Sinbad - money-laundering facilitator

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Executive Summary

Sinbad refers to a cryptocurrency mixing (“tumbling”) service branded as Sinbad / Sinbad.io, assessed to have been used as a money-laundering facilitator for proceeds of major cryptocurrency thefts, including activity attributed by U.S. authorities to the DPRK-aligned Lazarus Group. The service was sanctioned by the U.S. Treasury (OFAC) on 2023-11-29 and its online infrastructure was seized in a coordinated law-enforcement action (per OSINT reporting and subsequent DOJ statements). INFERENCE (confidence: medium): Sinbad operated as a cybercrime-as-a-service laundering utility primarily serving high-risk users (state-linked and financially motivated cybercriminals), rather than a “market” in the classic goods marketplace sense.

• Actor type: Illicit service (crypto mixer / laundering infrastructure)
• Primary function: Obfuscate transaction provenance and counterparty linkage on the Bitcoin blockchain via mixing/tumbling workflows.
• Branding / identifiers: “SINBAD”, “SINBAD.IO” (surface domain and Tor onion), support/advertising email contacts, and associated Bitcoin deposit addresses.
• Assessed motivation: Financial gain through fee-based laundering facilitation.

Sinbad fits the broader “crypto laundering services market” that enables monetization pipelines for ransomware and large-scale virtual asset theft. Such services reduce the operational friction for threat actors to convert stolen assets into spendable funds and help sustain repeat-offender ecosystems.