Worked example · 2024-01

Post-Tornado-Cash DeFi yield-protocol laundering shift — cross-chain — 2024 onward

Loss: structural — this is a pattern case rather than a single incident. After the U.S. Treasury OFAC sanctions against Tornado Cash (August 2022), illicit actors — most prominently the OAK-G01 Lazarus Group / DPRK-attributed cluster — shifted laundering infrastructure from mixer services (T7.001) to legitimate DeFi yield protocols (lending markets, liquid-staking protocols, yield-aggregating vaults) used as "yield user" cover. The volume laundered through DeFi yield protocols post-sanctions is estimated by Chainalysis in the multi-billion-dollar range across 2023–2025; the per-protocol operator-side fee accrual from laundering flows is documented at THORChain (~$12M in the Bybit 2025 laundering window, per [chainalysisbybitthorchain]) and at several major Ethereum lending and liquid-staking protocols whose fee structures are public but whose specific laundering-attributable fee fractions are not disaggregated in the public record.
Recovery: N/A — structural pattern; recovery is foreclosed once illicit funds enter permissionless DeFi yield protocols, because the withdrawal event is indistinguishable from legitimate yield-user behaviour at the per-transaction level. Per-position behavioural analysis (deposit-to-withdrawal duration, yield-claim absence, no APY-sensitivity, deposit-source / withdrawal-recipient mismatch) is the recommended detection surface per specs/T7.006-defi-yield-strategy-laundering.yml.
OAK Techniques observed: OAK-T7.006 (DeFi Yield-Strategy Laundering) — primary. The technique is the use of legitimate DeFi yield protocols (Aave, Compound, Lido, Yearn, Convex, and analogous venues) as laundering infrastructure by depositing illicit proceeds into yield-generating positions and withdrawing them after a minimum-lockup duration, presenting the funds as legitimate yield-farming proceeds. OAK-T7.003 (Cross-Chain Bridge Laundering) — adjacent; the canonical post-Tornado-Cash laundering chain typically involves a bridge hop (T7.003) to move funds to the chain hosting the target yield protocol, followed by the yield-protocol deposit/withdrawal cycle (T7.006). OAK-T7.001 (Mixer-Routed Hop) — pre-sanctions predecessor Technique; the OFAC sanctions reduced but did not eliminate T7.001 usage, and the shift from T7.001 to T7.006 + T7.003 is the load-bearing structural observation.
Attribution: inferred-strong at the cluster level — OAK-G01 Lazarus Group / DPRK-attributed as the dominant documented user of the T7.006 pattern at scale. Chainalysis [chainalysisbybitthorchain] [chainalysis2024laundering], TRM Labs, and Elliptic forensic analyses converge on G01 as the principal cluster routing nine-to-ten-figure volumes through DeFi yield infrastructure in the 2023–2025 window. Attribution is confirmed at the cluster level per FBI IC3 PSA 2025-02-26 for the Bybit extraction; the yield-protocol laundering leg is a continuation of the same cluster's post-extraction routing.
OAK-Gnn: OAK-G01 Lazarus Group / DPRK-attributed.
Key teaching point: T7.006 is the OAK framework's entry for a laundering Technique that became operationally dominant after the OFAC sanctions against Tornado Cash removed the dominant mixer primitive from the landscape. The T7.006 pattern — depositing illicit proceeds into DeFi yield protocols and withdrawing them under "yield user" cover — was observed at scale by Chainalysis, TRM Labs, and Elliptic across the 2023–2025 window, with the OAK-G01 Lazarus Group as the highest-volume documented cluster.

Summary

The U.S. Treasury OFAC sanctions against Tornado Cash (August 2022) removed the dominant on-chain mixer primitive from the illicit-finance infrastructure landscape. The sanctions did not eliminate on-chain laundering; they shifted it. Illicit actors — with the OAK-G01 Lazarus Group as the highest-volume documented cluster — migrated from mixer services (T7.001) to a composition of cross-chain bridge hops (T7.003) and DeFi yield-protocol deposits (T7.006). The composition is structurally load-bearing: the bridge hop breaks the chain-of-custody trail at the source-chain boundary, and the yield-protocol deposit/withdrawal cycle presents the funds as legitimate DeFi user activity.

The T7.006 pattern is behaviourally distinguishable from legitimate yield-seeking. The four detection PATHs documented in specs/T7.006-defi-yield-strategy-laundering.yml capture the signal:

PATH A (per-deposit duration vs baseline): illicit deposits stay at the protocol's minimum-lockup duration and produce no yield-claim event — the depositor is not optimising for yield but for cover duration.
PATH B (no APY-sensitivity / no rebalancing): the position does not move when APYs shift across competing protocols — the depositor is insensitive to the economic signal that drives legitimate yield-seekers.
PATH C (deposit-source / withdrawal-recipient mismatch): the protocol permits non-self-recipient withdrawal and the recipient-cluster differs from the deposit-source-cluster — the laundering chain introduces a custody-break at the protocol boundary.
PATH D (cross-protocol rotation graph): watchlisted-source-cluster trajectory traverses N≥3 yield protocols within a short window without yield-claim events — the rotation is cover-maximising, not yield-maximising.

The OAK-G01 Lazarus Group's post-2022 operational pattern is the canonical worked evidence for the T7.006 detection surface. Per Chainalysis [chainalysis2024laundering] and TRM Labs' post-Bybit forensic reporting, the cluster's post-extraction routing since late 2022 has consistently included a DeFi yield-protocol leg — typically a deposit into a major Ethereum lending market (Aave, Compound), a liquid-staking protocol (Lido), or a yield-aggregating vault (Yearn, Convex) — held for the minimum economically-rational duration before withdrawal into a fresh address cluster. The pattern exploits the legitimate-user cohort density of the deepest-liquidity DeFi protocols to embed illicit flows within a high-background-noise environment.

