Dirty crypto makes up growing share of assets in Tornado Cash

Both criminals and regular users seeking privacy on Ethereum have fled Tornado Cash since the US levied sanctions against the crypto mixer in August 2022.

But those regular users are leaving at a faster rate, according to forensic blockchain firm TRM Labs. As such, the share of dirty crypto on the protocol now makes up “a larger slice of a much smaller pie.”

“OFAC’s sanctioning of Tornado Cash succeeded in radically reducing usage of the service,” TRM said in its report. “Post-sanctioning, the proportion of illicit funds has nearly doubled amidst a drastic decline in overall transaction volumes.”

Criminals scramble

That has sent criminals scrambling for alternatives.

“Mixers are most effective when they have higher volumes. The more funds, the easier to obscure transactions. Therefore, Tornado Cash has less funds flowing through it and is a less effective tool for money launderers,” Ari Redbord, head of legal and government affairs at TRM, told DL News.

Tornado Cash is a protocol that obscures the flow of assets on otherwise public ledgers like Ethereum.

It became popular with people seeking privacy on the blockchain, but it also drew hackers and scammers who needed a way to launder stolen crypto.

The US sanctioned Tornado Cash in August 2022, citing its use by hackers affiliated with North Korea. Tornado Cash developers have since been arrested or sanctioned by authorities in the Netherlands and the US.

In the six months prior to US sanctions, almost $3 billion in crypto moved through Tornado Cash, according to TRM. In the same six-month period in 2023, it processed less than $500 million in crypto, a drop of almost 85%.

Dirty crypto passing through Tornado Cash has also plummeted — by an estimated 80%, according to TRM.

Go-to laundering platform

Among the alleged criminals to have left are North Korean hackers, who have “largely abandoned the service in favour of more traditional Bitcoin mixers,” TRM noted.

Sinbad has since become cybercriminals’ go-to crypto laundering platform, Redbord said. Another crypto forensics firm, Elliptic, has said Sinbad was likely a re-branded version of another sanctioned crypto mixer, Blender.

Like other anonymity-enhancing software, Tornado Cash is more effective when there’s a larger pot in which to mix users’ activity.

“It is not that cybercriminals are concerned with engaging with the sanctioned mixer,” Redbord said. “Cybercriminals are opportunists and Tornado Cash, with less volume flowing through it, is simply a less effective tool for money laundering.”

Nevertheless, “it is also clear that illicit actors are still looking to Tornado Cash despite the government’s actions,” the report said.

Aleks Gilbert is DL News’ New York-based DeFi Correspondent. Reach out to him with tips at aleks@dlnews.com.