FBI Seeks Tornado Cash Co-Founder Roman Semenov in $1 Billion Cryptocurrency Money Laundering Case

Jan 21

Russian Cryptocurrency Developer Wanted on Money Laundering and Sanctions Charges

Roman Semenov, a Russian cryptocurrency developer and co-founder of Tornado Cash, is wanted by the Federal Bureau of Investigation on federal charges involving money laundering, operation of an unlicensed money transmitting business, and violations of United States sanctions laws. Federal authorities say Tornado Cash was used to launder more than $1 billion in criminal proceeds, including hundreds of millions of dollars connected to the Lazarus Group, a North Korean state-sponsored cybercrime organization. A federal arrest warrant was issued for Semenov on August 21, 2023, by the United States District Court for the Southern District of New York.

Semenov remains at large and is currently featured on the FBI's Most Wanted white-collar crime list. The FBI identifies him as a Russian national with ties to Turkey, Dubai in the United Arab Emirates, and Moscow, Russia. He is also known by the aliases "Poma" and "Roma."

The Creation of Tornado Cash

Tornado Cash was launched in 2019 as a cryptocurrency mixing service designed to increase the anonymity of digital-asset transactions. Semenov, Roman Storm, and a third co-founder developed and operated the service, creating its core features and supporting the infrastructure necessary to keep it functioning. The service allowed users to obscure the connection between cryptocurrency entering Tornado Cash and cryptocurrency later withdrawn from it, making transaction histories significantly more difficult to trace.

Tornado Cash promoted itself as providing anonymous and untraceable cryptocurrency transactions. Federal prosecutors say Semenov and Storm paid for critical infrastructure, promoted the service to users, and made millions of dollars from operating it. Authorities also say the founders chose not to implement required know-your-customer and anti-money-laundering programs while continuing to operate a service handling enormous volumes of cryptocurrency.

Semenov's role extended beyond simply being associated with the project. The United States Treasury describes him as actively involved in promoting Tornado Cash through media and online platforms, where he provided users with information about increasing the anonymity of their cryptocurrency transactions. His technical background included work as a zkSNARK researcher, backend developer, and blockchain researcher and developer.

More Than $1 Billion in Criminal Proceeds

Federal authorities say Tornado Cash was ultimately used to launder more than $1 billion in criminal proceeds. Cryptocurrency mixers can obscure the movement of digital assets by breaking the publicly visible connection between the address sending cryptocurrency and the address ultimately receiving it. While privacy technologies can have lawful uses, federal prosecutors say Tornado Cash became a major mechanism for criminals seeking to conceal stolen cryptocurrency.

The federal indictment states that Semenov and the other founders knew the service was being used for money laundering and received complaints and requests for assistance from victims of hacking and other cybercrimes. Despite receiving information concerning criminal use of the platform, prosecutors say they continued operating Tornado Cash without implementing effective controls to prevent illicit transactions. The service continued processing cryptocurrency while criminal organizations used its privacy features to conceal where stolen assets were being moved.

The investigation eventually became more than a conventional cryptocurrency money-laundering case. Tornado Cash was used by hackers connected to North Korea, transforming the operation into a matter involving United States national security and economic sanctions. The transactions involving the Lazarus Group became a central part of the federal charges against Semenov.

Connection to North Korea's Lazarus Group

The Lazarus Group is a North Korean state-sponsored cybercrime organization that has been sanctioned by the United States since 2019. The United States government identifies the organization as an agency, instrumentality, or controlled entity of the North Korean government. The group has been responsible for major cryptocurrency thefts and other cyber operations that have generated enormous amounts of stolen digital assets.

United States authorities say Lazarus Group hackers used Tornado Cash to conceal hundreds of millions of dollars in stolen cryptocurrency. In April and May 2022, the service was used to move proceeds connected to major cryptocurrency thefts even after information linking the transactions to North Korea had become known. Federal prosecutors say Semenov and his co-conspirators knew that Tornado Cash was facilitating transactions that violated United States sanctions but continued operating the service.

The Treasury Department says Semenov learned in April 2022 that an Ethereum address publicly attributed to the Lazarus Group was using Tornado Cash. That address contained hundreds of millions of dollars in stolen cryptocurrency from the Ronin network bridge attack and had been identified on the United States government's sanctions list. Despite that knowledge, authorities say Semenov continued participating in the operation and maintenance of Tornado Cash.