Timeline (UTC)

When	Event	OAK ref
2022-08	U.S. Treasury OFAC sanctions Tornado Cash; mixer-service laundering infrastructure contracts	(T7.001 surface contracts)
2022-Q4 to 2023-Q1	Illicit clusters — OAK-G01 primary — begin shifting laundering infrastructure from mixers to DeFi yield protocols + cross-chain bridges; Chainalysis `[chainalysis2024laundering]` documents the structural shift	T7.006 + T7.003 shift begins
2023–2024	DeFi yield protocols (Aave, Compound, Lido, Yearn, Convex, and analogous) accumulate illicit-cluster deposits at detectable volumes; per-position behavioural signal (PATHs A/B/C/D from the T7.006 spec) is distinguishable from the legitimate-user baseline but no protocol-level monitoring is operational at cohort scale	T7.006 operational at scale
2024–2025	Multiple nine-to-ten-figure extraction events (Bybit February 2025 — see `examples/2025-02-bybit.md` and `examples/2025-02-bybit-thorchain-laundering.md`; others in the G01 cohort) route proceeds through DeFi yield protocols as a standard leg of the post-extraction laundering chain	T7.006 + T7.003 composition at scale
Continuing	Per TRM Labs and Chainalysis monitoring, the T7.006 pattern remains operational as of v0.1 freeze; per-protocol detection PATHs are deployable but not yet operational at industry scale	(ongoing surface)

What defenders observed

The shift from T7.001 to T7.006 + T7.003 is operationally observable at the laundering-infrastructure layer. Chainalysis [chainalysis2024laundering] documents the structural shift in laundering-infrastructure usage post-Tornado-Cash sanctions. The shift is not a theoretical prediction; it is an observed, documented, multi-year operational reality with the OAK-G01 Lazarus Group as the highest-volume cluster.
Per-position behavioural signal is distinguishable from the legitimate-user baseline. The four PATHs in the T7.006 detection spec are designed to discriminate illicit-cluster yield-protocol usage from legitimate yield-seeking, and the discriminator quality improves as the legitimate-user baseline density increases — exactly the condition at the deepest-liquidity DeFi protocols that illicit clusters preferentially target.
Protocol-level monitoring was not operational at cohort scale at v0.1 freeze. No major DeFi lending protocol, liquid-staking protocol, or yield-aggregating vault had deployed T7.006-specific monitoring (per-position duration-vs-baseline analysis, APY-sensitivity tracking, deposit-source/withdrawal-recipient mismatch detection, cross-protocol rotation-graph analysis) at the time of the documented laundering patterns. The monitoring gap is the load-bearing defender observation.
The composition T7.006 + T7.003 is the canonical post-Tornado-Cash laundering chain. T7.003 (cross-chain bridge) provides the chain-of-custody break at the source-chain boundary; T7.006 (yield-protocol deposit) provides the legitimate-user cover at the destination. The two Techniques compose into a laundering chain that is structurally more resilient than the pre-sanctions T7.001-only chain because the individual legs (bridge hop, yield-protocol deposit) are each, considered in isolation, legitimate protocol usage.

Public references

[chainalysis2024laundering] — Chainalysis 2024 money-laundering report documenting the post-Tornado-Cash-sanctions shift from mixers to DeFi yield protocols and cross-chain bridges.
[chainalysisbybitthorchain] — Chainalysis forensic analysis of the Bybit February 2025 laundering chain including DeFi yield-protocol and bridge-hop legs.
[coindeskthorchainlazarus2025] — CoinDesk investigative reporting on the Lazarus Group's ~$1.4B THORChain laundering operation; secondary source for the yield-protocol leg of the laundering chain.
[trmbybit2025] — TRM Labs forensic analysis of the Bybit laundering window; per-window dollar accounting and DeFi-protocol usage characterisation.
[ellipticbybit2025] — Elliptic forensic confirmation of Bybit laundering chain including yield-protocol legs.

Discussion

T7.006 is the OAK framework's entry for a laundering Technique that became operationally dominant after the OFAC sanctions against Tornado Cash removed the dominant mixer primitive from the landscape. The T7.006 pattern — depositing illicit proceeds into DeFi yield protocols and withdrawing them under "yield user" cover — was observed at scale by Chainalysis, TRM Labs, and Elliptic across the 2023–2025 window, with the OAK-G01 Lazarus Group as the highest-volume documented cluster.

The technique is structurally important for the OAK detection framework because it exploits a property that makes DeFi yield protocols high-quality cover: the legitimate-user baseline density is highest at the deepest-liquidity protocols, and the per-position behavioural signal that discriminates illicit from legitimate usage (deposit duration, yield-claim absence, APY-sensitivity, cross-protocol rotation without yield claims) requires protocol-level monitoring that was not operational at cohort scale at v0.1 freeze. The detection PATHs documented in the T7.006 spec are deployable but the deployment coverage remains incomplete.

The technique is also the cleanest OAK example of the sanctions-driven technique substitution dynamic that the framework expects to repeat: when a dominant Technique is operationally degraded by regulatory or law-enforcement action, the illicit-actor cohort substitutes to the next-most-efficient available Technique, and the defender-side monitoring surface must shift correspondingly. The T7.001 → T7.006 + T7.003 substitution is the canonical v0.1 case; future T7-class entries should expect analogous substitution dynamics as regulatory and law-enforcement pressure continues to reshape the laundering-infrastructure landscape.