YoMix is a Bitcoin mixing service used to obscure cryptocurrency flows, not malware. After Sinbad was sanctioned and shut down in November 2023, YoMix became a replacement mixer for Lazarus Group, which had previously shifted from Tornado Cash to Sinbad. A transaction graph showed a wallet associated with North Korean hacking receiving funds from YoMix where it had formerly received funds from Sinbad. YoMix inflows increased by more than fivefold during 2023, and about one third of its total inflows came from wallets associated with cryptocurrency hacks.