{"investigation":{"slug":"sinbad-io","entity_name":"Sinbad.io","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":0.97,"status":"published","content_type":"investigation","summary":"Sinbad.io was a Bitcoin mixing service that operated from October 2022 until its seizure by U.S., Dutch, and Finnish law enforcement in November 2023. OFAC designated it a key money-laundering tool of North Korea's Lazarus Group, which used it to launder proceeds from multiple major crypto hacks including Axie Infinity's Ronin Bridge and Atomic Wallet. On-chain analytics firms assessed it to be highly likely a rebranding of Blender.io, the first crypto mixer ever sanctioned by OFAC.","sections":[{"content":"On November 29, 2023, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned Sinbad.io, adding the service and two of its Bitcoin addresses (bc1qq7p0es3dv5hcynjjf40f2xjjr6qp5py47d2f6n847vduuq9gvnyq7y9ecd and 1JHdQHkBZiim1cb4hyUh2PbzEbbg6z2TrF) to the Specially Designated Nationals and Blocked Persons (SDN) List. OFAC described Sinbad as 'a key money-laundering tool of the OFAC-designated Lazarus Group,' the state-sponsored North Korean hacking organization. Simultaneous with the sanction, the service's web infrastructure was seized by a coordinated multinational law enforcement action involving the U.S. Federal Bureau of Investigation, the Dutch Financial Intelligence and Investigation Service (FIOD), the Openbaar Ministerie (Netherlands public prosecutor's office), and the Finnish National Bureau of Investigation. Servers were physically seized in the Netherlands and Finland. Sinbad became the third cryptocurrency mixer sanctioned by the U.S. government within an 18-month span, following Blender.io in May 2022 and Tornado Cash in August 2022.","heading":"OFAC Designation and Law Enforcement Seizure","sources":[{"url":"https://home.treasury.gov/news/press-releases/jy1933","name":"home.treasury.gov","type":"other","credibility":3},{"url":"https://www.coindesk.com/policy/2023/11/29/crypto-mixer-sanctioned-by-us-treasury-for-north-korea-allegations-as-fbi-and-finish-police-seize-website","name":"coindesk.com","type":"other","credibility":3},{"url":"https://techcrunch.com/2023/11/29/feds-seize-sinbad-crypto-mixer-allegedly-used-by-north-korean-hackers/","name":"techcrunch.com","type":"other","credibility":3},{"url":"https://www.chainalysis.com/blog/crypto-mixer-sinbad-sactioned-north-korean-laundering/","name":"chainalysis.com","type":"other","credibility":3}],"severity":"medium"},{"content":"OFAC and multiple blockchain analytics firms documented Sinbad's role as the preferred mixing service of the Lazarus Group following the sanctions against Blender.io and Tornado Cash. Treasury confirmed Sinbad processed stolen funds from a series of high-profile hacks attributed to Lazarus, including: the March 2022 Axie Infinity Ronin Bridge hack ($625 million stolen), the June 2022 Harmony Horizon Bridge hack ($100 million stolen), the June 2023 Atomic Wallet hack ($35 million of which was traced directly to Sinbad), and the September 2023 hacks of Stake.com ($41 million) and CoinEx ($70 million). Between December 2022 and January 2023 alone, Chainalysis identified approximately 1,429.6 Bitcoin (worth roughly $24.2 million at the time) sent from Lazarus-linked wallets to Sinbad. TRM Labs assessed that Sinbad became the second-largest mixer by volume globally in 2023, receiving close to one-fifth of all funds sent to mixers that year. Elliptic's analysis found that more than one-third of all funds sent to Sinbad during its operational lifetime originated from cryptocurrency hacks.","heading":"Connection to Lazarus Group and North Korean