Three actions across nineteen months, and together they are the clearest enforcement statement on mixing that exists.
Blender.io, 6 May 2022
Treasury’s own framing: “Today, for the first time ever, Treasury is sanctioning a virtual currency mixer.”
Blender was designated under Executive Order 13694, as amended. Treasury records that it had processed over $500 million in bitcoin since its creation in 2017, and that it handled over $20.5 million of the proceeds of the Axie Infinity heist — approximately $620 million stolen by the DPRK’s Lazarus Group on 23 March 2022.
The description of what a mixer does is worth quoting because it is the working definition: services that “indiscriminately facilitate illicit transactions by obfuscating their origin, destination, and counterparties,” receiving and mixing transactions before transmitting them onward.
Tornado Cash, 8 August 2022
The second designation, and the contentious one, because Tornado Cash was not a company holding customer funds but a set of smart contracts.
That distinction generated substantial litigation and commentary about whether immutable code can be sanctioned, and the site notes it here rather than resolving it. What matters for the technique is the demonstration: mixing on a public ledger is provided by identifiable services, and services can be addressed.
Sinbad.io, 29 November 2023
Treasury describes Sinbad as “a key money-laundering tool of the OFAC-designated Lazarus Group” and its “preferred mixing service.” It was used to launder a significant portion of the roughly $100 million stolen from Atomic Wallet customers on 3 June 2023, a significant portion of the $620 million Axie Infinity heist, and part of the $100 million Horizon Bridge theft of June 2022.
Why designation is the effective response
Tracing through a mixer is hard by construction. Establishing that particular outputs correspond to particular inputs requires statistical work, and it produces probabilities rather than certainties.
Designating the mixer changes the question. An institution no longer has to prove where funds came from before the mix; it has to check whether an address belongs to a designated service, which is a match rather than an inference. Exposure to the mixer becomes the finding.
That is the same move the SDN List makes when it carries digital currency addresses as structured identifiers, and it is why address screening is the one control in this area that works better than its banking equivalent rather than worse.
What it does not do
Designation does not remove the service. Blockchain infrastructure is not seized by a list entry, and the sequence here — Blender, then Tornado Cash, then Sinbad, all serving the same actor — is itself evidence that capacity reappears.
What changes is cost. Each designation strips a laundering route of any counterparty that screens, which pushes the activity toward services with no compliance function and correspondingly worse execution, where the off-ramp remains the binding constraint.