# Tornado Cash An Ethereum privacy mixer, published in 2019 by [[Roman Storm]], [[Roman Semenov]], and [[Alexey Pertsev]]. Roughly a thousand lines of Solidity that let a user deposit a fixed amount of ETH and withdraw it later to an unlinked address, using zero-knowledge proofs so the withdrawal proves membership in the deposit set without revealing which deposit it was. It is filed here as a **work** rather than a company or a concept because that is the question the entire legal fight turned on, and the answer came from a federal appeals court. In [[Van Loon v. Department of the Treasury]] the Fifth Circuit held that the core contracts "are not property because they are not capable of being owned." There is no entity to sanction, no owner to subpoena, no server to seize. There is only published code and the people who published it — which is why the government, having lost the argument against the software, is still prosecuting the authors. > [!abstract] The through-line > Tornado Cash is the case where the state discovered that its enforcement tools assume an owner, and that the ownerless artifact defeats them. It responded not by finding a better tool but by **relocating liability from the thing to the person who wrote it.** Everything else on this page is detail underneath that move. ## Architecture, and the split that everything hinges on The **trusted setup ceremony** concluded around 10 May 2020. The team's contemporaneous statement: their intent was to "update all Verifiers in all instances and set the operator address to zero," at which point "Tornado.cash smart contracts will become completely immutable and unstoppable." The ceremony was audited by NCC Group, which had audited Zcash's. Most coverage stops there and calls the whole system immutable. It is not, and the distinction is load-bearing: | Layer | Mutable? | Who controls it | |---|---|---| | Core mixer pools | **No** — no admin, no pause, no upgrade path | nobody | | Default router, pool registry | Yes | TORN governance | | The standard UI (an IPFS hash on ENS) | Yes | TORN governance | | Relayer registry, TORN token | Yes | TORN governance | | Individual relayers | n/a | independent operators | Governance requires 1,000 TORN to submit a proposal, a 100,000 TORN quorum, and a two-day timelock. So there is an ownerless core wrapped in an owned periphery — and prosecutors and the Fifth Circuit each worked a different side of that seam. The Fifth Circuit looked at the pools and found nothing ownable. DOJ looked at the periphery, the fee revenue, and the front-end and found defendants. The seam is not theoretical. In **May 2023** an attacker seized voting control through a malicious proposal and laundered roughly $900,000 through the service. In **June 2026** researchers flagged a second attempt: a proposal dressed as a "dynamic deflationary economic model" that would have swapped the governance address holding **$23 million in TORN** for an attacker-controlled address sharing the same first fifteen characters. Both times the pools themselves were untouchable. Governance was not. > [!warning] Unresolved > No reporting was found on whether the June 2026 proposal passed or failed. This is the biggest open item in the protocol's 2026 record. ## The laundering record — claimed versus measured This is where the public record is most systematically distorted, and the distortion is documentable rather than contested. Treasury's designation press release said Tornado Cash "has been used to launder more than $7 billion worth of virtual currency since its creation in 2019." The blockchain analytics firms that Treasury itself relies on reached a different number, because they were measuring a different thing: | Source | Total throughput | Illicit portion | |---|---|---| | U.S. Treasury, Aug 2022 | — | **"more than $7 billion"** laundered | | Elliptic, Aug 2022 | just over $7 billion | **at least $1.54 billion** (~22%) | | Chainalysis, Aug 2022 | over $7.6 billion in ETH | 18% from sanctioned entities, just under 11% stolen funds | | St. Louis Fed study (via Cambridge JBS) | — | ~30% illicit pre-sanctions | | DOJ criminal indictment, 2023 | — | **"more than $1 billion"** in criminal proceeds | **Treasury's $7 billion is total volume, not laundered volume.