U.S. v. Roman Storm & Alexey Pertsev (Tornado Cash $1B Heist)
Key Facts
- Legal Status: CHARGED in U.S. District Court for the Southern District of New York.
- Primary Target Sector: Cryptocurrency & Financial Services.
- Documented Financial Loss: $1.0 billion.
- 2 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Landmark federal criminal indictment in the Southern District of New York against founders of the Tornado Cash cryptocurrency mixer for conspiracy to commit money laundering and sanctions violations, knowingly facilitating over $1 billion in illicit transactions including hundreds of millions stolen by North Korea's state-sponsored Lazarus Group.
Root Cause & Infiltration Vector
Initial access established against Cryptocurrency & Financial Services infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Landmark federal criminal indictment in the Southern District of New York against founders of the Tornado Cash cryptocurrency mixer for conspiracy to commit money laundering and sanctions violations, knowingly facilitating over $1 billion in illicit transactions including hundreds of millions stolen by North Korea's state-sponsored Lazarus Group.
Operational Impact & Financial Blast Radius
Resulted in $1,000,000,000 in documented financial liabilities. Over $1 billion in total criminal proceeds laundered, including $455M from the Axie Infinity Ronin Bridge heist.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Threat actors utilized automated relayer services and programmatic API keys to deposit and withdraw stolen funds without presenting customer identity credentials.
Operated non-custodial smart contracts designed to pool and obfuscate origins of illicit cryptocurrency transfers, frustrating blockchain tracing by law enforcement.
Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Cryptocurrency & Financial Services infrastructure.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
U.S. Department of the Treasury OFAC sanctions Tornado Cash for laundering funds stolen by DPRK Lazarus Group.
S.D.N.Y. grand jury indicts founders Roman Storm and Roman Semenov on three criminal counts.
Dutch court finds co-founder Alexey Pertsev guilty of money laundering, sentencing him to 64 months imprisonment.
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1567 | Exfiltration Over Web Service Exfiltration | "Operated non-custodial smart contracts designed to pool and obfuscate origins of illicit cryptocurrency transfers, frustrating blockchain tracing by law enforcement." | Indictment ¶ 14, Page 6 | reviewed |
| T1078 | Valid Accounts Defense Evasion | "Threat actors utilized automated relayer services and programmatic API keys to deposit and withdraw stolen funds without presenting customer identity credentials." | Indictment ¶ 29, Page 12 | reviewed |