{"investigation":{"slug":"blender-io","entity_name":"Blender.io","trust_score":0,"severity_base":null,"score_modifier":0,"confidence":0.97,"status":"published","content_type":"investigation","summary":"Blender.io was a Bitcoin mixing service that operated from approximately 2018 to 2022, processing over $500 million in Bitcoin before being shut down. On May 6, 2022, the U.S. Treasury's Office of Foreign Assets Control (OFAC) designated it as a Specially Designated National, marking the first time a virtual currency mixer had ever been sanctioned by the United States government. The service was designated for its role in laundering over $20.5 million in proceeds from North Korea's Lazarus Group following the $620 million Ronin Network hack, as well as for processing funds tied to Russian ransomware groups and the Hydra darknet market.","sections":[{"content":"Blender.io was a custodial Bitcoin mixing service, meaning it took custody of user funds and returned different Bitcoin in an attempt to obscure transaction trails on the blockchain. According to OFAC, the service was established around 2017-2018 and operated until 2022. It advertised on cybercriminal forums with promises of no activity logs and deletion of all transaction evidence. The service processed over $500 million worth of Bitcoin across its operational lifespan, according to U.S. Treasury findings. Blender.io operated on the Bitcoin blockchain and offered features including ten-digit mixer codes, guarantee letters signed by the service address, and transaction delays of up to seven days to further obfuscate fund flows.","heading":"Background and Operation","sources":[{"url":"https://home.treasury.gov/news/press-releases/jy0768","name":"home.treasury.gov","type":"other","credibility":3},{"url":"https://www.justice.gov/usao-ndga/pr/operators-cryptocurrency-mixers-charged-money-laundering","name":"justice.gov","type":"other","credibility":3},{"url":"https://en.wikipedia.org/wiki/Blender.io","name":"en.wikipedia.org","type":"other","credibility":3}],"severity":"medium"},{"content":"On May 6, 2022, OFAC designated Blender.io as a Specially Designated National (SDN), making it the first virtual currency mixer ever sanctioned by the United States government. OFAC sanctioned 45 Bitcoin addresses linked to Blender.io as part of the action. As a result of the designation, all property and interests in property of Blender.io subject to U.S. jurisdiction were blocked, and U.S. persons were prohibited from transacting with the service. The action was taken under the International Emergency Economic Powers Act (IEEPA) and was explicitly tied to North Korea's cyber threat posture and the Lazarus Group's use of the service.","heading":"OFAC Sanctions — Historic First","sources":[{"url":"https://home.treasury.gov/news/press-releases/jy0768","name":"home.treasury.gov","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/ofac-sanctions-virtual-asset-mixer-for-the-first-time-to-combat-north-koreas-lazarus-group","name":"elliptic.co","type":"other","credibility":3},{"url":"https://www.mayerbrown.com/en/perspectives-events/publications/2022/05/ofac-imposes-first-ever-sanctions-against-virtual-currency-mixer","name":"mayerbrown.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On March 23, 2022, the Lazarus Group — a DPRK state-sponsored hacking organization — carried out what was at the time the largest virtual currency theft on record, stealing approximately $620 million from the Ronin Network bridge that supported the Axie Infinity play-to-earn game. According to OFAC, Blender.io processed over $20.5 million of the illicit proceeds from that theft. The Lazarus Group had converted the stolen Ether to Bitcoin before routing funds through Blender.io. OFAC also sanctioned four additional virtual currency wallet addresses linked to the Lazarus Group in conjunction with the Blender.io action, and noted the group had transferred approximately $273.9 million in Ether to newly identified addresses between April 24 and May 4, 2022.","heading":"Connection to Lazarus Group and the Ronin Network Hack","sources":[{"url":"https://home.treasury.gov/news/press-releases/jy0768","name":"home.treasury.gov","type":"other","credibility":3},{"url":"https://therecord.media/cryptocurrency-mixer-sanctions-ofac-blendrio-lazarus-group","name":"therecord.media","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/ofac-sanctions-virtual-asset-mixer-for-the-first-time-to-combat-north-koreas-lazarus-group","name":"elliptic.co","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/crypto-mixer-sanctioned-by-us-treasury-for-role-in-axie-infinity-hack","name":"cointelegraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Beyond the Lazarus Group connection, OFAC's investigation found that Blender.io processed funds for a range of other criminal actors. Russian-linked ransomware groups identified