Blender coin mixer may have rebranded, likely remains in use by Lazarus Group Blender coin mixer may have rebranded, likely remains in use by Lazarus Group
The laundering tool favored by North Korean groups may now exist as "Sinbad."
1 min read
Updated: Feb. 14, 2023 at 2:55 am UTC
Cover art/illustration via CryptoSlate. Image includes combined content which may include AI-generated content.
The coin mixer Blender has likely rebranded and could still be in use among North Korean groups, according to a report from analytics firm Elliptic on Feb. 13.
Elliptic says that although Blender stopped operating in April 2022, it has likely rebranded as “Sinbad” based on several facts and patterns it has observed.
Blender’s operator is suspected of sending $22 million of early Bitcoin transactions to Sinbad, plus a separate amount sent to a “service” address. Blender’s operator likely sent Bitcoin to a wallet that also paid Sinbad’s promoters.
Elliptic also noted several similarities between Sinbad and Blender by comparing their on-chain behavior, various features, and respective websites. The firm noted that both mixers could be tied to Russia through their supported languages and websites.
Elliptic also observed that Blender and Sinbad were used in two blockchain attacks by North Korea’s state-sponsored Lazarus Group.
Lazarus attacked Ronin Bridge (associated with the blockchain game Axie Infinity) for more than $540 million in March 2022. Following that attack, Lazarus managed to launder $475 million of that amount through various coin mixers, one of which was Blender.
Lazarus then attacked the cross-chain bridge Horizon in June 2022, stealing $100 million. When Sinbad went live months later in October, Lazarus used it to launder nearly $100 million stolen from Horizon and other targets, Elliptic said.
A separate mixer — Tornado Cash — was also used in both attacks. It continues to operate despite the sanctions imposed by the U.S. Treasury and its Office of Foreign Assets Control (OFAC) in August 2022. Elliptic said that Sinbad could face similar sanctions, adding that Blender and Sinbad addresses are already flagged in its compliance services.
Despite their use in money laundering and recent attention from enforcement, coin mixers have legitimate uses and can be used to perform private transactions.
Mentioned in this article
Author 
Mike Dalton
Before transitioning to crypto writing in 2018, Mike studied library and information sciences. Currently, he resides on Canada's West Coast.
In this article
Bitcoin, a decentralized currency that defies the sway of central banks or administrators, transacts electronically, circumventing intermediaries via a peer-to-peer network.
Tornado Cash
$2.30199
Tornado Cash is a decentralized, non-custodial privacy solution built on Ethereum.
Elliptic
Elliptic empowers financial institutions and crypto businesses to confidently manage risk and meet AML regulatory compliance worldwide.
