Two men who founded a cryptocurrency mixing service called Tornado Cash have been charged by the U.S. authorities with laundering more than $1 billion in illicit funds, including hundreds of millions for a North Korean hacking group.
What is Tornado Cash and how does it work?
Tornado Cash is a platform that allows users to send and receive cryptocurrency anonymously by mixing their transactions with those of other users. This makes it difficult to trace the origin and destination of the funds, as well as the identity of the users.
Tornado Cash claims to offer a “technically sophisticated privacy service” that uses zero-knowledge proofs, a cryptographic technique that allows users to prove something without revealing any information. The platform supports Ethereum and several ERC-20 tokens, such as USDT, DAI, and WBTC.
Who are the founders and what are the charges?
The founders of Tornado Cash are Roman Storm, 34, of Washington state, and Roman Semenov, 35, a Russian citizen. They have been indicted by a federal grand jury in Manhattan on charges of conspiracy to commit money laundering, operating an unlicensed money transmitting business, and violating sanctions against North Korea.
According to the indictment, Storm and Semenov knowingly facilitated the laundering of hundreds of millions of dollars for the Lazarus Group, a cybercrime organization linked to the North Korean government. The Lazarus Group is responsible for several high-profile cyberattacks, such as the Sony Pictures hack in 2014, the WannaCry ransomware attack in 2017, and the theft of over $250 million from cryptocurrency exchanges in 2018.
The indictment also alleges that Storm and Semenov failed to implement any anti-money laundering or know-your-customer programs as required by law, despite receiving customer complaints and inquiries from law enforcement. They also allegedly made millions of dollars in profits from their service fees and commissions.
What are the consequences and reactions?
If convicted, Storm and Semenov face up to 20 years in prison for each count of money laundering and sanctions violations, and up to five years for operating an unlicensed money transmitting business. They also face forfeiture of any assets derived from their criminal activities.
Storm was arrested in Washington on Wednesday, while Semenov remains at large. A third co-founder of Tornado Cash, who was not named in the indictment, was arrested on money laundering charges in the Netherlands last year.
Storm’s lawyer, Brian Klein, said in a statement that his client was “incredibly disappointed” by the charges and that he had been cooperating with the prosecutors’ investigation since last year. He also said that Storm disputed that he engaged in any criminal conduct and that he helped develop software based on a “novel legal theory with dangerous implications for all software developers”.
The U.S. Attorney for the Southern District of New York, Damian Williams, said in a statement that Storm and Semenov “chose not to implement basic safeguards to prevent their service from becoming a haven for criminals”. He also said that they “helped hackers and fraudsters conceal the fruits of their crimes”.
The U.S. Treasury Department also announced sanctions against Semenov on Wednesday, freezing any assets he may have under U.S. jurisdiction and prohibiting any transactions with him by U.S. persons or entities.
The case is part of a broader effort by the U.S. government to crack down on illicit activities involving cryptocurrencies, especially those related to North Korea. In February this year, three North Korean hackers were indicted for their role in stealing over $1.3 billion from banks and cryptocurrency exchanges around the world.