in OFAC's action as having used the service include Trickbot, Conti, Ryuk, Sodinokibi (REvil), and Gandcrab. The service was also linked to Hydra, a Russian-language darknet marketplace that OFAC had sanctioned separately. These additional connections established Blender.io as a broadly used illicit finance infrastructure rather than a service connected to a single criminal group.","heading":"Additional Illicit Clients — Ransomware and Darknet Markets","sources":[{"url":"https://home.treasury.gov/news/press-releases/jy0768","name":"home.treasury.gov","type":"other","credibility":3},{"url":"https://therecord.media/cryptocurrency-mixer-sanctions-ofac-blendrio-lazarus-group","name":"therecord.media","type":"other","credibility":3},{"url":"https://www.databreachtoday.co.uk/first-us-sanction-virtual-currency-mixer-blenderio-a-19038","name":"databreachtoday.co.uk","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the OFAC sanctions and shutdown of Blender.io, blockchain analytics firm Elliptic published analysis in February 2023 concluding with high confidence that the same operators had relaunched under the name Sinbad.io. Evidence cited by Elliptic included on-chain analysis showing that before Sinbad.io's public launch, its service address received Bitcoin from a wallet believed to be controlled by the Blender.io operator, and that nearly all early incoming transactions to Sinbad originated from that same wallet. Sinbad.io replicated Blender's operational characteristics, including ten-digit mixer codes, guarantee letters, and maximum seven-day transaction delays. On November 29, 2023, OFAC sanctioned Sinbad.io as well, and law enforcement in the Netherlands and Finland seized its servers. U.S. Treasury officials described Sinbad.io as the Lazarus Group's 'preferred mixing service.'","heading":"Relaunch as Sinbad.io","sources":[{"url":"https://www.coindesk.com/business/2023/02/13/sanctioned-mixer-blender-re-launched-as-sinbad-elliptic-says","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/sinbad-crypto-mixer-flagged-by-elliptic-sanctioned-and-seized","name":"elliptic.co","type":"other","credibility":3},{"url":"https://home.treasury.gov/news/press-releases/jy1933","name":"home.treasury.gov","type":"other","credibility":3},{"url":"https://decrypt.co/208160/sanctioned-bitcoin-mixer-blender-relaunch-sinbad-sanctioned-again","name":"decrypt.co","type":"other","credibility":3}],"severity":"medium"},{"content":"On January 7, 2025, a federal grand jury in the Northern District of Georgia returned indictments against three Russian nationals alleged to have operated both Blender.io and Sinbad.io: Roman Vitalyevich Ostapenko (age 55), Alexander Evgenievich Oleynik (age 44), and Anton Vyachlavovich Tarasov (age 32). Ostapenko was charged with one count of conspiracy to commit money laundering and two counts of operating an unlicensed money transmitting business. Oleynik and Tarasov each face one count of conspiracy to commit money laundering and one count of operating an unlicensed money transmitting business. Ostapenko and Oleynik were arrested on December 1, 2024; Tarasov remained at large as of the indictment date. If convicted on all counts, the defendants face up to 25 years in federal prison each.","heading":"Criminal Charges and Arrests","sources":[{"url":"https://www.justice.gov/usao-ndga/pr/operators-cryptocurrency-mixers-charged-money-laundering","name":"justice.gov","type":"other","credibility":3},{"url":"https://therecord.media/russian-nationals-indicted-blender-sinbad-crypto-mixers","name":"therecord.media","type":"other","credibility":3},{"url":"https://www.theblock.co/post/334129/alleged-blender-and-sinbad-crypto-mixer-operators-charged-in-money-laundering-case","name":"theblock.co","type":"other","credibility":3}],"severity":"medium"},{"content":"The Blender.io sanctions established a regulatory precedent that mixing services could be treated as sanctions-risk infrastructure when linked to state-sponsored threat actors, not merely as anti-money-laundering compliance concerns. The action preceded the August 2022 OFAC sanctions against Tornado Cash, a far larger Ethereum-based mixer, demonstrating that Treasury was prepared to use the SDN list against both custodial and non-custodial mixing protocols. Legal commentators including Mayer Brown noted that the action signaled a new escalation in the use of OFAC sanctions authorities against virtual currency infrastructure. The Blender.io case also illustrated the limitations of sanction evasion through rebranding, as the subsequent Sinbad.io action confirmed that operators who attempted to evade sanctions by relaunching under a new name remained subject to prosecution.","heading":"Regulatory and Policy