United States designation and delisting of Tornado Cash (2022-2025)

The Tornado Cash case exposed a legal limit on using sanctions against decentralised software. Treasury designated the service in August 2022 and redesignated it in November. The Fifth Circuit later held that the immutable smart contracts in the administrative record were not sanctionable property under IEEPA, and Treasury delisted Tornado Cash in March 2025. Separate criminal liability did not rise or fall with that administrative holding.

Designation and redesignation

Tornado Cash combined smart contracts, web interfaces, governance and supporting infrastructure to obscure links between deposits and withdrawals on Ethereum. Those components were not one legal person. Some contracts had become immutable, while developers, a decentralised autonomous organisation, relayers, users and front-end providers retained different forms of agency.

On 8 August 2022, Treasury designated Tornado Cash under the cyber-related sanctions programme. It stated that the mixer had been used to launder more than USD 7 billion in virtual currency since its creation, including funds stolen in hacks attributed by the United States to North Korea's Lazarus Group. That USD 7 billion figure described total value moved through the service in Treasury's release, not an adjudicated finding that every dollar was criminal proceeds.

OFAC replaced the initial action with a redesignation on 8 November 2022 under cyber and North Korea authorities. It identified the entity, associated addresses and alleged activity in a revised administrative action. Compliance effects spread beyond the listed addresses as exchanges, infrastructure providers and users withdrew. The immutable contracts nevertheless remained executable on the blockchain.

Judicial review and delisting

Users challenged the action in Van Loon v Department of the Treasury. On 26 November 2024, the Fifth Circuit held that the immutable smart contracts at issue were not "property" or an "interest in property" under IEEPA and OFAC's regulation because they could not be owned, controlled or changed. The holding was narrower than a general immunity for cryptocurrency mixers or software. It did not decide the status of every front end, governance body, developer, relayer or mutable contract, and it did not limit criminal statutes outside the property-blocking authority before the court.

Treasury removed Tornado Cash from the sanctions list on 21 March 2025 while maintaining its concern about illicit use of digital-asset services. Delisting ended the administrative blocking action. It was not an acquittal of any individual and did not determine whether particular transactions violated criminal law.

In a separate prosecution, a federal jury convicted co-founder Roman Storm on 6 August 2025 of conspiracy to operate an unlicensed money-transmitting business. The jury did not return convictions on the other charged conspiracies in the cited announcement. The verdict established the count decided at trial, not every allegation in the sanctions notices. Storm filed a motion for judgment of acquittal under Federal Rule of Criminal Procedure 29 on 30 September 2025. A 24 April 2026 court order set retrial on the unresolved counts for 26 October 2026, expressly contingent on the court's ruling on that motion. The court's 16 June pretrial order still described the Rule 29 motion as pending. The cited record therefore does not establish a final sentence or appeal disposition as at 29 July 2026.

Statecraft assessment

The designation reached compliant intermediaries but not the underlying immutable execution layer. That distinction matters for economic statecraft. Financial restrictions work most reliably where an actor can control an asset, account or service. Immutable code weakens that chokepoint, shifting enforcement towards developers, interfaces, exchanges and identifiable proceeds.

The case did not place decentralised finance outside law. It required the state to match the legal instrument to the object. Property blocking, criminal prosecution and regulation of intermediaries have different elements, evidence and remedies. Treating them as interchangeable obscures both the reach and the limit of each tool.

See also

Cryptocurrency mixers and tumblers (Tornado Cash, Blender.io) · Van Loon v Department of the Treasury (Fifth Circuit, 2024) · North Korean cryptocurrency theft campaign (2017-present) · Lazarus Group · Crypto exchanges as chokepoints (fiat on/off-ramps) · Office of Foreign Assets Control (United States)

Sources

1. United States Department of the Treasury, Treasury sanctions virtual-currency mixer Tornado Cash, 8 August 2022.
2. Office of Foreign Assets Control, Tornado Cash redesignation and related cyber action, 8 November 2022.
3. United States Court of Appeals for the Fifth Circuit, *Van Loon v Department of the Treasury*, No. 23-50669, 26 November 2024.
4. United States Department of the Treasury, Treasury removes Tornado Cash from sanctions list, 21 March 2025.
5. Office of Foreign Assets Control, Tornado Cash delisting record, 21 March 2025.
6. United States Attorney's Office for the Southern District of New York, Tornado Cash founder convicted of conspiring to operate an unlicensed money-transmitting business, 6 August 2025.
7. Defendant Roman Storm, memorandum in support of motion for judgment of acquittal, United States v Storm, No. 23-cr-430, document 230, 30 September 2025.
8. United States District Court for the Southern District of New York, order setting a contingent retrial, document 288, 24 April 2026, and pretrial scheduling order, document 296, 16 June 2026.