Blender.io

» see blender.io as it lived, on the wayback machine

~ the goodbye ~

Blender.io's whole life sits inside years i was working, and none of it came near me. By 2017 i was a computer engineer in Ankara doing vision work, and the closest i got to this part of the internet was reading about exchange collapses in the trade press. A mixer is infrastructure for people with something to hide. I had nothing to run through one.

What it did is short enough to explain in a sentence. You sent bitcoin in, the service pooled it with everybody else's, and it paid you back out to a fresh address from that pool, so the chain no longer drew a line from where the money came from to where it went. Blender took a fee for this and added a random delay, because a mixer that pays out instantly and in round numbers has not mixed anything.

It opened in 2017 and by the time the US Treasury got to it the service had moved more than 500 million dollars in bitcoin. The designation notice lists what went through: ransomware proceeds from Trickbot and Conti among others, plus 20.5 million dollars out of the largest cryptocurrency theft on record at that point.

That theft was on 23 March 2022, when the Lazarus Group, working for North Korea, took almost 620 million dollars out of the Ronin bridge serving the game Axie Infinity. Blender laundered a slice of it. Six weeks later the mixer was sanctioned for it, and that sanction was the first one the United States ever wrote against a virtual currency mixer.

~ the chronicle ~

~ how a mixer stayed in business ~

The trust arrangement is the interesting part, because there was none. You handed your bitcoin to an anonymous operator on the promise that different bitcoin would come back, and you had no contract and no recourse. What held it together was reputation on forums and the fact that the operator made more from fees over time than from stealing the float once.

That arithmetic only holds while the service has a future. The moment it does not, the float is the last payday available, and every user has already agreed in advance that they cannot go to the police.

~ how it actually ended ~

The order of events is what people get backwards. Blender stopped operating in April 2022, before the designation landed on 6 May. It was not shut down by the Treasury and it was not seized. The operator closed it and left with roughly 22 million dollars in bitcoin belonging to the customers.

So the first sanctions ever issued against a mixer hit a service that had already emptied itself. The listed addresses still mattered, because coins sitting in them stayed radioactive to every exchange with a compliance department, but there was no business at the other end of the order.

~ what came back ~

In October 2022 a new mixer called Sinbad.io appeared and started handling Lazarus money. Elliptic published the analysis in February 2023 showing it was Blender under another name, matching it on transaction patterns and on the way the new service had been funded out of the old one. Treasury sanctioned Sinbad on 29 November 2023, and its servers were seized in the Netherlands and Finland.

~ the indictment ~

On 7 January 2025 a federal grand jury in the Northern District of Georgia named three Russian nationals for running both services. Roman Ostapenko and Alexander Oleynik had been arrested on 1 December 2024. Anton Tarasov was charged and not in custody.

The counts are conspiracy to commit money laundering and two counts of operating an unlicensed money transmitting business. The second one is the charge that does the work in cases like this, because it does not require proving where any particular coin came from. Running the machine without registering it is the offense on its own.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »