Tornado Cash

Tornado Cash is a decentralized, open-source software project whose contributors deployed a series of smart contracts to the Ethereum blockchain in 2019; its developers included Roman Storm and the Russian nationals Alexey Pertsev and Roman Semenov. The project aimed to interrupt the public trail of transactions recorded on a blockchain: coins from many parties are deposited, pooled, mixed, and sent to brand-new wallets, after which it is no longer clear whose coins are whose.⁠[1][1][2][2]

If users still had to pay withdrawal gas fees from their own addresses, transactions would remain traceable; the developers therefore added “relayers,” mutable contracts operated by third parties that pay the gas fees from their own accounts and deduct those fees and a relayer fee from the amount withdrawn, without ever taking custody of users’ assets, thereby eliminating the link between deposit and withdrawal accounts.⁠[1][1][1][1]

In May 2020, the founders changed the code so that nobody, themselves included, could modify or disable the underlying software, allowing Tornado Cash to operate independently of them; they still controlled the website and interface through which most traffic passed. Once a contract is made immutable, the step cannot be reversed and no one can regain control over it.⁠[2][2][1]

After the pool contracts became immutable, the original developers announced the creation of a decentralized autonomous organization (DAO) and a transferable, sellable crypto token called TORN. TORN holders can vote on a limited set of DAO governance issues, but only after locking their tokens into another mutable “governance” contract; the DAO can only vote to implement new projects and change certain optional features. Prosecutors allege that the founders used TORN to create a means of profiting, with the token’s value roughly correlated to activity on Tornado Cash.⁠[1][1][1][1][2]

In January 2022, co-founder Roman Semenov told CoinDeskCoinDeskCoinDesk is a cryptocurrency media, events, index, and data company founded in 2013 and headquartered in New York. Its businesses include the CoinDesk news website, the annual crypto industry conference Consensus, and the CoinDesk Indices index business. In November 2023, the digital asset exchange Bullish acquired CoinDesk from Digital Currency Group, and CoinDesk has since operated as an independent subsidiary of Bullish.Open the full entry that the protocol was deliberately designed to be unstoppable, because it would make no sense for a third party such as the developers to control it, just as no one should control Bitcoin or Ethereum; law enforcement rarely contacted them directly, he said, because the developers could not assist with investigations or change the protocol. He argued that because crypto portfolios are fully visible to the public, large holders are vulnerable to kidnapping, torture, and blackmail, making privacy protocols important for personal safety.⁠[3][3][3][3]

On August 8, 2022, the US Treasury’s Office of Foreign Assets Control added Tornado Cash to its sanctions list under Executive Order 13694, saying the mixer, which operates on Ethereum and indiscriminately facilitates anonymous transactions, had been used to launder more than $7 billion worth of virtual currency since its creation in 2019, including more than $455 million stolen by the North Korean state-sponsored hacking group Lazarus Group, and more than $96 million and at least $7.8 million from the June 24, 2022, Harmony Bridge and August 2, 2022, Nomad heists. Under Secretary for Terrorism and Financial Intelligence Brian E. Nelson said that despite public assurances, Tornado Cash had repeatedly failed to impose effective controls to stop it from regularly laundering funds for malicious cyber actors.⁠[4][4][4][4][4][4]

The same day, GitHub removed the Tornado Cash account and disabled the personal accounts of at least three contributors, Roman Semenov, Roman Storm, and Alexey Pertsev, even though none of the three was named as a sanctioned party. Kurt Opsahl of the Electronic Frontier Foundation (EFF) and others argued that publishing code on its own is protected speech, even if the code can be used unlawfully.⁠[5][5][5][5][6]

In August 2022, the Dutch Fiscal Information and Investigation Service (FIOD) announced the arrest in Amsterdam of a 29-year-old man suspected of being a Tornado Cash developer and of being involved in “concealing criminal financial flows and facilitating money laundering,” adding that further arrests were not ruled out; the man arrested was Alexey Pertsev. The move drew criticism from some crypto and privacy advocates.⁠[7][7][2][7]

On November 8, 2022, OFAC delisted Tornado Cash and simultaneously redesignated it under Executive Orders 13722 and 13694, adding a basis for the designation concerning its support for North Korean activities: Tornado Cash had obfuscated the movement of more than $455 million stolen in March 2022 by the North Korea-controlled Lazarus Group. OFAC also issued a new FAQ explaining the nature of the Tornado Cash entity.⁠[8][8][8][8][8]

In April 2023, the Electronic Frontier Foundation said that government actions targeting the publication of code based on its topic necessarily target speech and trigger First Amendment scrutiny; as an example, it said GitHub’s removal of the code had hindered its client Matthew Green, a cryptography professor at Johns Hopkins University, in research and teaching.⁠[9][9][5]

On August 23, 2023, the US Department of Justice unsealed an indictment against Tornado Cash co-founders Roman Storm and Roman Semenov. Storm was arrested in Washington state, where he lives; Semenov, a Russian national, remained at large, and OFAC sanctioned him the same day for providing support to the North Korean government. Each was charged with one count of conspiracy to commit money laundering and one count of conspiracy to violate the International Emergency Economic Powers Act, each carrying a maximum sentence of 20 years, as well as conspiracy to operate an unlicensed money transmitting business, carrying a maximum of five years. Prosecutors accused the three founders of helping North Korean hackers obscure more than $450 million stolen in the 2022 attack on Axie Infinity’s Ronin bridge.⁠[10][10][10][10][10][10][10]

Deputy Secretary of the Treasury Wally Adeyemo said that even after the founders knew the Lazarus Group was laundering hundreds of millions of dollars of stolen virtual currency through the service, they continued to develop and promote it and took no meaningful steps to reduce its use for illicit purposes.⁠[10][10]

On May 14, 2024, a Dutch court found Alexey Pertsev guilty of money laundering and sentenced him to five years and four months in prison. Prosecutors said Tornado Cash laundered $1.2 billion in crypto assets stolen in at least 36 hacks, including more than $600 million taken from the game Axie Infinity in March 2022 and about $275 million taken from the exchange KuCoin by the Lazarus Group. The court found that it was Tornado Cash that carried out the concealing and disguising activities, that processing criminal proceeds through it constituted money laundering, and that it was “not just an instrument for users”; messages between the co-founders showed they knew the platform was being used for laundering but took no action to curb the abuse. Pertsev appealed the verdict.⁠[11][11][11][11][11][11][2]

Six Tornado Cash users, including Joseph Van Loon, sued the Treasury, arguing that adding Tornado Cash to the sanctions list exceeded OFAC’s statutory authority; the US District Court for the Western District of Texas granted summary judgment to the Treasury. On November 26, 2024, the US Court of Appeals for the Fifth Circuit (Judges Jones, Willett, and Engelhardt, with Willett writing) ruled that Tornado Cash’s immutable smart contracts are not the “property” of a foreign national or entity, cannot be blocked under the International Emergency Economic Powers Act, and that OFAC had overstepped its congressionally defined authority; it reversed and remanded with instructions to grant the plaintiffs’ motion for partial summary judgment under the Administrative Procedure Act.⁠[1][1][1][1][1][1][1]

The ruling acknowledged that OFAC’s concerns about illicit foreign actors laundering funds are “undeniably legitimate” and said Congress might update the International Emergency Economic Powers Act, enacted during the Carter administration, to cover modern technologies such as crypto-mixing software.⁠[1]