The licensed cryptocurrency mixer was reopened under a different name to avoid U.S. scrutiny and was later used to clean up North Korea’s digital currency, according to Elliptic.
The US-sanctioned Blender cryptomixer has been renamed Sinbad after helping Pyongyang launder proceeds from the Axie Infinity attack, a blockchain analytics firm said.
According to Elliptic, after launching in October 2022, Sinbad was first used to launder Horizon’s $100 million heist and has since laundered tens of millions of crypto stolen for the hermit state. We have cleared the currency.
According to the company, Sinbad shares several similarities with Blender:
- Bitcoin wallets used to pay people who promoted Sinbad received money from Blender operator’s wallets
- A service address on Sinbad’s website received bitcoin from a wallet linked to Blender’s operator to test the service prior to launch.
- Almost all of the early transactions on Sinbad (approximately $22 million) came from wallets of dubious Blender operators.
- Certain characteristics of transactions, and the use of other services to obfuscate transactions, are very similar for both mixers.
- Both mixers work with a 10-digit mixer code, a letter of guarantee signed by your service address, and a transaction delay of up to 7 days
- The website structure, language usage, and naming conventions of both services are very similar.
“Blender may have had motives to rebrand to avoid sanctions, and OFAC may seek to impose further sanctions on Sinbad,” Elliptic argued.
“It may have been done to gain the trust of its users following the abrupt closure of Blender last year and the disappearance of large sums of money from mixers.”
Blender, along with Tornado Cash, another cryptocurrency mixer, is believed to have helped North Korean threat actors launder $475 million from their attack on Axie Infinity.
According to Chainalysis, a record $3.8 billion was stolen from cryptocurrency companies last year, of which $1.7 billion was stolen by North Korean hackers.