Hacks","sources":[{"url":"https://home.treasury.gov/news/press-releases/jy1933","name":"home.treasury.gov","type":"other","credibility":3},{"url":"https://www.trmlabs.com/resources/blog/us-treasury-sanctions-north-koreas-preferred-mixer-sinbad","name":"trmlabs.com","type":"other","credibility":3},{"url":"https://www.chainalysis.com/blog/crypto-mixer-sinbad-sactioned-north-korean-laundering/","name":"chainalysis.com","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/analysis/35-million-atomic-wallet-hacker-funnels-crypto-to-north-korea-s-favored-mixer","name":"elliptic.co","type":"other","credibility":3},{"url":"https://beincrypto.com/atomic-wallet-hack-mixer-north-koreas-lazarus-group/","name":"beincrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Blockchain analytics firm Elliptic assessed in February 2023 that Sinbad is 'highly likely' a rebranding of Blender.io, the first cryptocurrency mixer ever sanctioned by OFAC (designated May 2022). Elliptic's on-chain evidence included: pre-launch 'service address' test transactions on Sinbad that were funded from wallets believed to be controlled by the Blender.io operator; promotional payment wallets for Sinbad that also received funds from the same suspected Blender operator wallet; and the operator's transfer of approximately $22 million in Bitcoin to Sinbad's infrastructure ahead of its public launch. Additional circumstantial evidence included near-identical operational features on both platforms — ten-digit mixer codes, seven-day delays on transactions, issuance of guarantee letters, matching website structure, and Russian-language customer support teams. Blender.io ceased operations in April 2022, approximately six months before Sinbad began advertising in October 2022.","heading":"Alleged Rebranding of Blender.io","sources":[{"url":"https://www.elliptic.co/blog/sinbad-crypto-mixer-flagged-by-elliptic-sanctioned-and-seized","name":"elliptic.co","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/analysis/has-a-sanctioned-bitcoin-mixer-been-resurrected-to-aid-north-korea-s-lazarus-group","name":"elliptic.co","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2023/02/13/sanctioned-mixer-blender-re-launched-as-sinbad-elliptic-says","name":"coindesk.com","type":"other","credibility":3},{"url":"https://decrypt.co/121222/new-sinbad-bitcoin-mixer-is-sanctioned-blender","name":"decrypt.co","type":"other","credibility":3}],"severity":"medium"},{"content":"On January 7, 2025, a federal grand jury in the Northern District of Georgia returned an indictment against three Russian nationals alleged to have operated both Blender.io and Sinbad.io. The defendants are Roman Vitalyevich Ostapenko (age 55), Alexander Evgenievich Oleynik (age 44), and Anton Vyachlavovich Tarasov (age 32). Ostapenko was charged with one count of conspiracy to commit money laundering and two counts of operating an unlicensed money transmitting business; Oleynik and Tarasov were each charged with one count of conspiracy to commit money laundering and one count of operating an unlicensed money transmitting business. The DOJ announced the indictment publicly on January 10, 2025. Ostapenko and Oleynik were arrested on December 1, 2024, in an unspecified location; Tarasov remained at large as of the indictment announcement. If convicted on all counts, each defendant faces a maximum of 20 years in prison for the money laundering conspiracy charge and five years per unlicensed money transmitting count.","heading":"Criminal Indictment of Alleged