Crypto Mixers and Tornado Cash Sanctions Explained: The Legal Battle and Aftermath

For years, Tornado Cash was the most controversial name in cryptocurrency privacy. If you wanted to break the on-chain link between your wallet address and a transaction, this Ethereum-based mixer was the go-to tool. But in August 2022, the U.S. government pulled the rug out from under it by sanctioning the protocol itself. This wasn't just a slap on the wrist; it was an unprecedented move that criminalized the use of specific smart contracts for millions of users worldwide. Fast forward to 2025 and 2026, and the landscape has shifted dramatically. Courts have ruled against the government's authority to sanction code, and sanctions have been lifted from the protocol. Yet, the developers are still facing criminal charges. What does this mean for you? How do crypto mixers work, and why did the government target them so aggressively?

How Crypto Mixers Work and Why Privacy Matters

To understand the controversy, you first need to grasp what a crypto mixer is a service or protocol that obscures the origin of cryptocurrency transactions by pooling funds from multiple users and redistributing them to new addresses. Think of it like dropping cash into a large laundry machine with other people’s money. When it comes out, it’s mixed up, and no one can easily tell which bill belongs to whom. On the blockchain, however, every transaction is public. Your wallet address is visible, and anyone can trace where your funds came from and where they went.

Tornado Cash operates as a non-custodial decentralized application (dApp) built on Ethereum that uses zero-knowledge proofs to anonymize transactions. Launched in August 2019 by developers Roman Semenov and Roman Storm, it allows users to deposit Ether (ETH) into smart contracts and withdraw it to a completely different address. The system uses cryptographic techniques called zero-knowledge proofs are cryptographic methods that allow one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. This breaks the digital trail between sender and receiver.

Why do people use these tools? For many, it’s about financial privacy. Just as you don’t want your bank sending you a receipt for every coffee purchase to the world, crypto users want control over their data. However, because blockchains are transparent, privacy isn’t the default. Mixers fill that gap. According to Chainalysis, a leading blockchain analytics firm, Tornado Cash processed over $7.6 billion worth of Ether since its inception. While approximately 30% of those funds were traced to illicit actors, the majority were used by everyday users seeking basic privacy protections.

The 2022 Sanctions: A Regulatory Shockwave

On August 8, 2022, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) made history. They sanctioned Tornado Cash under Executive Order 13694, which targets malicious cyber-enabled activities. This added the protocol’s Ethereum addresses to the Specially Designated Nationals and Blocked Persons (SDN) List is a list maintained by OFAC containing individuals and companies owned or controlled by, or acting for or on behalf of, targeted countries and other terrorists, narcotics traffickers, and other threats to the national security, foreign policy, or economy of the United States.

The government’s argument was clear. They alleged that Tornado Cash facilitated the laundering of more than $7 billion in cryptocurrency. Specific examples included:

• $455 million stolen by North Korea’s Lazarus Group from the Axie Infinity hack.
• $96 million from the Harmony Bridge Heist in June 2022.
• $7.8 million from the Nomad Heist in August 2022.

The Treasury stated that Tornado Cash had “repeatedly failed to impose effective controls designed to stop it from laundering funds.” By placing the smart contracts on the SDN List, OFAC prohibited all U.S. persons from interacting with them. This created massive uncertainty. If an American user sent ETH to a Tornado Cash contract, were they committing a crime? Even if the user wasn’t a sanctioned entity themselves, the mere act of interacting with the code was restricted.

This move was unique. Previously, sanctions targeted companies or individuals. Here, the target was immutable code. Once deployed on Ethereum, smart contracts cannot be changed or shut down by their creators. The website went down, and the team stepped back, but the contracts remained active. Technically sophisticated users could still interact with them via scripts, and dark web mirrors persisted. Despite the crackdown, inflows dropped significantly from a peak of $3 billion, but Tornado Cash still processed approximately $200 million in transactions by September 2023.

The Legal Battle: Code vs. Property

The sanctions sparked immediate legal challenges. Critics argued that sanctioning software was an overreach. You can’t really “own” or “control” open-source code in the same way you own a bank account. This debate reached the federal courts, culminating in a landmark case: Van Loon v. Department of Treasury.

In November 2024, the U.S. Fifth Circuit Court of Appeals issued a ruling that shook the regulatory world. The court determined that OFAC had exceeded its authority under the International Emergency Economic Powers Act (IEEPA) is a U.S. law that grants the President broad powers to deal with unusual and extraordinary threats to the national economy, provided such threats originate in whole or substantial part outside the United States. The core issue was whether Tornado Cash’s smart contracts qualified as “property” or “interests in property” under the law.

The Fifth Circuit said no. Immutable smart contracts do not fit the traditional definition of property that can be blocked or seized. The court remanded the case back to the District Court with instructions to grant partial summary judgment for Van Loon, effectively striking down the sanctions against the code itself. Legal experts from Mayer Brown noted this established a critical distinction between sanctioning code versus sanctioning human actors. The court ruled that OFAC had overstepped its regulatory authority regarding the immutable smart contracts.

The 2025 Delisting and Ongoing Criminal Charges

Following the court’s decision, the regulatory landscape shifted again. On March 21, 2025, the U.S. Treasury Department officially lifted sanctions against Tornado Cash’s smart contracts. This was a strategic move. The Treasury limited the delisting to only the code while maintaining sanctions against developer Roman Semenov. They also filed in the District Court to narrow the court order to “immutable smart contracts,” claiming they had taken all necessary actions to delist the protocol.

So, is it legal for Americans to use Tornado Cash again? According to Merkle Science, yes, the reversal made it legal for Americans to interact with the smart contracts once more. However, the situation remains complex. The Department of Justice (DOJ) proceeded with criminal charges against developer Roman Storm, filing three conspiracy charges:

1. Conspiracy to money launder.
2. Conspiracy to operate an unlicensed money transmitting business.
3. Conspiracy to violate IEEPA.

This dual-track approach highlights a nuanced regulatory strategy. The government is separating protocol-level sanctions from individual accountability. While the technology itself may no longer be sanctioned, the humans behind it face serious legal consequences. This creates ongoing legal uncertainty for those interacting with the platform. Are you liable if you use a tool created by someone who is criminally charged? The lines are still being drawn.

Implications for DeFi and Privacy Tech

The Tornado Cash saga has profound implications for the future of decentralized finance (DeFi) and privacy-enhancing technologies. Industry analysts noted that the initial sanctions created “more complicated” compliance challenges due to the protocol’s non-custodial nature and decentralized development team. Exchanges like Coinbase and Kraken quickly froze assets linked to Tornado Cash to avoid secondary sanctions, impacting thousands of innocent users.

Privacy advocates hailed the delisting as a significant victory. It highlighted the challenges of applying traditional financial sanctions to decentralized technologies. If code cannot be sanctioned, how will regulators police illicit activity in DeFi? The focus may shift toward centralized points of failure, such as exchanges and bridges, rather than the protocols themselves.

Furthermore, the case sets a precedent for developer liability. The fact that Roman Storm faces criminal charges despite the protocol being delisted suggests that regulators will continue to pursue individuals. This could chill innovation, as developers may fear prosecution for creating open-source tools that bad actors might misuse. The distinction between a neutral tool and a criminal enterprise remains a key legal question.

As we move through 2026, the crypto industry is watching closely. Will other privacy protocols face similar scrutiny? How will courts interpret the boundaries of IEEPA in the digital age? The answers will shape the regulatory framework for blockchain technology for years to come. For now, users must navigate a landscape where privacy is legally permissible but politically sensitive.