What is Tornado Cash?

Tornado Cash is a privacy mixing service on Ethereum that became the canonical case study in regulatory risk reaching beyond direct token holders. The OFAC sanctions on Tornado Cash in August 2022 were unprecedented — sanctioning code rather than a person or entity — and the subsequent enforcement actions raised foundational questions about what it means to interact with a sanctioned smart contract. The case is still being litigated in 2026 and the resolution will shape crypto regulatory policy for years.

The basic mechanics. Tornado Cash is a set of smart contracts on Ethereum that pool deposits from many users, then allow withdrawals to different addresses, breaking the on-chain link between the deposit and withdrawal addresses. The mechanism uses zero-knowledge proofs to allow users to prove they own a deposit without revealing which specific deposit they own. The result is that a user can deposit ETH from one address and withdraw it to a different address without on-chain analysis being able to link the two — effectively providing privacy for Ethereum transactions.

The legitimate use case is real. Privacy is a baseline financial property that traditional banking provides through closed institutional records. On-chain transactions are public by default. Users have legitimate reasons to want privacy: protecting personal financial information from public exposure, preventing competitors from analyzing business transactions, shielding charitable donations from public scrutiny, protecting safety in politically sensitive contexts. Tornado Cash provided a technical mechanism to restore the privacy baseline that on-chain transactions inherently lack.

The illegitimate use case was also real. North Korean state actors (Lazarus Group) used Tornado Cash extensively to launder stolen cryptocurrency from major exchange hacks. Various other malicious actors used the service to obscure illicit funds. The Tornado Cash team's response — that the protocol is neutral infrastructure that cannot prevent specific uses — is true at the technical level but did not resolve the policy question.

The August 2022 OFAC action. On August 8, 2022, the US Treasury's Office of Foreign Assets Control added Tornado Cash to the Specially Designated Nationals (SDN) list. This was unprecedented because OFAC had historically sanctioned people, entities, or specific cryptocurrency addresses controlled by sanctioned parties — not autonomous smart contracts that no one controls. The sanctions made it illegal for US persons to interact with the Tornado Cash smart contracts, regardless of purpose.

The cascading effects. Major cryptocurrency infrastructure providers immediately complied with the sanctions in ways that went beyond the literal text. Circle (USDC issuer) froze USDC held in Tornado Cash addresses, an action with no clear legal basis but consistent with regulatory caution. Major DeFi front-ends blocked addresses that had ever interacted with Tornado Cash, including innocent users who had used the service for legitimate privacy purposes years before the sanctions. GitHub took down the Tornado Cash repository. Several developers associated with the project were arrested in various jurisdictions, including Alexey Pertsev in the Netherlands (later convicted) and Roman Storm in the US (pending trial).

The legal questions still being litigated.

Can OFAC sanction a smart contract? A federal court ruling in 2024 partially rejected OFAC's authority to sanction code rather than a person or entity, but the broader principle remains contested.

Are developers liable for users' actions? Pertsev's conviction in the Netherlands established the principle in at least one jurisdiction that developers of privacy tools can be held liable for users' illicit use of those tools. The Storm prosecution in the US tests whether the same principle applies under US law.

Are users liable for interacting with sanctioned contracts? Several cases have addressed this question without clear resolution. The technical reality (smart contracts are autonomous, anyone can interact with them) collides with the legal framework (interacting with a sanctioned address is illegal).

The practical implications.

For users, the lesson is that interacting with privacy-focused crypto tools carries regulatory risk that can be retroactive. Users who legitimately used Tornado Cash years before the sanctions later found their addresses blocked from major services.

For developers, the lesson is that building privacy infrastructure for crypto carries personal legal risk in jurisdictions that prioritize anti-money-laundering enforcement.

For policy, the case illustrates the fundamental tension between privacy as a financial property (legitimate, important) and privacy as an enabler of illicit activity (real, problematic). No clean resolution exists; the policy response is ongoing.

Worth knowing about as the canonical example of regulatory risk reaching beyond direct token holders. The Tornado Cash case will likely produce precedents that shape crypto regulation for years.