** Elliptic and Chainalysis independently arrive at the same throughput figure and put the illicit share at roughly a fifth to a third of it. DOJ, charging a case it had to prove, used $1 billion. The $7 billion number is the one that entered general circulation. Specific thefts attributed by Treasury: | Incident | Date | Laundered through Tornado Cash | Note | |---|---|---|---| | Ronin Bridge / Axie Infinity | Mar 2022 | **over $455 million** | ~$620–625M total hack; called the largest known crypto heist at the time | | Harmony Horizon Bridge | Jun 2022 | **more than $96 million** | Elliptic: the entire ~$100M went through within hours | | Nomad Bridge | Aug 2022 | **at least $7.8 million** | a small fraction of the ~$190M loss | | HTX / HECO | from Mar 2024 | **over $100 million** | *after* designation, while still sanctioned | All the bridge hacks are attributed to [[Lazarus Group]]. ## The sanction, and its unwinding | Date | Event | |---|---| | 2022-08-08 | OFAC designates Tornado Cash under E.O. 13694 plus ~40 wallet addresses — **the first time a smart contract, rather than a person or organization, was placed on the SDN list** | | 2022-08-10 | [[Alexey Pertsev]] arrested in Amsterdam, two days later, before any charge | | 2022-08 | GitHub removes the repositories; later partially restored read-only | | 2022-09-08 | *Van Loon* filed in W.D. Tex., funded by [[Coinbase]] | | 2023-08-23 | [[Roman Storm]] and [[Roman Semenov]] indicted; Semenov separately designated | | 2024-05-14 | Pertsev convicted in the Netherlands, 64 months | | 2024-11-26 | **Fifth Circuit reverses in [[Van Loon v. Department of the Treasury]]** | | 2025-03-21 | OFAC delists Tornado Cash; Semenov's designation modified but retained | | 2025-06-28 | District court judgment vacating the designation and permanently enjoining re-enforcement becomes binding; no appeal | | 2025-07-03 | *Coin Center v. Yellen* vacated and dismissed as moot in the Eleventh Circuit | The delisting is unusually clean as a reversal: Treasury did not merely decline to defend, it accepted a permanent injunction against re-imposing the sanction. ## The prosecutions **[[Alexey Pertsev]]** — convicted of money laundering in the Netherlands on 14 May 2024, sentenced to five years four months, released to electronic monitoring on 7 February 2025, appeal pending with no reported hearing date. **[[Roman Storm]]** — tried in the Southern District of New York before Judge Katherine Polk Failla from 14 July 2025. On **6 August 2025** the jury convicted on one count — conspiracy to operate an unlicensed money transmitting business under 18 U.S.C. § 1960(b)(1)(C), five-year maximum — and hung on the money-laundering and IEEPA counts carrying forty years between them. He remains free on a $2 million bond and **has not been sentenced**. On 9 March 2026 prosecutors moved to retry the two hung counts in October 2026. His Rule 29 acquittal motion was argued 9 April 2026; Failla did not rule, remarking only, "This is a lot." **[[Roman Semenov]]** — still at large, still on the SDN list under the North Korea authority. Note the split: the Dutch court convicted on **money laundering**, the American jury deadlocked on it. Same conduct, same protocol, two legal systems, different answers. ## The statutory hinge, and the policy that arrived too late The surviving conviction rests entirely on which subsection of the money-transmitting statute applies. - **§ 1960(b)(1)(B)** — failure to register with [[FinCEN]]. DOJ **dropped this theory on 15 May 2025**. FinCEN's own 2019 guidance says "an anonymizing software provider is not a money transmitter," and reporting indicates FinCEN told DOJ a comparable non-custodial service likely failed its control test. - **§ 1960(b)(1)(C)** — transmitting funds *known to be derived from a criminal offense*. This is what convicted him. The [[Todd Blanche]] memo of 7 April 2025, "Ending Regulation By Prosecution," disbanded the National Cryptocurrency Enforcement Team and told prosecutors not to charge unlicensed money transmitting under (b)(1)(A) and (B), stating the Department "will no longer target virtual currency exchanges, mixing and tumbling services" for their users' conduct. **Footnote 2 carved (b)(1)(C) out of that policy.