The US DOJ indicts three Russian citizens for allegedly operating Bender.io and Sinbad.io crypto mixing services used by North Korea and ransomware gangs
If you own crypto, you are complicit. [embedded post] Mastodon: Lorenzo Franceschi-Bicchierai / @lorenzofb@infosec … : NEW: A year after seizing two cryptocurrency mixing services, the U.S. government is now accusing three Russian citizens of money laundering for their roles in operating those websites. — Two of the suspects have been arrested, one remains at large, per DOJ. — https://techcrunch.com/... X: Lorenzo Franceschi-Bicchierai / @lorenzofb : NEW: A year after seizing two cryptocurrency mixing services, the U.S. government is accusing three Russian citizens of money laundering for their roles in operating those websites. Two of the suspects have been arrested, one remains at large, per DOJ. https://techcrunch.com/...
Context & Ripple Effects
The indictments extend a U.S. campaign against Sinbad that had already produced sanctions and a multinational seizure of the service in 2023, now shifting attention from the platform to its alleged operators: the earlier Sinbad seizure.
The case also fits a broader DOJ focus on alleged Russian-linked laundering infrastructure serving cybercriminals, following charges over another large money-laundering service. The stated links to North Korea and ransomware make the enforcement action relevant beyond a single mixer.
First-order effects
- The three accused operators face U.S. money-laundering charges; two are reportedly in custody while one remains at large.
- Bender.io and Sinbad.io are further identified as alleged laundering infrastructure for North Korean and ransomware-linked proceeds, strengthening the legal case against their operation.
Second-order effects
- Mixer operators and the exchanges or services that interact with them face stronger pressure to screen for exposure to sanctioned or allegedly criminal laundering routes.
- Cybercrime groups that relied on these services must seek alternative ways to move funds, while investigators gain a clearer operator-level target rather than only seized domains.
Third-order effects
- The action points to enforcement moving up the crypto-laundering stack—from disrupting services to pursuing the people alleged to run them—though arrests across borders will determine its practical reach.
- If this pattern continues, privacy-oriented crypto infrastructure will face a widening legitimacy divide between lawful uses and services authorities tie to state-backed or ransomware activity.
The trend: Crypto enforcement is increasingly targeting the operators and financial plumbing that connect digital-asset services to cybercrime, not solely the illicit end users.