The $620 Million Ronin Network Attack

One of the largest cryptocurrency thefts connected to the case was the March 2022 attack on the Ronin network bridge. The attack resulted in approximately $620 million in stolen cryptocurrency and became the largest known virtual-currency theft at the time. The United States government attributed the attack to the Lazarus Group.

Treasury says the Lazarus Group subsequently used Tornado Cash to obscure the movement of more than $455 million stolen in the Ronin attack. Moving stolen cryptocurrency through a mixing service made tracing the funds more difficult by separating the original wallet addresses from the addresses eventually receiving the digital assets. The enormous amount of cryptocurrency involved made the Tornado Cash transactions a major focus for federal investigators.

The Ronin theft was not the only major hacking operation connected to Tornado Cash. North Korean hackers continued using cryptocurrency infrastructure to move proceeds from additional cyberattacks. Federal authorities say Tornado Cash continued facilitating transactions connected to the Lazarus Group even after the founders knew that sanctioned North Korean actors were using the service.

Harmony Horizon and Nomad Heists

The Lazarus Group also used Tornado Cash following the June 24, 2022, attack against Harmony's Horizon bridge. Treasury says more than $96 million connected to that cyber-enabled theft was laundered through Tornado Cash. The group later used the service to move at least $7.8 million connected to the August 2, 2022, Nomad cryptocurrency heist.

These transactions occurred after concerns about North Korea's use of cryptocurrency mixers had become increasingly clear. Federal authorities say Semenov and his fellow founders continued supporting Tornado Cash despite knowing that sanctioned actors were using the platform to move stolen assets. Prosecutors contend that the service therefore became an important part of the financial infrastructure used to conceal proceeds from major international cryptocurrency thefts.

The United States government views North Korea's cryptocurrency theft operations as a national-security issue rather than simply a series of financial crimes. Treasury says revenue generated through cyber-enabled theft provides the North Korean government with resources supporting its unlawful ballistic-missile and nuclear-weapons programs. Preventing stolen cryptocurrency from being successfully laundered has consequently become part of broader efforts to disrupt North Korean sanctions evasion.

Sanctions Screening That Authorities Say Was Easy to Evade

As scrutiny of Tornado Cash increased, the service introduced a front-end sanctions screening mechanism. Treasury says Semenov and the other founders knew that the measure could easily be bypassed and did not sufficiently address the continuing use of Tornado Cash by North Korean actors. Authorities say the founders continued paying for infrastructure and developing the service while failing to implement meaningful measures capable of preventing sanctioned transactions.

Blockchain analysis and inquiries concerning the movement of stolen cryptocurrency provided additional information about how Tornado Cash was being used. Treasury says Semenov ignored or downplayed evidence that North Korean hackers were laundering stolen digital assets through the service. He continued participating in Tornado Cash operations after multiple high-profile cryptocurrency thefts brought additional attention to the platform.

The government's case therefore focuses not simply on the existence of a privacy technology but on how authorities say the service was operated after its founders became aware of large-scale criminal and sanctions-violating activity. Prosecutors maintain that Semenov and his co-conspirators knowingly continued facilitating transactions after receiving information about illicit use. Those allegations underpin the money-laundering and sanctions charges now pending against him.

Tornado Cash Sanctioned by the United States

The United States Treasury's Office of Foreign Assets Control sanctioned Tornado Cash in August 2022. The government determined that the service had been used to launder billions of dollars' worth of cryptocurrency since its creation, including funds stolen by the Lazarus Group. The sanctions prohibited transactions involving Tornado Cash property or interests in property subject to United States jurisdiction.

One year later, on August 23, 2023, Treasury separately sanctioned Roman Semenov. The designation cited his role in providing material support to Tornado Cash and the Lazarus Group. Treasury's action occurred alongside the Justice Department's announcement of federal criminal charges against Semenov and fellow Tornado Cash co-founder Roman Storm.

As a result of the designation, Semenov's property and interests in property located in the United States or possessed or controlled by United States persons became subject to blocking requirements. United States sanctions regulations also generally prohibit transactions involving blocked individuals and property unless authorized. The Treasury action added significant financial restrictions to the criminal case already being pursued by federal investigators.

Federal Charges Against Semenov and Roman Storm

Federal prosecutors charged Semenov and Roman Storm with conspiracy to commit money laundering, conspiracy to operate an unlicensed money transmitting business, and conspiracy to violate the International Emergency Economic Powers Act. The indictment was unsealed in Manhattan federal court on August 23, 2023. Storm was arrested in Washington state that day, while Semenov remained outside federal custody.

