Tornado Cash’s legal victory paves the way for the development of decentralized networks

On November 26, 2024, the U.S. Court of Appeals for the Fifth Circuit ruled that the U.S. Treasury Department's OFAC sanctions on Tornado Cash were illegal and exceeded its own statutory authority. As Coinbase General Counsel Paul said: "This is a historic victory for the crypto industry and all those who care about defending freedom."

No one wants criminals to use encryption protocols, but the laws enacted by Congress do not authorize regulators to completely block the entire technology-neutral open source code because some users do evil. Regulatory enforcement that exceeds authority needs to be limited.

The second-instance court made it clear that although OFAC does have legitimate reasons to prohibit illegal behavior, Tornado Cash, as an immutable smart contract (lines of software code that supports privacy), is not the "property" of foreign nationals or entities, which means that (1) they cannot be blocked under the law and (2) OFAC exceeds the statutory authority granted by Congress.

This ruling is of epoch-making significance to the crypto industry. It not only clarifies the definition of immutable smart contracts, but also provides guidance and direction for the crypto industry facing a complex global regulatory environment.

Therefore, from the perspective of a Web3 legal practitioner, this article analyzes the significance of the Tornado Cash case to see the source of OFAC's regulatory enforcement power, the definition of immutable smart contracts, and the future development trend of decentralized networks.

1. What is Tornado Cash

Tornado Cash is a well-known coin mixing application on Ethereum, designed to provide users with privacy protection for transactions. It achieves privacy and anonymous transactions by obfuscating the source, destination, and counterparty of digital currency transactions.

Tornado Cash accepts transactions of different types of tokens (user deposits). Smart contracts use zero-knowledge proof technology to mix various transactions together, thereby cutting off the public link between the deposit address and the withdrawal address, and then transmitting them to the counterparty (user withdrawals) to achieve transaction privacy. Users no longer have to worry about their transactions being monitored on the chain.

Tornado Cash mixed currency smart contracts provide two valuable functions: privacy (anonymous digital transactions) and immutability (because software code cannot be owned, controlled, or changed - even its creator cannot change it).

Although the on-chain wallet is anonymous, the transactions between wallets are traceable and permanently recorded on the blockchain. Someone with a heart can use some technical means to match the transaction records of the wallet with individuals in the real world, which is very scary. Tornado Cash can solve this pain point, interrupting the transaction track between wallets, thereby protecting the privacy of the users behind the wallets.

(Tornado Cash Case)

2. Background of Tornado Cash Sanctions

Tornado Cash, an innovative application of neutral technology, can help legitimate users provide privacy protection for transactions, but it cannot prevent malicious users from using it illegally, such as being used for money laundering crimes in reality.

On August 8, 2022, Tornado Cash was sanctioned by OFAC, the U.S. Treasury Department's Office of Foreign Assets Control. The Tornado Cash protocol, 37 Tornado Cash smart contracts (including at least 20 immutable smart contracts), and an address for receiving donations were designated as "entities" and included in the sanctions list on the grounds that North Korean hacker groups used Tornado Cash to commit cybercrimes such as money laundering.

Three months later, OFAC issued new guidelines, which included sanctions on 53 Ethereum addresses related to the Tornado Cash protocol. These guidelines identified Tornado Cash as an entity operated by its DAO organization, and thereby blocked "all real, personal and other property and property interests" of Tornado Cash entities under U.S. jurisdiction.

By adding Tornado Cash to the Specially Designated Nationals and Blocked Persons (SDN) list, OFAC has completely banned any transactions with Tornado Cash-related "property". OFAC defines it as including open source computer code called "smart contracts".

That is to say, any interaction between any entity or individual and the on-chain addresses in the SDN list is illegal. In the press release at the time, OFAC stated that since 2019, the amount of funds used for money laundering crimes using Tornado Cash has exceeded US$7 billion. Tornado Cash provides substantial (materially) assistance, sponsorship or financial and technical support for illegal cyber activities in and outside the United States. These actions may pose a major threat to the national security, foreign policy, economic health, and financial stability of the United States, and are therefore sanctioned by OFAC.

