Tornado Cash: A Privacy Champion or a Money Laundering Tool? Tornado Cash, a decentralized currency mixing protocol running on the Ethereum blockchain, was once widely used for its strong privacy features, which also made it a thorn in the side of regulators. In August 2022, the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) issued a sanctions order designating Tornado Cash on its SDN List, accusing it of being used for money laundering, specifically by the North Korean hacker group Lazarus Group, to process over $1 billion in illicit funds. This move marked the first time the United States had imposed sanctions on an on-chain project, and it shook the entire crypto industry. However, on March 21, 2025, things took a turn for the better. The U.S. Treasury Department abruptly withdrew its sanctions order, removing the blacklist designation for Tornado Cash and all associated addresses. This decision wasn't entirely unexpected. As early as November 2024, the U.S. Court of Appeals for the Fifth Circuit threw cold water on the Treasury Department's decision, finding that Tornado Cash's core smart contract did not meet the definition of "property" and that the sanctions were unauthorized. However, the lifting of sanctions doesn't mean the developers are off the hook. Alexey Pertsev was sentenced to five years and four months in prison for money laundering by a Dutch court in May 2024, while Roman Storm, far away in the United States, remains mired in legal turmoil. This lawsuit has sparked a debate: should open-source code authors be held liable for the misuse of their tools? The Solana Policy Institute provided $500,000 in funding for Storm and Pertsev's legal defense, emphasizing that "writing code is not a crime." Ethereum founder Vitalik Buterin and others have also raised funds for their defense, demonstrating the crypto community's high level of interest in this case. Roman Storm: Charged with Money Laundering, Jury Failed to Reach a Unanimous Verdict In August 2023, Roman Storm was indicted by US prosecutors on eight counts, including money laundering, sanctions violations, and operating an unregistered money transmission business. Storm's trial began on July 14, 2025, in Manhattan, New York. Although the jury failed to reach a unanimous verdict on the money laundering and sanctions violations charges, resulting in those charges being dismissed or pending, Storm was still convicted of conspiracy to operate an unregistered money transmission business and faces a maximum sentence of five years. This verdict sparked widespread debate. Some argued that, as a technology developer, Storm should enjoy the right to free speech and should not be held responsible for the misuse of the decentralized tools he created. On the other hand, some argue that while Storm couldn't control every detail of the protocol's usage, if he knew the tool was widely used for illegal activities and didn't enforce it, he should be held accountable for its misuse. The slogan "Technology is Innocent: The Boundary between Law and Ethics" is popular in the open source community and among decentralization believers. The underlying logic is simple: the tool itself is neutral; the guilt lies with those who use it. Many countries, particularly the United States, generally consider technology developers to be creators entitled to free speech, meaning the code they write shouldn't automatically be held liable for misuse. For example, under Section 230 of the Communications Decency Act, internet service providers are generally not liable for the actions of users on their platforms. While this provision primarily applies to internet platforms, it provides similar protections to developers of decentralized protocols, assuming they don't directly engage in illegal activity. However, not all countries fully embrace this concept. For example, in the Netherlands, Tornado Cash developer Alexey Pertsev was sentenced for allegedly facilitating money laundering. Dutch courts have held that open source software developers may bear some responsibility for the misuse of their tools. This reflects the varying approaches and understandings of technical liability across different legal systems. Determination of Money Laundering Crimes: In the United States, money laundering crimes are typically prosecuted under the Money Laundering Control Act. Under the Act, money laundering involves the illegal transfer of funds through banks or other financial institutions with the intent to conceal, disguise, or legitimize illicit proceeds. The elements of money laundering primarily include the illicit origin of the funds and the various transactions conducted to conceal the source of the funds. The "Knowledge" Standard: Most jurisdictions require "knowledge" of the proceeds of crime as a subjective requirement for money laundering offenses, meaning the defendant must have known that the activities they engaged in involved the transfer of illegal funds. If the defendant is completely unaware of the illegal source of the funds, they generally cannot be found guilty of money laundering, and the United States is no exception. However, in certain circumstances, even without clear evidence of "knowledge" that the funds were derived from illegal sources, a defendant can still be held liable for money laundering if they can prove reasonable suspicion or willful disregard of the illegal source. For example, Section 1956 of the Money Laundering Control Act explicitly states that anyone who "knows or has reasonable cause to know" that a financial transaction involves illegal funds may be presumed to have engaged in money laundering. This means that even without direct evidence of "knowledge" that the funds were derived from illegal sources, a court can still convict them of money laundering as long as there is clear suspicion or negligence. The question of Tornado Cash developers' "knowledge" is crucial in determining whether the developers can be held liable for money laundering. According to the US prosecutors' charges, Tornado Cash's developers are accused of intentionally creating a tool that allowed anonymous transfers, facilitating money laundering. However, the defense argues that as developers of a decentralized protocol, they lacked control or knowledge of the specific ways the protocol could be abused. To determine whether the developers met the "knowledge" requirement, the court may consider the following factors: 1. The purpose of the technical tool: As an open-source, decentralized protocol, Tornado Cash was theoretically designed to enhance user privacy, not specifically for money laundering. However, whether the court can determine that the developers should have foreseen the potential for illegal activities when designing the tool remains a controversial issue. 2. Public Information and Warnings: If the developer or community is aware that the tool is frequently used for illegal transactions but fails to take any measures to prevent or warn against it, the court may find that the developer possessed subjective intent, either through knowledge or willful disregard. 3. Developer Conduct and Responsibility: US prosecutors may argue that if Tornado Cash developers were fully aware of the potential misuse of their tool or failed to implement necessary controls or monitoring to ensure its anonymity, they could be found to have known that the tool was being used for money laundering. These factors raise the question of developer responsibility in the design of decentralized financial instruments from different perspectives. While the technology itself is not intended to be criminal, determining the liability of developers for its misuse is clearly a complex and multifaceted issue. As the case progresses, how the law balances innovation and compliance may influence the future direction of blockchain technology. Conclusion: Who bears the cost of innovation? The Tornado Cash case has transcended the fate of individual developers; it is defining the boundaries of the entire decentralized finance industry. If even the authors of open source code can be imprisoned for the illegal activities of users, who will dare to innovate? Conversely, if anonymous tools are allowed to flourish unchecked, won't criminal activity become even more rampant? This case is likely to serve as a bellwether for the future—its ultimate outcome will not only determine Storm's fate but also set a standard for the code of conduct for the entire crypto community. On the balance between privacy and compliance, how can technology, law, and society find a compromise? Perhaps the answer, like blockchain itself, still awaits consensus.
Kikyo
Weatherly
Catherine
Anais