** That footnote is the whole case: it is why DOJ could abandon the registration theory in May and still win a conviction in August. Then, on **21 August 2025 — fifteen days after the verdict** — Acting Assistant Attorney General Matthew Galeotti told an industry summit in Jackson, Wyoming: > where the evidence shows that software is truly decentralized and solely automates peer-to-peer transactions, and where a third party does not have custody and control over user assets, new 1960(b)(1)(C) charges against the third-party will not be approved. He added that "developers of neutral tools, with no criminal intent, should not be held responsible for someone else's misuse of those tools." The operative word is **new**. The policy is prospective. Storm's conviction, obtained under a theory the Department disclaimed two weeks later, stands. ## Where the argument stands in 2026 - **25 March 2026** — the Supreme Court decides *Cox Communications v. Sony Music Entertainment*, holding that a service provider is contributorily liable only where it intended the service to be used for infringement, and that "mere knowledge that a service will be used to infringe is insufficient." Storm invoked it on 2 April as the neutral-tool principle; DOJ called it "inapposite" on 7 April, arguing a civil copyright standard does not migrate into criminal law. - **9 March 2026** — Treasury, in a GENIUS-Act-mandated report to Congress, concedes that mixers have lawful uses: "as consumers increase their use of digital assets for payments, individuals may want to use mixers to maintain more privacy." Four years after calling the same software a laundering machine. - **26 February 2026** — H.R. 7732, the Promoting Innovation in Blockchain Development Act, introduced by Fitzgerald, Cline, and Lofgren, would amend § 1960 to reach only services that "control customer assets and transmit funds on behalf of customers." Referred to House Judiciary; status past introduction unverified. - **14 May 2026** — the Senate Banking Committee advances the [[CLARITY Act]] substitute, which carries a separate DeFi title including protections for "noncontrolling software developers and providers." - **Volume** — TVL peaked near $1.5 billion on 7 November 2025, driven substantially by ~$393 million in ETH from wallets linked to PulseX, and stood around **$572 million** in August 2026, roughly 80% of the entire DeFi privacy category. The ~60% drawdown is unexplained in available reporting. ## The empirical finding worth keeping Cambridge Judge Business School published a post-sanctions study on 24 February 2026 with a result that cuts against the instrument's own logic: after designation, daily transactions on Tornado Classic fell **97%** and on Tornado Nova **91%** — yet attackers still used the protocol in **78% of Ethereum security incidents through mid-2025**. The sanction worked on everyone it was not aimed at. Ordinary users, who face real consequences for touching a sanctioned address, left. [[Lazarus Group]], which faces none, stayed — and demonstrated it by laundering $100 million through the still-sanctioned protocol in March 2024. This is the general shape of sanctions against infrastructure rather than actors, and it is worth carrying to other cases in the KB. ## The First Amendment argument that has not yet been ruled on The "code is speech" lineage — *Bernstein v. DOJ*, *Junger v. Daley* — was argued by the defense at the April 2026 Rule 29 hearing, that conviction "would effectively criminalize software distribution." **No court in either the Van Loon or Storm proceedings has ruled on First Amendment grounds.** Van Loon was decided on the statutory meaning of "property." The free-speech theory remains advocacy, not holding,. ## Open questions - **Answered 2026-10-06:** on August 26, 2026 Judge Failla moved the retrial to **April 26, 2027** (The Block; Decrypt). The Rule 29 motion was still undecided at that point. See [[Roman Storm]]. - The outcome of the June 2026 governance attack. - The cause of the 2025–2026 TVL collapse. - Pertsev's appeal calendar. - Semenov's whereabouts and status. ## Related - [[Software Hub]] — why this is filed as a work - [[Van Loon v. Department of the Treasury]] — the holding - [[Roman Storm]] · [[Alexey Pertsev]] · [[Roman Semenov]] — the authors - [[Lazarus Group]] — the reason for the designation - [[Money Laundering]] · [[Ethereum]] · [[Smart Contract]] · [[Self-Custody]] · [[Private Key]] - [[Cryptocurrency Ecosystem]] · [[Crypto-Political Machine]] · [[Cryptocurrency Regulation Timeline]] · [[Cryptocurrency Lexicon]] - [[Department of the Treasury]] · [[FinCEN]] · [[Todd Blanche]] · [[GENIUS Act]]