III. The first-instance ruling that OFAC’s authority is legal

Six Tornado Cash users funded by Coinbase sued OFAC in the first instance. Their main theory, the only one that was supported on appeal, was that OFAC violated the U.S. Administrative Procedure Act, namely that OFAC had no authority to put Tornado Cash on the sanctions list because (1) Tornado Cash is not a foreign "national" or "individual"; (2) immutable smart contracts are not "property"; and (3) Tornado Cash cannot have property "interests" in immutable smart contracts.

The first instance court rejected the motion of Tornado Cash users, concluding that: (1) Tornado Cash is an "entity" that can be designated as an individual under the law, (2) smart contracts constitute "property", and (3) the DAO that operates Tornado Cash has an "interest" in its smart contracts because it earns profits from the services running on the smart contracts.

This ruling has caused great controversy in the industry, especially the characterization of "smart contracts" as a product in a technology-neutral context, and has caused the industry to think about Web3 privacy and financial regulation. Once software code such as smart contracts is defined as "property", it means that it may infringe on the citizens' right to freedom of speech and personal privacy under the First Amendment of the U.S. Constitution.

Fortunately, the recent second instance ruling has given us a clear answer and a bright future for the development of decentralized networks.

(From the Tornado Cash incident, let’s look at the regulatory logic of the US OFAC on Crypto)

Fourth, the second-instance judgment clearly stated that the definition of smart contracts cannot be changed

On November 26, 2024, the second-instance court overturned the judgment of the first-instance court in the appeal case-OFAC’s sanctions were illegal and exceeded its statutory authority.

The focus of the case is whether an open-source, encrypted, digital asset transaction software protocol like Tornado Cash is "property" and "interest" under OFAC supervision.

If the answer is no, then OFAC has no authority to impose sanctions on Tornado Cash.

OFAC's regulatory enforcement power comes from: the International Emergency Economic Powers Act and the North Korea Sanctions and Policy Enhancement Act give the president the power to regulate (or block) "property" in which foreign "nationals" or "individuals" (or "entities") have "interests".

The International Emergency Economic Powers Act is an integral part of the United States' modern sanctions regime. The Act authorizes the president to freeze the assets of any foreign actor identified as a threat to U.S. national security and prohibit transactions with them. This broad authority is implemented by the Treasury Department's OFAC, which is responsible for overseeing various economic sanctions programs.

Through these authorities, OFAC promulgates regulations, including definitions of terms such as “person,” “entity,” “property,” and “interest.” It also provides avenues for persons affected by blocking designations to challenge them and sometimes grants permission to engage in transactions involving blocked property.

4.1 Immutable Smart Contracts

In their rulings, the judges distinguished between smart contracts to avoid the misunderstanding that all smart contracts were confused and uniformly identified as “property” in the first instance judgment.

Smart contracts can be divided into two types: (1) immutable smart contracts, which are usually controlled by one or more entities; and (2) immutable smart contracts, which cannot be controlled by anyone. Once a smart contract becomes immutable, no one can reclaim control over it.

Corresponding to Tornado Cash, it is a decentralized, open source software protocol first launched by a group of developers in 2019. Although some smart contracts were changeable at the time, in 2020, developers launched a "trusted setup ceremony" to cancel the control of smart contracts. More than 1,100 users participated in it, and at least 20 smart contracts were irreversibly transformed into immutable smart contracts.

As a result, Tornado Cash becomes an automatically executed computer code that can no longer be changed, deleted or controlled. The software protocol is deployed on the blockchain and operates independently without any human intervention. The entire smart contract and Tornado Cash network are governed by the DAO organization.