Operators","sources":[{"url":"https://therecord.media/russian-nationals-indicted-blender-sinbad-crypto-mixers","name":"therecord.media","type":"other","credibility":3},{"url":"https://www.theblock.co/post/334129/alleged-blender-and-sinbad-crypto-mixer-operators-charged-in-money-laundering-case","name":"theblock.co","type":"other","credibility":3},{"url":"https://techcrunch.com/2025/01/10/us-government-charges-operators-of-crypto-mixing-service-used-by-north-korea-and-ransomware-gangs/","name":"techcrunch.com","type":"other","credibility":3},{"url":"https://www.helpnetsecurity.com/2025/01/13/alleged-blender-sinbad-cryptomixer-operators-arrested-indicted/","name":"helpnetsecurity.com","type":"other","credibility":3},{"url":"https://decrypt.co/300615/russian-nationals-indicted-over-blender-io-and-sinbad-io-coin-mixers","name":"decrypt.co","type":"other","credibility":3}],"severity":"medium"},{"content":"Beyond North Korean state-sponsored money laundering, OFAC's November 2023 designation stated that Sinbad was also used by cybercriminals to obfuscate transactions linked to sanctions evasion, drug trafficking, the purchase of child sexual abuse materials (CSAM), and additional illicit sales on darknet marketplaces. The platform's broad use across multiple categories of financial crime was cited as a secondary basis for the designation alongside the Lazarus Group laundering activity. U.S. charges against the alleged operators also referenced the service's use by ransomware gangs.","heading":"Additional Illicit Activity","sources":[{"url":"https://home.treasury.gov/news/press-releases/jy1933","name":"home.treasury.gov","type":"other","credibility":3},{"url":"https://www.bleepingcomputer.com/news/security/us-charges-operators-of-cryptomixers-linked-to-ransomware-gangs/","name":"bleepingcomputer.com","type":"other","credibility":3},{"url":"https://www.whitecollarlawblog.com/2023/12/ofac-sanctions-crypto-mixer-following-allegations-of-laundering-funds-to-north-korea/","name":"whitecollarlawblog.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Sinbad.io began advertising its services in October 2022. It operated as a centralized Bitcoin mixing service — accepting user deposits, commingling them with other users' funds and the service's own reserves, then returning equivalent amounts to specified output addresses, thereby obscuring the on-chain transaction trail. Operational features included ten-digit mixer codes to prevent repeat detection, configurable time delays of up to seven days, and the issuance of cryptographic guarantee letters. The platform offered Russian-language support. According to TRM Labs, Sinbad became the second-largest mixer by volume globally by 2023, accounting for close to one-fifth of all funds processed by mixers that year. The service operated a .onion (Tor) version of its website in addition to the clearnet domain.","heading":"Service Mechanics and Operational Profile","sources":[{"url":"https://www.trmlabs.com/resources/blog/us-treasury-sanctions-north-koreas-preferred-mixer-sinbad","name":"trmlabs.com","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/sinbad-crypto-mixer-flagged-by-elliptic-sanctioned-and-seized","name":"elliptic.co","type":"other","credibility":3},{"url":"https://www.theregister.com/2023/02/14/blender_crypto_mixer_sinbad","name":"theregister.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-04","event":"Blender.io ceases operations, approximately one month before OFAC sanctions it.","source":"","date_original":"2022-04-01"},{"date":"2022-05-06","event":"OFAC sanctions Blender.io, the first cryptocurrency mixer ever designated by the U.S. government, for laundering North Korean Lazarus Group funds from the Ronin Bridge hack.","source":""},{"date":"2022-10","event":"Sinbad.io begins advertising and accepting users as a Bitcoin mixing service.","source":"","date_original":"2022-10-01"},{"date":"2023-02-13","event":"Elliptic publishes analysis concluding Sinbad is 'highly likely' a rebranding of the sanctioned Blender.io mixer, based on on-chain Bitcoin transaction tracing linking both services to the same operator wallet.","source":""},{"date":"2023-06","event":"Lazarus Group