✅ Report Title: Analysis of DPRK-Linked Money Laundering Infrastructure

✅ Executive Summary:

• North Korea continuously conducts virtual asset compromise and money laundering activities to circumvent restrictions on securing foreign currency due to international financial sanctions.
• Representative cases include Ronin Bridge (2022), Horizon Bridge (2022), Atomic Wallet (2023), DMM Bitcoin (2024), and Bybit (2025), and the United States government and major blockchain analysis firms assess these as activities of North Korean-backed threat groups such as Lazarus and TraderTraitor.

📌 North Korea's Virtual Asset Compromise and Money Laundering Activities

• North Korean-backed threat groups tend to structure laundering flows in multiple stages rather than immediately cashing out compromised assets. However, the same service is not used in all cases. Based on the disclosed cases, the threat actor disperses the compromised assets into multiple wallets, then selectively uses mixers, bridges, cross-chain swaps, exchange services, and OTC networks, and finally converts them into stablecoins such as USDT and USDC before cashing out through the OTC network.

📌 Money Laundering Procedure

The characteristics of each stage are as follows.

1) Initial Distribution Phase

• The compromised assets are distributed into hundreds to thousands of wallets, making tracking and asset freezing difficult.

2) Mixer Stage

• In some cases, a mixer is used. A mixer refers to a service that weakens the connection between sender and receiver by mixing the virtual assets of multiple users and redistributing them to new addresses.

3) Bridge / Cross-Chain Swap Stage

• In some cases, bridge or cross-chain swaps are utilized. A bridge is a service that supports asset transfers between different blockchains, and a cross-chain swap refers to the method of directly exchanging assets from different blockchains without going through a centralized exchange.
• In multiple incidents recently analyzed to involve North Korean-backed organizations, cases of ETH-BTC conversion using THORChain have been repeatedly confirmed. THORChain itself is a legitimate cross-chain liquidity protocol, but if a threat actor exploits it to transfer assets to another chain, the complexity of single-chain-based tracking may increase.

4) Cash Conversion (OTC) Stage

• In the final stage, the OTC (Over-The-Counter) network is utilized. OTC refers to a method of conducting direct transactions between parties without going through the exchange order book, and it is known that Chinese-speaking brokers and currency exchange networks play a major role.
• Recently, the Southeast Asia-based OTC ecosystem, which includes Huione-affiliated services such as Huione Pay, Huione Crypto, and Haowang Guarantee, has been continuously mentioned as a major concern for money laundering.

📌 Main Laundering Infrastructure

Blender.io

• Blender.io is a Bitcoin-based virtual asset mixer service. The United States Department of the Treasury explained that its May 2022 sanction of Blender.io was the first OFAC sanction case against a virtual asset mixer. The Treasury also announced that Blender.io processed more than $20.5 million of the funds compromised in the Ronin Bridge hack.
• Blender.io is analyzed to have used a structure that mixed deposited bitcoins into an internal liquidity pool and then distributed them to multiple new addresses. This structure made transaction-flow analysis difficult by delaying withdrawal timing or routing funds through multiple addresses.
• Blender.io is significant as the first mixer to be subjected to OFAC sanctions in a virtual asset money laundering case attributed to North Korea.

Tornado Cash

• Tornado Cash is an Ethereum-based decentralized smart contract mixer. A smart contract is a program that automatically executes when predetermined conditions are met on the blockchain, and Tornado Cash used smart contracts together with Zero-Knowledge Proof (ZKP) technology to weaken the link between deposit and withdrawal addresses.
• Zero-Knowledge Proof (ZKP) is a cryptographic technique that allows one to prove possession of certain information without revealing the information itself. In Tornado Cash, users can withdraw funds by proving they previously deposited into the pool, without revealing which specific deposit is linked. As a result, analyzing the direct correlation between deposit and withdrawal addresses becomes difficult.

Sinbad.io

• Sinbad.io is a Bitcoin-based mixer service repeatedly identified in North Korea-linked virtual asset money laundering cases following the sanctions on Blender.io. The U.S. Treasury explained in November 2023 that Sinbad.io was sanctioned because it was used to process funds compromised in the Ronin Bridge and Harmony Horizon Bridge hacks.

eXch

• eXch is a virtual asset exchange service focused on anonymity with minimal user identity verification (KYC). eXch supported multiple blockchains and, due to its policy of minimizing user information collection, has been used as a fund-transfer channel in various illegal money laundering cases.
• According to Elliptic, eXch was identified as one of the main money laundering routes used by North Korean-backed threat groups following the Bybit hack. eXch has been criticized for minimizing identity verification and insufficiently applying anti-money-laundering controls, and the related controversy expanded after the Bybit incident. eXch subsequently announced the termination of its operations.

THORChain

• THORChain is a decentralized protocol that supports cross-chain swaps. A cross-chain swap refers to the method of directly exchanging assets from different blockchains without going through a centralized exchange.
• THORChain was originally designed as a legitimate decentralized finance (DeFi) service. However, after the Bybit hack, compromised funds were confirmed to have moved through THORChain, which is now evaluated as a key service repeatedly identified in North Korea's virtual asset money laundering process.

Chinese Laundromat Network and Huione

• Chinese Laundromat refers to an informal money laundering network made up of Chinese-speaking OTC brokers, fund intermediaries, and escrow services, rather than a single specific service. TRM Labs explains that the final liquidation stage of funds compromised by North Korean-backed organizations tends to be outsourced to OTC and fund-brokerage networks, suggesting that North Korea's virtual asset laundering structure is expanding from technology-service-centered methods like mixers toward a financial-network-centered approach.

📌 Public IoC and Identification Information Analysis

• In the past, mixer services such as Blender.io, Tornado Cash, and Sinbad.io were primarily used for laundering, but recently, cross-chain swap and OTC-based infrastructures like THORChain, eXch, and Huione-related services have been repeatedly observed.
• In money laundering by North Korean-backed organizations, the services and protocols through which funds pass are considered more important tracking targets than individual wallet addresses.
• The threat actor can continuously change addresses, but the laundering infrastructure tends to be repeatedly reused or to reappear in similar forms.
• For more detailed analysis of IoC and identification information, please contact us via the link below.

✅ Recommended Threat Detection and Mitigation Actions:

• In the detection and response process, behavior-based analysis centered on services and protocols is required, along with detection based on public IoCs.