US Treasury Sanctions Crypto Mixing Protocol Tornado Cash

What happened? What is the legal significance? What happens next?

By: Evan Santos

What happened with Tornado Cash?

On Monday August 8, 2022, the U.S. Treasury announced it sanctioned Tornado Cash, an open-source crypto mixer. The Office of Foreign Asset Control (OFAC), a financial intelligence and enforcement agency of the U.S. Treasury Department added Tornado Cash and over 40 related Ethereum wallet addresses to the Specially Designated Nationals (SDN) list accusing it of helping hackers, including from North Korea, launder illicit proceeds.

According to the Treasury Department, for entities listed on the SDN all “assets are blocked and U.S. persons are generally prohibited from dealing with them.” OFAC’s actions essentially make it illegal for any U.S. person or company to interact with Tornado Cash or the Ethereum wallet addresses tied to the protocol. Those who do may face fines, civil and/or criminal penalties.

OFAC treats violations as  serious threats to national security and foreign relations. As a result, criminal offenders could face monetary fines—ranging from a few thousand dollars to several million—and up to 30 years in prison. Additionally, OFAC sanction violations are subject to a strict liability standard–as such, violations require no intent, knowledge, or reason to know one is dealing with a sanctioned person.

The impact of the sanctions were immediate with U.S. based company Circle freezing about $75,000 on Tornado Cash and crypto exchange dYdX blocking accounts that may have interacted with the protocol. 

Soon after, authorities  in the Netherlands announced the arrest of a 29-year old developer for suspected involvement with Tornado Cash. An official statement said the developer is suspected of  “concealing criminal financial flows and facilitating money laundering" through the popular virtual currency mixer. Additionally, GitHub suspended not only the Tornado Cash account, but also the account of the co-founder Roman Semenov, leaving uncertainty about what constitutes an interaction with a sanctioned address.

Decrypt also reported that an anonymous person was sending ETH to celebrities from a Tornado Cash wallet—presumably as a way to demonstrate how difficult it will be for the U.S. government to enforce its ban on the mixing service. Crypto transactions cannot be refused, and those on the receiving end may theoretically be deemed liable for interacting with a sanctioned address.

What’s the legal significance?

The latest move from the U.S. Treasury marks an escalation in a series of enforcement actions against crypto mixers. In May officials targeted Blender.io, a centralized crypto mixer employed by the North Korea-based hacker Lazarus Group, to allegedly conceal $625 million stolen from the Ronin Network. Many crypto experts, however, view the sanction of Tornado Cash as different.

Blockchain attorney Gabriel Shapiro highlighted “the novelty here is that. . .OFAC has added a copy of bytecode to the list of ‘sanctioned persons.’” These sanctions set precedent because this SDN entry merely identifies a URL and a series of Ethereum addresses. Instead of targeting specific individuals or entities , the government has imposed a sweeping ban on the protocol itself.

This marks the first time OFAC has targeted an on-chain decentralized protocol. Crypto mixers raise the debate of privacy vs. national security, because they can be used both for legitimate privacy purposes but also by malicious parties to launder money and avoid U.S. Treasury regulation.

Coin Center Executive Director Jerry Brito and Research Director Peter Van Valkenburgh describe OFAC’s action as a ban on a technology rather than a sanction against a person or entity. Specifically, Coin Center argued OFAC had overstepped its authority by designating an “entity” that is actually a smart contract.

OFAC historically sanctions natural persons or entities with legal personhood–either way sanctioned parties typically enjoy  the right to sue and be sued, own property, enter into contracts, and challenge the sanctions. Because Tornado Cash is an open-source protocol without legal personhood, it can do none of these things including challenge its  SDN designation .

What’s Next?

Coin Center is examining options for challenging OFAC’s actions. Brito and Van Valkenburgh said they are "still looking at the legal and constitutional ramifications. As a first pass, it's worth noting that under Buckley v. Valeo and Citizens United v. FEC, limitations on spending money raise First Amendment concerns because spending is necessary to support and communicate political speech."

From a legal standpoint the critical question is whether Tornado Cash will be classified as money, open source code, or something else. As Coin Center has pointed out, courts have concluded both money and computer code can be forms of speech protected by the First Amendment.

OFAC’s action against Tornado Cash represents the regulator’s first attempt to apply the U.S. sanctions regime to DeFi protocol. When and how these landmark sanctions will be challenged in court remains unknown, but the action clearly prompts numerous legal and regulatory questions for domestic and foreign jurisprudence. 

Stay tuned.

---

This newsletter is written, curated, annotated, and edited by Christopher Foreman (@CryptlessInSEA), Kyler Wandler (@KylerW56), Nicole Prada (@octopape); Nick Corso (@nick_corso2); Evan Santos (@evansantos4); and Kleb (@kleb_33); with consultation and input from Jacob Robinson of the Law of Code Podcast; editing courtesy of TΞxas ₿l◎ckchain LawyΞr ; in collaboration with Ann Sofie Cloots; and support from the Blockchain Barristers Law Student Collective.

The articles and opinions in this newsletter are not legal or financial advice. For legal and financial guidance, please consult a qualified attorney or financial advisor.

---

Special thanks: TornadoGIF