Significance","sources":[{"url":"https://www.mayerbrown.com/en/perspectives-events/publications/2022/05/ofac-imposes-first-ever-sanctions-against-virtual-currency-mixer","name":"mayerbrown.com","type":"other","credibility":3},{"url":"https://www.moneylaunderingnews.com/2022/08/ofac-sanctions-virtual-currency-mixer-tornado-cash-and-faces-crypto-backlash/","name":"moneylaunderingnews.com","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/ofac-sanctions-virtual-asset-mixer-for-the-first-time-to-combat-north-koreas-lazarus-group","name":"elliptic.co","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2017","event":"Blender.io established as a Bitcoin mixing service; exact launch date not publicly confirmed but referenced as circa 2017 by U.S. Treasury.","source":"","date_original":"2017-01-01"},{"date":"2022-03-23","event":"Lazarus Group executes the Ronin Network hack, stealing approximately $620 million in cryptocurrency from the Axie Infinity bridge.","source":""},{"date":"2022-03-29","event":"Sky Mavis (Axie Infinity developer) and Ronin Network publicly disclose the breach, six days after the theft occurred.","source":""},{"date":"2022-05-06","event":"OFAC designates Blender.io as a Specially Designated National, the first-ever sanctions action against a virtual currency mixer. 45 Bitcoin addresses linked to Blender.io are added to the SDN list.","source":""},{"date":"2022-08-08","event":"OFAC sanctions Tornado Cash, the Ethereum-based mixer, following the Blender.io precedent.","source":""},{"date":"2022-10","event":"Blender.io ceases operations; approximate shutdown date based on DOJ indictment stating the service operated from approximately 2018 to 2022.","source":"","date_original":"2022-10-01"},{"date":"2023-02-13","event":"Elliptic publishes analysis concluding that Sinbad.io is a relaunch of Blender.io operated by the same individuals, based on on-chain transaction analysis.","source":""},{"date":"2023-11-29","event":"OFAC sanctions Sinbad.io as the successor to Blender.io and the Lazarus Group's preferred mixing service. Law enforcement in the Netherlands and Finland seize Sinbad.io's servers.","source":""},{"date":"2024-12","event":"Roman Vitalyevich Ostapenko and Alexander Evgenievich Oleynik, alleged Russian operators of Blender.io and Sinbad.io, are arrested.","source":"","date_original":"2024-12-01"},{"date":"2025-01-07","event":"Federal grand jury in the Northern District of Georgia returns indictments against Ostapenko, Oleynik, and Anton Vyachlavovich Tarasov for conspiracy to commit money laundering and operating unlicensed money transmitting businesses. Tarasov remains at large.","source":""}],"sources_used":[{"url":"https://home.treasury.gov/news/press-releases/jy0768","name":"home.treasury.gov","type":"other","credibility":3},{"url":"https://www.justice.gov/usao-ndga/pr/operators-cryptocurrency-mixers-charged-money-laundering","name":"justice.gov","type":"other","credibility":3},{"url":"https://en.wikipedia.org/wiki/Blender.io","name":"en.wikipedia.org","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/ofac-sanctions-virtual-asset-mixer-for-the-first-time-to-combat-north-koreas-lazarus-group","name":"elliptic.co","type":"other","credibility":3},{"url":"https://www.mayerbrown.com/en/perspectives-events/publications/2022/05/ofac-imposes-first-ever-sanctions-against-virtual-currency-mixer","name":"mayerbrown.com","type":"other","credibility":3},{"url":"https://therecord.media/cryptocurrency-mixer-sanctions-ofac-blendrio-lazarus-group","name":"therecord.media","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/crypto-mixer-sanctioned-by-us-treasury-for-role-in-axie-infinity-hack","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.databreachtoday.co.uk/first-us-sanction-virtual-currency-mixer-blenderio-a-19038","name":"databreachtoday.co.uk","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2023/02/13/sanctioned-mixer-blender-re-launched-as-sinbad-elliptic-says","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/sinbad-crypto-mixer-flagged-by-elliptic-sanctioned-and-seized","name":"elliptic.co","type":"other","credibility":3},{"url":"https://home.treasury.gov/news/press-releases/jy1933","name":"home.treasury.gov","type":"other","credibility":3},{"url":"https://decrypt.co/208160/sanctioned-bitcoin-mixer-blender-relaunch-sinbad-sanctioned-again","name":"decrypt.co","type":"other","credibility":3},{"url":"https://therecord.media/russian-nationals-indicted-blender-sinbad-crypto-mixers","name":"therecord.media","type":"other","credibility":3},{"url":"https://www.theblock.co/post/334129/alleged-blender-and-sinbad-crypto-mixer-operators-charged-in-money-laundering-case","name":"theblock.co","type":"other","credibility":3},{"url":"https://www.moneylaunderingnews.com/2022/08/ofac-sanctions-virtual-currency-mixer-tornado-cash-and-faces-crypto-backlash/","name":"moneylaunderingnews.com","type":"other","credibility":3}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-30T18:24:58.324523+00:00","updated_at":"2026-08-29T01:33:31.669+00:00"}}