In August 2022, the U.S. Treasury’s Office of Foreign Assets Control (OFAC) took an unprecedented action: it sanctioned Tornado Cash, an Ethereum-based cryptocurrency mixer. Unlike traditional sanctions that target people or companies, this sanctioned a piece of open-source software. The action instantly made it illegal for U.S. persons to use Tornado Cash or even interact with its smart contracts. It was a shocking escalation in the government’s war on crypto privacy.
Tornado Cash had been launched in 2019 as a tool for private transactions on Ethereum. When you use Tornado Cash, you deposit ether into a smart contract, and later withdraw the same amount from a different address. The protocol uses zero-knowledge proofs to break the link between deposits and withdrawals, making transactions private. For legitimate users concerned about financial privacy, it was a valuable tool. For criminals and sanctioned entities, it was also valuable — and that was the problem.
The Treasury argued that Tornado Cash had been used to launder over $7 billion, including hundreds of millions of dollars stolen by North Korean hackers through attacks on Axie Infinity’s Ronin bridge and other projects. By sanctioning the protocol itself, the government aimed to cut off this laundering capability. The sanctions prohibited anyone in the U.S. from sending or receiving transactions through Tornado Cash, or from helping others do so.
The crypto community was horrified. Sanctioning code, they argued, was unprecedented and dangerous. Code is speech, they said — protected under the First Amendment. Sanctioning Tornado Cash was like sanctioning a mathematical formula. Crypto advocates filed lawsuits challenging the sanctions. Civil liberties groups weighed in. The debate raised fundamental questions: can the government sanction software? Can it prohibit people from using privacy tools? Where does financial surveillance end and personal freedom begin?
The debate continued for years. In late 2024, a federal appeals court ruled that OFAC had exceeded its authority in sanctioning Tornado Cash as an entity — immutable smart contracts aren’t “persons” that can be sanctioned. The ruling was a partial victory for crypto privacy advocates. But the broader issue remained unresolved. Tornado Cash had become a symbol of the fundamental tension between government desire to prevent money laundering and individual desire for financial privacy. That tension will continue to shape crypto regulation for years to come.
Leave a Reply