In August of 2022, the U.S. Treasury Department sanctioned cryptocurrency mixer Tornado Cash, accusing it of helping to launder billions of dollars for North Korean hackers, among other malicious cyber actors. In a decision handed down on November 26, 2024, the 5th U.S. Circuit Court of Appeals ruled that these sanctions were unlawful, siding with six users of Tornado Cash, who were also backed by the cryptocurrency exchange Coinbase.
This decision may set a precedent for how privacy-focused tools are regulated in the rapidly evolving world of digital assets. The article will discuss the court’s ruling, its impact on cryptocurrency users, and what it means for the future.
Technical Background
Tornado Cash is a decentralized virtual currency “mixer,” also referred to as a cryptocurrency mixer, coin mixer, or DeFi. These mixers are designed to increase the privacy and anonymity of cryptocurrency transactions.
It works by mixing a user’s cryptocurrency (such as Bitcoin, Ethereum, or other digital assets) with funds from other users, making it difficult to trace the origin and destination of the coins. These mixers are commonly used to obscure the transactional history of digital currencies, which can otherwise be tracked on the blockchain.
Smart Contracts
In a decentralized mixer, users send their coins to a pool or system where they are mixed with coins from other users. After mixing, each user receives an equivalent amount of cryptocurrency, but the coins are now indistinguishable from those of other participants, making it difficult to trace the origin and destination of any specific coin.
Smart contracts enable the functioning of decentralized mixers by automating and enforcing the mixing process directly on the blockchain without relying on a central authority.
Tornado Cash uses smart contracts and allows users to mix Ethereum (ETH) and ERC-20 tokens (like USDC or DAI) using zk-SNARKs. Here’s how it works with smart contracts:
- Deposit — A user deposits ETH into the Tornado Cash smart contract.
- Mixing — The contract generates proof using zk-SNARKs, allowing users to prove they have deposited without revealing the original deposit or the recipient’s address.
- Withdrawal — After mixing, the user can withdraw their funds to a new address, making it difficult to trace the original deposit because the transaction history is obscured by the mixing process.
Legal Framework
The US Department of the Treasury’s Office of Foreign Assets Control (OFAC) is a government agency responsible for enforcing economic and trade sanctions against targeted foreign countries and individuals, as well as overseeing measures aimed at preventing the financing of terrorism, money laundering, and other illicit activities. OFAC operates under the authority of the U.S. Department of the Treasury and plays a crucial role in U.S. foreign policy by using sanctions as a tool to achieve national security and foreign policy objectives.
In August 2022, OFAC added Tornado Cash to their Specially Designated Nationals (SDN) List. The list includes individuals, entities, and countries subject to sanctions. U.S. citizens and businesses are prohibited from engaging in transactions with those on the SDN List.
OFAC used the 1977 International Emergency Economic Powers Act (IEEPA) as the basis for placing Tornado Cash on the SDN List. The law gives OFAC authority to sanction “any property in which any foreign country or national thereof has any interest” that threatens the national security of the United States.
Being placed on the SDN list created legal uncertainty and potential liability for even innocent users who sent cryptocurrency to addresses associated with Tornado Cash’s smart contracts. The decision made it effectively illegal for anyone in the United States to interact with the Tornado Cash mixer.
The six Tornado Cash users, backed by Coinbase, then sued the Department of the Treasury. They argued that OFAC did not have the authority to sanction them because the smart contracts used by Tornado Cash are not “property” as designated by the IEEPA.
The Case
The six plaintiffs in the case argued that OFAC acted outside of their authority when they placed Tornado Cash on the SDN List. Their argument hinged on the definition of “property,” maintaining that the smart contracts used by Tornado Cash did not constitute property as defined by the IEEPA.
The Decision
The court presided over by Judge Don Willett, determined that OFAC had overstepped its authority in sanctioning Tornado Cash because smart contracts, by their nature, do not constitute “property” in the way that tangible assets or even certain types of digital assets (like Bitcoin or Ethereum) are considered property under U.S. law.
The court explained that Tornado Cash, being a decentralized and automated software protocol, did not involve the holding of assets or property in a traditional sense. Instead, it simply facilitated the movement of cryptocurrencies in a way that allowed users to obscure the origin of their funds.
The smart contracts did not directly own or control any cryptocurrency themselves. They merely executed instructions that users provided.
The court emphasized that the smart contracts themselves were not “owned” by anyone in the conventional sense. They were deployed on the Ethereum blockchain but did not belong to a single entity. While developers and users interacted with the code, this interaction did not constitute ownership of the code itself or any underlying property.
Conclusions
The future of decentralized currency mixers will likely involve innovation, legal challenges, and evolving regulatory frameworks as privacy advocates and regulators navigate this complex landscape. The court ruling could lead to broader acceptance and development of privacy-focused decentralized applications (dApps) and protocols.
It may embolden the broader DeFi community to continue building privacy solutions that allow users to transact anonymously and securely. As privacy becomes a more significant concern for individuals, the demand for such services will likely grow.
The ruling also highlights the need for more transparent legal frameworks and shows the limits of the IEEPA’s authority. If a decentralized protocol, such as Tornado Cash, is not considered property because it cannot be owned or controlled by any one entity, it may limit the scope of property that can be sanctioned under IEEPA. The decision may lead to more precise legal definitions and potentially new legislative or regulatory actions as both privacy and security concerns continue evolving in decentralized finance.
Need Help Navigating Digital Assets? Turn to Veritas Global
If you’re navigating the complex world of digital assets, Veritas Global is here to help. Our team of experts provides tailored solutions for everything from licensing and structuring transactions to advising on legal compliance and security. Whether you’re new to the space or looking to optimize your digital strategy, we offer the guidance and support you need to make informed decisions.
Contact us, and let us help you unlock the full potential of your digital assets.
