The U.S. Treasury Department has removed sanctions on Tornado Cash, the Ethereum-based privacy protocol, after a series of legal challenges. The decision marks a major shift in the government’s approach to financial sanctions, particularly in the context of rapidly evolving technology.
Background of the Sanctions
Tornado Cash, a decentralized privacy-enhancing service launched in 2019, allows users to obfuscate their transaction histories on the Ethereum blockchain. However, in August 2022, the U.S. government added Tornado Cash to its list of sanctioned entities under the Office of Foreign Assets Control (OFAC), citing its alleged role in facilitating money laundering activities. The sanctions were largely due to the platform’s involvement in transactions linked to the North Korean hacker group Lazarus, which U.S. authorities claimed had laundered over $7 billion through the service.
As part of the sanctions, U.S. persons were prohibited from using Tornado Cash, and legal action was taken against its co-founders, Roman Storm and Roman Semenov, for their role in facilitating illicit transactions. Tornado Cash users, backed by Coinbase, filed a lawsuit against the Treasury Department, arguing that the sanctions on smart contracts were legally unjustified.
Legal Developments Lead to Sanctions Removal
In a landmark ruling, the federal court in Texas ruled in January 2025 that the sanctions imposed on Tornado Cash were unconstitutional, as smart contracts themselves could not be targeted under existing financial regulations. The ruling was upheld by the Fifth Circuit Court of Appeals in late 2024, prompting the Treasury Department to reassess its stance.
The Treasury announced that it had decided to lift the sanctions, citing the evolving legal and technological landscape. The department acknowledged that the case raised “novel legal and policy issues” and exercised discretion in removing the sanctions. While Tornado Cash is no longer subject to penalties, the Treasury has reiterated its commitment to continuing sanctions enforcement against North Korea, emphasizing the ongoing threat posed by state-sponsored cybercrime.
Continued Focus on North Korean Cybercrime
Despite the change in position regarding Tornado Cash, the U.S. Treasury remains firm in its stance on addressing the cybersecurity threats posed by North Korea. The agency cited recent hacks, including the theft of over $1 billion from Bybit, which authorities believe were orchestrated by the Lazarus group, as a key concern.
The Treasury’s statement emphasized that while the sanctions on Tornado Cash have been lifted, the U.S. government will continue to monitor and prevent transactions that could benefit malicious actors or support North Korean interests. Treasury officials have advised caution when engaging in digital asset transactions to avoid inadvertently supporting these illicit activities.
Impact on the Crypto Industry
The lifting of sanctions on Tornado Cash could have significant implications for the cryptocurrency industry, especially for developers working on privacy-focused solutions. The decision suggests a shift toward a more nuanced regulatory approach, acknowledging the complex nature of smart contracts and decentralized platforms.
However, experts warn that it is still too early to predict the full impact on the broader crypto market. Legal and regulatory uncertainties remain, and future court cases involving other privacy tools, such as the Samurai Wallet, may continue to shape the landscape of cryptocurrency regulation.
U.S. Treasury Secretary Scott Bessent emphasized the need to balance innovation with security, stating, “Digital assets present enormous opportunities for innovation and value creation for the American people. However, securing this industry from abuse by bad actors is crucial to ensuring that these opportunities can be safely harnessed.”
As the legal and regulatory environment surrounding digital assets continues to evolve, both the crypto industry and policymakers will need to navigate the complex intersection of innovation, privacy, and security.