hacks Atomic Wallet, stealing approximately $100 million; $35 million of the proceeds are subsequently traced to Sinbad.io by Elliptic.","source":"","date_original":"2023-06-01"},{"date":"2023-11-29","event":"OFAC designates Sinbad.io under E.O. 13722 and E.O. 13694, adding the service to the SDN List. Simultaneous multinational law enforcement operation by the FBI, Dutch FIOD, and Finnish National Bureau of Investigation seizes Sinbad's web infrastructure and servers.","source":""},{"date":"2024-12","event":"Roman Vitalyevich Ostapenko and Alexander Evgenievich Oleynik, two Russian nationals alleged to be Blender/Sinbad operators, are arrested.","source":"","date_original":"2024-12-01"},{"date":"2025-01-07","event":"A federal grand jury in the Northern District of Georgia returns an indictment against Ostapenko, Oleynik, and a third defendant, Anton Vyachlavovich Tarasov, on counts of money laundering conspiracy and operating an unlicensed money transmitting business. Tarasov remains at large.","source":""},{"date":"2025-01-10","event":"U.S. Department of Justice publicly announces the indictment against the three alleged Blender.io and Sinbad.io operators.","source":""}],"sources_used":[{"url":"https://home.treasury.gov/news/press-releases/jy1933","name":"home.treasury.gov","type":"other","archive_url":"http://web.archive.org/web/20260529070738/https://home.treasury.gov/news/press-releases/jy1933","credibility":3,"archive_timestamp":"2026-05-29T07:07:38+00:00"},{"url":"https://www.coindesk.com/policy/2023/11/29/crypto-mixer-sanctioned-by-us-treasury-for-north-korea-allegations-as-fbi-and-finish-police-seize-website","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://techcrunch.com/2023/11/29/feds-seize-sinbad-crypto-mixer-allegedly-used-by-north-korean-hackers/","name":"techcrunch.com","type":"other","archive_url":"http://web.archive.org/web/20260519204638/https://techcrunch.com/2023/11/29/feds-seize-sinbad-crypto-mixer-allegedly-used-by-north-korean-hackers/","credibility":3,"archive_timestamp":"2026-05-19T20:46:38+00:00"},{"url":"https://www.chainalysis.com/blog/crypto-mixer-sinbad-sactioned-north-korean-laundering/","name":"chainalysis.com","type":"other","archive_url":"http://web.archive.org/web/20260514050238/https://www.chainalysis.com/blog/crypto-mixer-sinbad-sactioned-north-korean-laundering/","credibility":3,"archive_timestamp":"2026-05-14T05:02:38+00:00"},{"url":"https://www.trmlabs.com/resources/blog/us-treasury-sanctions-north-koreas-preferred-mixer-sinbad","name":"trmlabs.com","type":"other","archive_url":"http://web.archive.org/web/20260512211804/https://www.trmlabs.com/resources/blog/us-treasury-sanctions-north-koreas-preferred-mixer-sinbad","credibility":3,"archive_timestamp":"2026-05-12T21:18:04+00:00"},{"url":"https://www.elliptic.co/blog/analysis/35-million-atomic-wallet-hacker-funnels-crypto-to-north-korea-s-favored-mixer","name":"elliptic.co","type":"other","archive_url":"http://web.archive.org/web/20260416054337/https://www.elliptic.co/blog/analysis/35-million-atomic-wallet-hacker-funnels-crypto-to-north-korea-s-favored-mixer","credibility":3,"archive_timestamp":"2026-04-16T05:43:37+00:00"},{"url":"https://beincrypto.com/atomic-wallet-hack-mixer-north-koreas-lazarus-group/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20260123142720/https://beincrypto.com/atomic-wallet-hack-mixer-north-koreas-lazarus-group/","credibility":3,"archive_timestamp":"2026-01-23T14:27:20+00:00"},{"url":"https://www.elliptic.co/blog/sinbad-crypto-mixer-flagged-by-elliptic-sanctioned-and-seized","name":"elliptic.co","type":"other","archive_url":"http://web.archive.org/web/20260412061206/https://www.elliptic.co/blog/sinbad-crypto-mixer-flagged-by-elliptic-sanctioned-and-seized","credibility":3,"archive_timestamp":"2026-04