Crypto mixer Blender.io allegedly involved in Ronin attack

The Office of Foreign Assets Control (OFAC) of the US Treasury Department sanctioned crypto mixer Blender.io on Friday for its role in laundering funds that came from the hack of the Vietnam-based Axie Infinity’s play-to-earn game Ronin Bridge. The attack was carried out by the Lazarus Group, a North Korean state-sponsored hacking group.

“Today, for the first time ever, Treasury is sanctioning a virtual currency mixer,” Treasury Under Secretary for Terrorism and Financial Intelligence Brian E. Nelson said in a statement. 

“We are taking action against illicit financial activity by the DPRK and will not allow state-sponsored thievery and its money-laundering enablers to go unanswered.”

The connection of Blender.io with the Ronin attack

All Blender.io property in the US or in the control of US individuals is blocked and, therefore, must be reported to OFAC under the sanctions. Blender.io processed $20.5 million in Ethereum and 25.5 million USD Coin out of about $620 million stolen from the Ronin, according to OFAC. Its website has been down for several hours now.

Blender.io allegedly assisted in money laundering for Russia-linked ransomware gangs such as Conti, Trickbot, Ryuk, Gandcrab, and Sodinokibi, according to OFAC’s research. 

The addresses of four wallets used by Lazarus Group to launder some of the stolen monies were also added to the Treasury Department’s List of Specially Designated Nationals and Blocked Entities. The department is also investigating three Ethereum addresses allegedly linked to the Ronin attack.

The Ronin Bridge breach occurred on March 23; however, it was only discovered a week later. Sky Mavis, a game developer, was able to gain access to the bridge. After assisting in the processing of a rise in transactions, that company was whitelisted indefinitely.

Sky Mavis funded $150 million to pay users who lost money as a result of the exploit, with exchange giant Binance recovering $5.8 million from 86 accounts. OFAC recognized Lazarus Group as the hackers in mid-April.