The money-laundering conspiracy charge carries a maximum statutory penalty of 20 years in prison, while the sanctions conspiracy charge carries a maximum of 20 years. Conspiracy to operate an unlicensed money transmitting business carries a maximum statutory penalty of five years. Any sentence would ultimately be determined by a federal judge if a defendant were convicted.

The case was investigated by the FBI and Internal Revenue Service Criminal Investigation, with assistance from the Justice Department's Office of International Affairs and the Joint Chiefs of Global Tax Enforcement. Prosecutors from the Southern District of New York's Money Laundering and Transnational Criminal Enterprises Unit and the Justice Department's National Cryptocurrency Enforcement Team have handled the prosecution.

A Third Tornado Cash Founder Arrested in Europe

Tornado Cash had three principal co-founders, and Semenov is not the only one to face criminal proceedings. Alexey Pertsev, the third co-founder, was arrested by Dutch law-enforcement authorities in the Netherlands in August 2022 on related money-laundering charges. Roman Storm was later arrested in the United States when the American indictment was announced in August 2023.

Semenov remained at large following the announcement of the charges and became the subject of an FBI wanted notice. His case consequently developed into an international fugitive investigation involving a Russian national with connections across several countries. The FBI's New York Field Office continues to list him among the individuals it is seeking.

The international nature of the case reflects the borderless structure of cryptocurrency markets themselves. Developers can operate infrastructure from one country, customers can access services from another, and digital assets can move between blockchain addresses without following traditional international banking routes. Investigating and prosecuting these cases therefore frequently requires cooperation between law-enforcement agencies across multiple jurisdictions.

Who Is Roman Semenov?

Roman Semenov was born on November 8, 1987, in Novocherkask, Russia, and is a Russian national. The FBI describes him as having brown hair and green eyes and identifies his professional background as a zkSNARK researcher, backend developer, and blockchain researcher and developer. He is also known by the aliases "Poma" and "Roma."

The FBI states that Semenov has ties to Turkey, Dubai in the United Arab Emirates, and Moscow, Russia. Those international connections are significant because Semenov has remained outside federal custody since the criminal charges were announced. The bureau has released photographs and wanted posters in English, Arabic, and Russian to assist with locating him.

His technical expertise is also relevant to the federal case. Semenov was not simply an investor or customer of Tornado Cash but one of the developers authorities say helped create and maintain its core infrastructure. Federal prosecutors say the founders collectively designed the service, funded critical infrastructure, promoted it, and profited from its operation.

Cryptocurrency Privacy and Criminal Money Laundering

Cryptocurrency transactions are generally recorded on public blockchains, meaning transfers between addresses can often be viewed and analyzed. Cryptocurrency mixers are designed to make following those transactions more difficult by obscuring the relationship between incoming and outgoing digital assets. This privacy function can be attractive to legitimate users seeking financial anonymity, but it can also be exploited by hackers, fraudsters, ransomware operators, and other criminals attempting to conceal stolen funds.

The Tornado Cash prosecution has consequently become an important case at the intersection of cryptocurrency privacy, software development, money laundering, and financial regulation. Federal authorities maintain that the case concerns the knowing operation of a money-transmitting service that facilitated enormous amounts of criminal activity without implementing legally required controls. The government further argues that the continued processing of transactions connected to the Lazarus Group resulted in direct violations of United States sanctions.

The case has attracted attention throughout the cryptocurrency and privacy communities because of broader questions concerning decentralized software and the responsibility of developers for how technology is used. Those questions do not change Semenov's current legal status: he remains federally charged and wanted by the FBI. The charges against him remain pending while he is outside United States custody.

Semenov Remains Wanted

Roman Semenov remains wanted by the FBI on charges of conspiracy to commit money laundering, conspiracy to operate an unlicensed money transmitting business, and conspiracy to violate the International Emergency Economic Powers Act. His federal arrest warrant was issued on August 21, 2023, in the Southern District of New York, and the FBI continues to list him among its Most Wanted white-collar crime fugitives. Authorities have identified connections to Turkey, Dubai, and Moscow as part of the continuing effort to locate him.

Anyone with information concerning Semenov's whereabouts should provide that information directly to law enforcement. The FBI directs members of the public to contact their local FBI office or, if outside the United States, the nearest American Embassy or Consulate. Members of the public should not attempt to confront, follow, detain, or apprehend a wanted individual.