-12T06:12:06+00:00"},{"url":"https://www.elliptic.co/blog/analysis/has-a-sanctioned-bitcoin-mixer-been-resurrected-to-aid-north-korea-s-lazarus-group","name":"elliptic.co","type":"other","archive_url":"http://web.archive.org/web/20260511091820/https://www.elliptic.co/blog/analysis/has-a-sanctioned-bitcoin-mixer-been-resurrected-to-aid-north-korea-s-lazarus-group","credibility":3,"archive_timestamp":"2026-05-11T09:18:20+00:00"},{"url":"https://www.coindesk.com/business/2023/02/13/sanctioned-mixer-blender-re-launched-as-sinbad-elliptic-says","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://decrypt.co/121222/new-sinbad-bitcoin-mixer-is-sanctioned-blender","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260410094349/https://decrypt.co/121222/new-sinbad-bitcoin-mixer-is-sanctioned-blender","credibility":3,"archive_timestamp":"2026-04-10T09:43:49+00:00"},{"url":"https://therecord.media/russian-nationals-indicted-blender-sinbad-crypto-mixers","name":"therecord.media","type":"other","archive_url":"http://web.archive.org/web/20260801133524/https://therecord.media/russian-nationals-indicted-blender-sinbad-crypto-mixers","credibility":3,"archive_timestamp":"2026-08-01T13:35:24+00:00"},{"url":"https://www.theblock.co/post/334129/alleged-blender-and-sinbad-crypto-mixer-operators-charged-in-money-laundering-case","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://techcrunch.com/2025/01/10/us-government-charges-operators-of-crypto-mixing-service-used-by-north-korea-and-ransomware-gangs/","name":"techcrunch.com","type":"other","archive_url":"http://web.archive.org/web/20250908203444/https://techcrunch.com/2025/01/10/us-government-charges-operators-of-crypto-mixing-service-used-by-north-korea-and-ransomware-gangs/","credibility":3,"archive_timestamp":"2025-09-08T20:34:44+00:00"},{"url":"https://www.helpnetsecurity.com/2025/01/13/alleged-blender-sinbad-cryptomixer-operators-arrested-indicted/","name":"helpnetsecurity.com","type":"other","archive_url":"http://web.archive.org/web/20260209091543/https://www.helpnetsecurity.com/2025/01/13/alleged-blender-sinbad-cryptomixer-operators-arrested-indicted/","credibility":3,"archive_timestamp":"2026-02-09T09:15:43+00:00"},{"url":"https://decrypt.co/300615/russian-nationals-indicted-over-blender-io-and-sinbad-io-coin-mixers","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260516105250/https://decrypt.co/300615/russian-nationals-indicted-over-blender-io-and-sinbad-io-coin-mixers","credibility":3,"archive_timestamp":"2026-05-16T10:52:50+00:00"},{"url":"https://www.bleepingcomputer.com/news/security/us-charges-operators-of-cryptomixers-linked-to-ransomware-gangs/","name":"bleepingcomputer.com","type":"other","archive_url":"http://web.archive.org/web/20260813212925/https://www.bleepingcomputer.com/news/security/us-charges-operators-of-cryptomixers-linked-to-ransomware-gangs/","credibility":3,"archive_timestamp":"2026-08-13T21:29:25+00:00"},{"url":"https://www.whitecollarlawblog.com/2023/12/ofac-sanctions-crypto-mixer-following-allegations-of-laundering-funds-to-north-korea/","name":"whitecollarlawblog.com","type":"other","archive_url":"http://web.archive.org/web/20251214180544/https://www.whitecollarlawblog.com/2023/12/ofac-sanctions-crypto-mixer-following-allegations-of-laundering-funds-to-north-korea/","credibility":3,"archive_timestamp":"2025-12-14T18:05:44+00:00"},{"url":"https://www.theregister.com/2023/02/14/blender_crypto_mixer_sinbad","name":"theregister.com","type":"other","archive_url":"http://web.archive.org/web/20260212104436/https://www.theregister.com/2023/02/14/blender_crypto_mixer_sinbad/","credibility":3,"archive_timestamp":"2026-02-12T10:44:36+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-30T18:29:34.546999+00:00","updated_at":"2026-08-30T17:55:51.247283+00:00"}}