US Sanctions on Crypto Mixers: The Tornado Cash Case Explained

Imagine writing a piece of code, uploading it to the internet, and then being told by the government that the code itself is now a sanctioned entity. That is exactly what happened with Tornado Cash is an Ethereum-based cryptocurrency mixing platform designed to provide transaction privacy by pooling funds. For years, it was the gold standard for privacy on the blockchain, but it eventually became the center of a legal war between the U.S. government and the world of decentralized finance.

The Basics of Crypto Mixing

To understand why the government cares, you first have to understand how crypto mixers work. In a normal blockchain transaction, everything is public. If I send you 1 ETH, anyone can see my address and your address. Mixers break this trail. They act like a digital blender: multiple users deposit their coins into a pool, the mixer shuffles them, and then users withdraw them to new, unrelated addresses.

Tornado Cash used a high-tech method called zero-knowledge proofs. This allows the system to prove that you deposited money without revealing which specific deposit belongs to you. It's like showing a ticket to enter a club without showing your ID. By supporting various denominations (0.1, 1, 10, and 100 ETH), it allowed users to blend in with others, making it nearly impossible for analysts to trace where the money went.

Why the U.S. Stepped In

Privacy is great for regular people, but it's a dream for cybercriminals. The Office of Foreign Assets Control (known as OFAC) noticed a disturbing pattern. The platform wasn't just being used by privacy enthusiasts; it was becoming a laundromat for stolen billions.

The biggest red flag was the Lazarus Group, a state-sponsored hacking collective from North Korea. According to Treasury Department data, this group used the mixer to wash over $455 million. It didn't stop there. High-profile thefts, like the $96 million Harmony Bridge Heist and the $7.8 million Nomad Heist, both saw funds funnelled through the protocol to hide the loot.

On August 8, 2022, the U.S. government decided enough was enough. They sanctioned the protocol under Executive Order 13694. This meant that any "U.S. person"-which includes citizens and companies-was legally prohibited from interacting with the mixer's smart contracts. If you used it, you weren't just using a tool; you were technically violating federal sanctions.

Can You Actually Sanction Code?

This is where the legal drama gets intense. Usually, sanctions target people, companies, or countries. But Tornado Cash is a decentralized protocol. It runs on Ethereum smart contracts. Once those contracts are deployed, they are immutable-meaning they cannot be changed or turned off by any human, even the people who wrote them.

Lawyers and developers argued that sanctioning code is like sanctioning the laws of physics or a mathematical formula. If the software operates autonomously, who is actually being punished? The government's stance was that the software served as a financial tool, and because it lacked basic "know-your-customer" (KYC) controls, it was a weapon for criminals.

This created a nightmare for developers. If you write open-source code and someone uses it for a crime, are you responsible? The case of co-founder Roman Storm highlights this tension. In August 2025, a jury reached a split verdict. Storm was convicted of conspiracy to operate an unlicensed money transmitting business, but the jury couldn't agree on the more serious money laundering charges. This suggests that while the law sees the *operation* of the business as a crime, it's still struggling to define the *creation* of the code as such.

The Ripple Effect on DeFi

The fallout from this case sent shockwaves through the Decentralized Finance (known as DeFi) ecosystem. It proved that the U.S. government is willing to target the plumbing of the blockchain, not just the people using it.

• Compliance Burdens: Cryptocurrency exchanges now have to screen every single transaction. If a coin has ever touched a sanctioned Tornado Cash address, it's often flagged or frozen.
• Developer Chill: Privacy-focused developers are now hesitant to launch projects. The fear is that if their tool becomes "too effective" at hiding money, they might end up in a federal courtroom.
• Market Volatility: The native governance token, TORN, became a barometer for regulatory news. When reports surfaced that sanctions might be lifted in March 2025, the price jumped from roughly $8 to $15 almost overnight.

Did the Sanctions Actually Work?

If the goal was to stop money laundering, the results are mixed. Technically, the smart contracts are still there. They haven't disappeared because you can't "delete" a contract from a decentralized blockchain. Bad actors who are determined enough can still find ways to interact with the protocol, often by using relayers to mask their identity even further.

In fact, some analysis suggests that sanctions have had a negligible effect on professional exploiters. The people stealing millions are usually the ones most capable of bypassing these restrictions. The people most affected are actually law-abiding users who wanted financial privacy for legitimate reasons, but now find their funds frozen by exchanges because they once used a mixer.

What Happens Next?

We are entering a new era of "regulated privacy." Future protocols are likely to build in compliance features-like "view keys" that allow users to share their history with auditors while keeping it hidden from the public. The goal is to find a middle ground where a user can have privacy from their neighbor, but not from the law.

The Tornado Cash saga is a wake-up call. It tells us that the "code is law" philosophy has a limit, and that limit is where the U.S. Treasury Department decides to draw a line. As we move forward, the industry will have to decide if it can coexist with government oversight or if it must build entirely new, more resistant systems.