U.S. Treasury withdraws appeal after Tornado Cash sanctions deemed unenforceable

Main Points：

• OFAC Sanctions Designation (Aug 8, 2022): Tornado Cash blacklisted for alleged money-laundering ties to North Korea’s Lazarus Group, citing over $1 billion in illicit flow (≈¥146.4 billion).
• Pertsev Conviction (May 2024): Co-developer Alexey Pertsev convicted of money-laundering in the Netherlands, receiving a five-year sentence.
• OFAC Sanctions Dropped (Mar 21, 2025): U.S. Treasury removed Tornado Cash from its Specially Designated Nationals list, signaling policy reversal and mootness of civil proceedings.
• Appeal Withdrawn (Jul 7, 2025): Treasury Department formally withdrew its appeal before the Eleventh Circuit, leading to outright dismissal of the lawsuit.
• Criminal Trial of Roman Storm (Jul 14, 2025): Co-founder Roman Storm faces U.S. federal trial on charges of laundering over $1 billion through the protocol.

Background of Tornado Cash Sanctions

Tornado Cash is an open-source, non-custodial “mixer” that runs as a set of smart contracts on Ethereum and compatible networks. By using zero-knowledge proofs (zk-SNARKs), it breaks the on-chain link between deposit and withdrawal addresses, providing privacy to users.

In August 2022, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) blacklisted Tornado Cash, arguing that the protocol facilitated laundering of over $1 billion (≈¥146 billion) by entities including North Korea’s Lazarus Group. This step prohibited U.S. persons from interacting with its contracts or governance token ($TORN).

Legal Battle and Appeal Withdrawal

Initial Lawsuit
Crypto advocacy group Coin Center, joined by individual developers, filed suit arguing OFAC overstepped, targeting open-source code rather than specific actors. They invoked First Amendment (free speech) and due-process rights.

OFAC Policy Reversal
On March 21, 2025, OFAC quietly removed Tornado Cash from its sanctions list, acknowledging the enforcement challenges posed by decentralized, immutable codebases.

Withdrawal of Appeal
Following this policy reversal, the Treasury Department withdrew its appeal on July 7, 2025, before the U.S. Court of Appeals for the Eleventh Circuit, which then vacated prior rulings and ordered dismissal of the case. This formal end to civil litigation underscores the difficulty of sanction enforcement against decentralized protocols. Figure 1: Timeline of Tornado Cash Legal Events

Implications for Decentralized Regulation

The dismissal highlights structural limits in applying traditional sanctions to open-source, non-custodial code:

1. Enforceability Issues: Smart contracts deployed on public blockchains can’t be “un-published,” limiting OFAC’s ability to restrict access.
2. First Amendment Concerns: Treating code as protected speech may dampen future enforcement efforts against purely on-chain protocols.
3. Shift to Individuals: Regulatory focus may pivot toward prosecuting developers, service providers, or custodial platforms rather than code itself.

Industry experts suggest regulators will need tailored frameworks balancing privacy, innovation, and compliance, possibly via new legislation or targeted developer licensing schemes.

Ongoing Criminal Proceedings

Civil sanctions aside, criminal charges against Tornado Cash co-founder Roman Storm remain. He is set to stand trial on July 14, 2025, in New York federal court, accused of conspiring to launder over $1 billion through the mixer and operating an unlicensed money transmitter.

Storm’s defense argues that code is a tool, not a business, and he did not personally profit from illicit flows. A verdict could establish crucial precedents for liability in open-source development.

Future Outlook

• Regulatory Evolution: Expect collaborative rule-making between blockchain communities and authorities to craft enforceable, tech-aware regulations.
• Developer Risk: Individuals behind protocols may face heightened scrutiny, reinforcing the need for legal counsel and compliance audits during development.
• Privacy vs. Compliance: Ongoing debate about the balance between financial privacy and anti-money-laundering safeguards will shape next-generation protocols.

Conclusion

The series of events surrounding Tornado Cash has highlighted the limitations of traditional sanctions against decentralized protocols. It is legally and practically difficult to “sanction” a smart contract that is technically undeletable. On the other hand, the need for stricter regulation of individual developers and new legislative measures has been suggested, and in the future, regulatory design that distinguishes between privacy tools as “software code” and individuals and organizations as “actors” will be required.