Mixer Tornado Cash and the Lazarus Group Question

Prepared by the editorial team. Updated August 31, 2026.

Mixer Tornado Cash was designated in August 2022 on a record in which state-linked theft featured heavily, and the figures from that record still anchor most discussion of the protocol. Treasury asserted that more than $7 billion had been laundered through the service since 2019, including over $455 million attributed to the DPRK-linked Lazarus Group. Both are government assertions rather than adjudicated findings, and researchers have contested the larger one.

What did Treasury assert about the Lazarus Group?

That the service had been used to launder more than $7 billion in virtual currency since 2019, of which over $455 million was attributed to the Lazarus Group, a hacking organisation linked to North Korea and separately designated in 2019. These figures were stated in the designation announcement as the government’s own assertions.

The same announcement itemised two further incidents. It attributed more than $96 million from the June 2022 Harmony Bridge heist and at least $7.8 million from the August 2022 Nomad heist to funds moved through the pools. Treasury’s August 2022 press release remains the primary document for all of these numbers, and anyone citing them is ultimately citing it.

It is worth being precise about what kind of document that is. A designation is an executive action supported by an administrative record: no trial, no cross-examination, no independent finder of fact, and not the standard a criminal court would apply. That does not make the assertions wrong; it makes them assertions rather than verdicts.

The Lazarus element was central to the framing rather than incidental to it. Treasury presented the action in national security terms, on the reasoning that proceeds from state-linked theft ultimately support weapons programmes. That framing explains why a privacy tool was treated as a proliferation concern rather than solely as a financial-crime one.

Why is blockchain attribution to a state actor so difficult?

Because on-chain evidence shows the movement of value and not the identity or nationality of whoever caused it. Attributing a movement to a state programme depends on material the chain does not contain: malware similarity, infrastructure reuse, operational timing and intelligence that is usually not published. The ledger supplies a trail, and the name at the end of it comes from somewhere else.

The chain of reasoning has several joints, each of which can slip. Analysts cluster addresses they believe share control, connect a cluster to a specific incident, then attach a group name assigned during earlier incidents. Every joint is probabilistic, and the final label inherits all that uncertainty without displaying it.

Incentives cut in both directions. A sophisticated actor has reason to imitate another actor’s known patterns, which weakens pattern-matching evidence. Governments hold corroborating material they cannot disclose, so the strongest support for an attribution is often the part no outside reader can examine. An attribution can therefore be well founded and unverifiable at once, which is why calibrated confidence beats a yes or no.

Why are the headline figures contested?

Chiefly because the $7 billion figure appears to describe total value passing through the pools rather than criminal proceeds, and those are different quantities. Researchers argued that a substantial share of that flow had no connection to any illicit source. No itemised derivation was published, so the number cannot be independently reconstructed.

Two mechanical problems inflate throughput totals. Funds moving through a pool more than once are counted more than once unless the methodology prevents it, and the fixed-denomination design means one sum often produces many separate transactions. A total built by summing transaction values therefore exceeds the distinct value involved.

The $455 million figure is narrower and rests on specific incident attributions, which makes it more checkable in principle. In practice it inherits whatever uncertainty attaches to those attributions, so it reads best as a conditional: if the underlying incidents are correctly attributed, this is the approximate sum traced through the pools.

Contested figures also harden with repetition. Each retelling drops a qualifier until an assertion made in a press release circulates as an established total. The March 2025 delisting did not revisit the numbers, so the original figures and the disagreement about them both remain exactly where they were.

How can you trace a cited figure back to its primary source?

You trace it by following the citation chain to the earliest document that states the number, establishing what the number counts, looking for a published derivation, comparing the wording across retellings, and recording the figure with its provenance attached. The procedure applies to any widely repeated statistic, not only to this one.

Step 1: Find the earliest document that states it

Follow the citation chain backwards until you reach the earliest document that states the number rather than repeating it, because most sources cite one another rather than anything original. A chain that loops without reaching a primary document usually means no primary document was ever consulted.

