designation by OFAC, including digital currency addresses, is as follows: SINBAD (a.k.a. SINBAD.IO); Website https://sinbad.io; alt. Website http://sinbadiovklgdbafpqvwfwjh2tfrisahtxmrskiovt62nirragcnkcad.onion; Email Address support@sinbad.io; alt. Email Address adv@sinbad.io; Digital Currency Address - XBT bc1qq7p0es3dv5hcynjjf40f2xjjr6qp5py47d2f6n847vduuq9gvnyq7y9ecd; alt. Digital Currency Address - XBT 1JHdQHkBZiim1cb4hyUh2PbzEbbg6z2TrF; Secondary sanctions risk: North Korea Sanctions Regulations, sections 510.201 and 510.210; Transactions Prohibited For Persons Owned or Controlled By U.S. Financial Institutions: North Korea Sanctions Regulations section 510.214; Organization Established Date 29 Sep 2022 [DPRK3] [CYBER2].
