US Sanctions on Crypto Mixers: The Tornado Cash Case Explained

What Happened to Tornado Cash?

On August 8, 2022, the U.S. government did something no one had ever done before: it sanctioned a piece of software. Not a company. Not a person. Not a bank. But a decentralized, open-source protocol called Tornado Cash. This wasn’t just another regulatory warning. It was a legal earthquake.

Tornado Cash wasn’t a business. It didn’t have offices, employees, or customer service. It was code-smart contracts running on the Ethereum blockchain, designed to mix cryptocurrency transactions and hide where the money came from. For years, people used it for privacy: activists in repressive countries, whistleblowers, everyday users who didn’t want their financial history tracked. But it was also used by criminals. A lot.

The U.S. Treasury’s Office of Foreign Assets Control (OFAC) said Tornado Cash had laundered over $7 billion since 2019. Of that, $455 million came from hacks tied to North Korea’s Lazarus Group. That included $96 million stolen from the Harmony Bridge and $7.8 million from the Nomad Bridge. The government didn’t just freeze accounts. It made it illegal for any U.S. person or company to interact with the protocol at all. Even running the code on your own computer became a legal risk.

How Did Tornado Cash Actually Work?

Think of Tornado Cash like a public laundry service for crypto. You drop in dirty cash-say, 10 ETH from an exchange-and after a while, you pull out clean ETH from a different address. No one can link the two. That’s because it used zero-knowledge proofs, a cryptographic trick that proves you own the money without revealing where it came from.

The system had pools for 0.1 ETH, 1 ETH, 10 ETH, and 100 ETH. You deposited your coins into one of these pools. After waiting a few hours or days, you generated a secret code (a “withdrawal proof”) and used it to claim an equivalent amount from the pool. The withdrawal address? Totally new. No connection to your original deposit.

There was no login. No KYC. No ID checks. No middleman. The whole thing ran on smart contracts. Once deployed, even the creators couldn’t stop it. That’s what made it powerful-and dangerous in the eyes of regulators.

Why Did the U.S. Target It?

The U.S. didn’t act because Tornado Cash was popular. They acted because it was effective. And it was being used by some of the most dangerous cybercriminals on the planet.

Lazarus Group, the North Korean hacking team, relied on Tornado Cash to clean up after heists. They didn’t need to hide from ordinary users. They needed to hide from the FBI, the Treasury, and global financial monitors. Tornado Cash made that easy.

OFAC’s statement was blunt: “Despite public assurances otherwise, Tornado Cash has repeatedly failed to impose effective controls designed to stop it from laundering funds for malicious cyber actors on a regular basis.” In other words: you claimed to be neutral, but you didn’t do anything to stop criminals. And that made you complicit.

Before Tornado Cash, OFAC had sanctioned Blender.io, another mixer. But Tornado Cash was different. It was decentralized. It was open-source. And it couldn’t be shut down. That’s what made the sanctions so controversial.

The Legal Battle: Is Code a Crime?

Sanctioning a website is one thing. Sanctioning code that runs on a global, decentralized network? That’s a legal frontier.

Lawyers immediately pushed back. How can you sanction software that doesn’t have a CEO, a bank account, or a physical address? The smart contracts don’t make decisions. They just run. If someone uses a hammer to break a window, do you jail the hammermaker?

Two lawsuits were filed. One argued OFAC overstepped its authority under the International Emergency Economic Powers Act. Another claimed the sanctions violated the First Amendment-because code is speech. The government’s response? If you build a tool that’s designed to evade sanctions, and it’s used for crime, you’re part of the crime.

Then came the trial of Roman Storm, one of Tornado Cash’s co-founders. In August 2025, after a four-week trial, the jury convicted him on one charge: conspiracy to operate an unlicensed money transmitting business. But they couldn’t agree on the bigger charges: money laundering or violating sanctions. That split verdict sent a clear message: the law isn’t ready for this.

What Happened After the Sanctions?

After August 2022, U.S. exchanges like Coinbase and Kraken blocked all transactions linked to Tornado Cash addresses. Wallets started flagging those addresses as “high risk.” Banks froze accounts that had ever interacted with the protocol-even if the user didn’t know what Tornado Cash was.

Developers got nervous. If you build a privacy tool, could you be next? Projects like Aztec, zkSync, and Semaphore started adding compliance features-optional KYC, transaction monitoring, or self-imposed limits-to avoid becoming targets.

But here’s the twist: the sanctions didn’t stop criminals. A Chainalysis report in early 2025 showed that Tornado Cash was still being used by hackers to launder funds. The smart contracts kept running. People outside the U.S. still used it. The protocol didn’t shut down. It just became a legal minefield for Americans.

Did the Sanctions Get Lifted?

On March 21, 2025, reports surfaced that OFAC had removed Tornado Cash from its sanctions list. The TORN token price jumped from $8 to $15 in hours. Markets cheered. Some thought the government had reversed course.

But it wasn’t that simple. OFAC never issued a formal reversal. Instead, they updated their guidance: U.S. persons could now interact with the protocol if they used a “compliant” interface that screened for tainted funds. In practice, that meant developers could build new wallets or front-ends that checked addresses before allowing deposits. The core code? Still on the blockchain. Still unchangeable. Still sanctioned-but now you could use it if you added a guardrail.

This created a gray zone. Is a wallet that filters Tornado Cash addresses compliant? What if it’s built by a non-U.S. team? Can you still use it if you’re not American? The rules are still being written.

What This Means for You

If you’re a regular crypto user: don’t use Tornado Cash. Even if you’re not in the U.S., your exchange might block you. Your funds could get frozen. Your wallet might be flagged. The risk isn’t worth it.

If you’re a developer: privacy tools are now high-risk. Building something that could be used for laundering-even if you didn’t intend it-could lead to legal trouble. The line between privacy and criminality is thin, and regulators are drawing it in real time.

If you care about financial privacy: this case is a warning. The government can and will target tools that protect anonymity. The question isn’t whether privacy matters. It’s whether the law can handle it without breaking the internet.

What Comes Next?

The Tornado Cash case didn’t end in 2025. It started something bigger.

Regulators around the world are watching. The EU is debating similar rules. Singapore is trying to carve out a middle path. China? They banned all mixers outright.

Meanwhile, new privacy protocols are emerging-ones that integrate compliance by design. Think of it like a privacy tool with a built-in cop. You still get anonymity, but the system checks if the money is dirty before letting you use it.

The future won’t be all-or-nothing. It’ll be layered: some tools for privacy, some for compliance, and a lot of legal fights in between.

One thing’s clear: the age of unregulated crypto privacy is over. The question now is: how much privacy can we still have-and who gets to decide?