4.2 OFAC's Basis for Sanctions

Although Tornado Cash is neutral and most users have good intentions, such as anonymous donations to the Ukrainian war to avoid hacker attacks. However, it is difficult for the protocol to restrict malicious users from laundering illegal proceeds through Tornado Cash.

This is why OFAC intervened. According to the International Emergency Economic Powers Act, it allows the President to exercise special economic powers after "declaring a national emergency in response to" any "unusual and extraordinary threats" that originate in whole or in large part from outside the United States and pose a threat to the national security, foreign policy or economy of the United States. This includes freezing any property in which any foreign country or a national thereof has any interest.

4.3 Tornado Cash is not property

Although the law gives the president the power to regulate and enforce the "rights and interests" of foreign "nationals" or "individuals" (or "entities") who have "interests", the second instance court does not recognize that immutable smart contracts can be classified as "property" and "rights and interests".

"Property" should be an asset that can be owned, with clear ownership and corresponding rights of disposal, exclusivity, etc.

Property has a plain meaning: It is capable of being owned. Property includes everything which is or may be the subject of ownership, whether a legal ownership, or whether beneficial, or a private ownership.

It is“the condition of being owned by or belonging to some person or persons”and encompasses“the right to possess, use, and dispose of something.”It also includes the right“to exclude everyone else from interfering with it.”

In this case, Tornado Cash, an immutable smart contract, obviously cannot be owned by anyone, nor can it exclude anyone from using it. We can see that even if Tornado Cash is sanctioned by OFAC, users can still call its underlying smart contract to use it.

“Those immutable smart contracts remain accessible to anyone with an internet connection.”

4.4 Tornado Cash is not a contract or service

OFAC claims that immutable smart contracts can constitute “rights” related to “property”, such as rights in contracts and rights in services. However, the second-instance court made it clear that although smart contracts are called smart contracts, they are not real contracts (the smart contract is not itself a contract).

A contract is a consensus reached between two or more parties and is revocable. Obviously, smart contracts are just software codes, and they cannot make offers or make revocations, etc., which require the contract parties to exercise contractual rights. Similarly, we cannot allow immutable smart contracts to change code, delete code, or remove them from the Ethereum blockchain network. Smart contracts are merely interactions between users and software codes.

Similarly, a service is "the performance of some useful action or series of actions for the benefit of another, usually for a fee." Here, a smart contract is just a piece of computer code that cannot be executed for the benefit of others or to obtain benefits.

Tornado Cash smart contracts are merely tools used in providing a service, and do not control these smart contracts (The immutable smart contracts are not property because they are not ownable, not contracts, and not services).

4.5 The judgment of the second instance court

Therefore, the second instance court overturned the judgment of the first instance court and determined that OFAC's regulatory enforcement exceeded its statutory authority.

The court finally stated: We can see the disadvantages of some unregulated and uncontrollable technologies in the real world. The president and the government are rightly concerned about malicious cyber activity, so IEEPA became law in 1977, several years before the invention of the modern Internet.

However, the law only grants the president's government broad powers to regulate various economic transactions, and its authority is not unlimited or expanded.

V. The victory of decentralized networks

Although this is only a ruling of the second-instance court, OFAC has the right to advance the case to the Supreme Court, but we have seen in the second-instance judgment that the strong argument for immutable smart contracts is difficult to overturn.

As Coinabse said, On Chain is the New Online. As more and more decentralized protocols and networks radiate to thousands of households, the previous purely permissionless approach on the chain also needs to be further improved and made legal and compliant. How to balance technological innovation and regulatory enforcement from a technology-neutral perspective is an important proposition that every legislator and regulator needs to explore.

In any case, just as Grayscale's victory against the SEC paved the way for the passage of the BTC ETF, the Tornado Cash case also paved the way for the further development of decentralized networks.

As Putin the Great said: Bitcoin and other electronic payment methods, as new technologies, cannot be completely banned, and they will continue to develop because they have advantages in reducing costs and improving transaction reliability.