{
  "id": "case-tornado-cash-storm-pertsev",
  "slug": "us-v-tornado-cash-storm-pertsev",
  "title": "U.S. v. Roman Storm & Alexey Pertsev (Tornado Cash $1B Heist)",
  "summary": "Landmark federal criminal indictment in the Southern District of New York against founders of the Tornado Cash cryptocurrency mixer for conspiracy to commit money laundering and sanctions violations, knowingly facilitating over $1 billion in illicit transactions including hundreds of millions stolen by North Korea's state-sponsored Lazarus Group.",
  "case_number": "1:23-cr-00430",
  "court": "U.S. District Court for the Southern District of New York",
  "district": "S.D.N.Y.",
  "country": "United States",
  "opened_at": "2023-08-23",
  "status": "charged",
  "victim_sector": "Cryptocurrency & Financial Services",
  "victim_country": "United States",
  "loss_amount_usd": 1000000000,
  "loss_amount_note": "Over $1 billion in total criminal proceeds laundered, including $455M from the Axie Infinity Ronin Bridge heist.",
  "first_seen_at": "2019-08-01T00:00:00Z",
  "last_updated_at": "2026-10-18T10:00:00Z",
  "actor_slug": "lazarus-group",
  "defendant_slugs": [],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1567",
      "evidence_excerpt": "Operated non-custodial smart contracts designed to pool and obfuscate origins of illicit cryptocurrency transfers, frustrating blockchain tracing by law enforcement.",
      "evidence_locator": "Indictment \u00b6 14, Page 6",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "DOJ Indictment: U.S. v. Storm and Semenov",
      "source_url": "https://www.justice.gov/opa/pr/tornado-cash-founders-charged-money-laundering-and-sanctions-violations",
      "technique_name": "Exfiltration Over Web Service",
      "tactic": "Exfiltration"
    },
    {
      "technique_id": "T1078",
      "evidence_excerpt": "Threat actors utilized automated relayer services and programmatic API keys to deposit and withdraw stolen funds without presenting customer identity credentials.",
      "evidence_locator": "Indictment \u00b6 29, Page 12",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "DOJ Indictment: U.S. v. Storm and Semenov",
      "source_url": "https://www.justice.gov/opa/pr/tornado-cash-founders-charged-money-laundering-and-sanctions-violations",
      "technique_name": "Valid Accounts",
      "tactic": "Defense Evasion"
    }
  ],
  "events": [
    {
      "event_type": "sanctions",
      "event_date": "2022-08-08",
      "description": "U.S. Department of the Treasury OFAC sanctions Tornado Cash for laundering funds stolen by DPRK Lazarus Group."
    },
    {
      "event_type": "indictment",
      "event_date": "2023-08-23",
      "description": "S.D.N.Y. grand jury indicts founders Roman Storm and Roman Semenov on three criminal counts."
    },
    {
      "event_type": "trial",
      "event_date": "2024-05-14",
      "description": "Dutch court finds co-founder Alexey Pertsev guilty of money laundering, sentencing him to 64 months imprisonment."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Initial access established against Cryptocurrency & Financial Services infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Landmark federal criminal indictment in the Southern District of New York against founders of the Tornado Cash cryptocurrency mixer for conspiracy to commit money laundering and sanctions violations, knowingly facilitating over $1 billion in illicit transactions including hundreds of millions stolen by North Korea's state-sponsored Lazarus Group.",
    "blast_radius": "Resulted in $1,000,000,000 in documented financial liabilities. Over $1 billion in total criminal proceeds laundered, including $455M from the Axie Infinity Ronin Bridge heist.",
    "kill_chain": [
      {
        "phase": "Phase 1: Defense Evasion",
        "title": "Defense Evasion & Security Blindfolding",
        "description": "Threat actors utilized automated relayer services and programmatic API keys to deposit and withdraw stolen funds without presenting customer identity credentials.",
        "technical_artifacts": [
          "T1078",
          "Valid Accounts"
        ],
        "mitre_technique_id": "T1078"
      },
      {
        "phase": "Phase 2: Exfiltration",
        "title": "Encrypted Cloud Data Exfiltration",
        "description": "Operated non-custodial smart contracts designed to pool and obfuscate origins of illicit cryptocurrency transfers, frustrating blockchain tracing by law enforcement.",
        "technical_artifacts": [
          "T1567",
          "Exfiltration Over Web Service"
        ],
        "mitre_technique_id": "T1567"
      },
      {
        "phase": "Phase 3: Expansion",
        "title": "Internal Traversal & Privilege Escalation",
        "description": "Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Cryptocurrency & Financial Services infrastructure.",
        "technical_artifacts": [
          "Internal administrative sessions",
          "Network telemetry"
        ],
        "mitre_technique_id": "T1021.002"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across 100% of external and administrative access portals.",
      "Implement network microsegmentation to restrict lateral movement between user workstations and core enclaves.",
      "Maintain immutable, isolated offline backups of mission-critical databases and directory services.",
      "Conduct regular tabletop simulations and verify incident response escalation procedures with legal counsel."
    ]
  }
}