Blender Coin Mixer may have Rebranded, likely Remains in use by Lazarus Group

According to a Feb. 13 study from analytics firm Elliptic, the currency mixer Blender has likely been renamed and may still be in use within North Korean organizations.

According to Elliptic, despite the claim that Blender ceased operations in April 2022, it has most certainly rebranded as “Sinbad” based on various facts and patterns it has noticed.

The operator of Blender is accused of paying $22 million in early Bitcoin transactions to Sinbad, as well as a second payment to a “service” address. The operator of Blender most certainly deposited Bitcoin to a wallet that also paid Sinbad’s promoters.

By analyzing their on-chain behavior, numerous features, and respective websites, Elliptic discovered some parallels between Sinbad and Blender. Both mixers, according to the company, might be linked to Russia via their supported languages and websites.

Elliptic also discovered that North Korea’s state-sponsored Lazarus Group employed Blender and Sinbad in two blockchain assaults.

In March 2022, Lazarus attacked Ronin Bridge (connected with the blockchain game Axie Infinity) for more than $540 million. Following the attack, Lazarus was able to launder $475 million using multiple currency mixers, one of which was Blender.

In June 2022, Lazarus attacked the cross-chain bridge Horizon, seizing $100 million. Elliptic alleged that when Sinbad went online months later in October, Lazarus exploited it to launder approximately $100 million stolen from Horizon and other companies.

Tornado Cash, a different mixer, was also employed in both assaults. Despite the restrictions issued by the US Treasury and its Office of Foreign Assets Control (OFAC) in August 2022, it continues to function. Elliptic stated that Sinbad may face similar punishments, and that the Blender and Sinbad addresses are already highlighted in its compliance services.

Despite its usage in money laundering and increasing enforcement attention, coin mixers have genuine applications and may be used to conduct private transactions.