Step 2: Establish what the figure counts

Determine precisely what the figure measures, since total volume, criminal proceeds and losses suffered by victims are three different quantities that are routinely reported with the same currency symbol. The unit of measurement explains more disagreements than any dispute about arithmetic does.

Step 3: Look for a published derivation

Look for a methodology, dataset or calculation behind the number, and note explicitly when none has been published. An assertion without a derivation can still be accurate, but it cannot be checked, and those are different properties that often get treated as one.

Step 4: Compare the wording across retellings

Compare how the figure is worded in the primary document with how later sources word it, because qualifiers such as approximately, alleged or attributed tend to fall away with each retelling. A number that began life as an assertion frequently arrives as a settled fact without anything having been settled.

Step 5: Record the figure with its provenance

Store the figure together with its source, its date and its attribution rather than on its own. A number kept without provenance becomes indistinguishable from a verified one the next time you reach for it.

What does the dual-use dilemma look like from both sides?

From the security side, a tool that reliably breaks a transaction trail is most valuable to whoever most needs the trail broken, and proceeds from state-linked theft fund weapons programmes. From the civil liberties side, general-purpose financial privacy protects ordinary people from surveillance, targeting and extortion. Both descriptions are accurate at the same time.

What makes the dilemma genuinely hard is the design itself. The core pool contracts are immutable, with no owner and no pause function, so there is no mechanism by which the tool could admit one population and refuse another. The property that makes it credible as a privacy system is the same property that makes it unable to discriminate, and no amount of good intent by anyone changes that.

The legal record reflects an unresolved trade-off rather than a settled answer. A designation in 2022, a Fifth Circuit ruling in November 2024 that immutable contracts are not property capable of designation, and a removal from the list in March 2025 do not describe a consensus arriving. They describe institutions reaching different answers at different stages, with criminal proceedings running separately throughout.

Competing arguments on the dual-use question

The two positions are usually presented one at a time, which makes each look stronger than it is. The table sets the main arguments against each other by topic, without endorsing either column.

Question at issue	Security framing	Civil liberties framing
Who bears a restriction?	Everyone using the tool, since it cannot distinguish between users	Mainly lawful users, because determined actors retain other options
How severe is the harm?	Stolen funds support weapons programmes, an acute national concern	Serious misuse by some users is not normally imputed to all users
Can the tool be selective?	An immutable contract cannot screen, which is precisely the problem	An immutable contract also has no operator who could be made to screen
What does restriction achieve?	It raises cost and friction for the most damaging actors	It displaces activity elsewhere while removing an option from everyone
What precedent follows?	Sanctions authority has to adapt to new financial infrastructure	The theory extends to any privacy technology that works as designed

Neither column collapses under the other. That is the defining feature of a dual-use problem, and the reason coverage that presents only one side reads as more conclusive than the underlying question allows.

Frequently asked questions

Were the 2022 figures ever formally retracted or revised?

No public retraction or revision has been issued. The March 2025 delisting removed the name from the sanctions list without revisiting the numbers stated in the 2022 announcement. The assertion and the research disagreement about it both remain on the record, unresolved.

Did the Fifth Circuit ruling address the Lazarus allegations?

No. Van Loon v. Department of the Treasury decided a statutory question about whether immutable smart contracts are property capable of being designated, and it did not weigh the factual claims about who used the pools. A ruling about the limits of agency authority is not a finding about anybody’s conduct.

Is the Lazarus Group a single fixed organisation?

The name works as an umbrella label used by governments and researchers for a set of activity clusters attributed to North Korean state operations, and different analysts draw the boundaries between named groups differently. Treating it as one stable entity overstates how precise the underlying taxonomy is.

Does heavy misuse by a state actor settle the policy question?

It settles nothing on its own, because the policy question also depends on whether a given restriction actually reduces the misuse and what that restriction costs everyone else. Those are empirical and normative questions that a volume figure cannot answer, however large the figure is.