On November 26, 2024, the United States Court of Appeals for the Fifth Circuit (the “Court”) ruled that the Treasury Department’s Office of Foreign Assets Control (“OFAC”) exceeded its authority by sanctioning the crypto mixer Tornado Cash. In its ruling, the Court stated that autonomous software, which cannot be modified or controlled, does not qualify as “property” under prevailing federal law, and therefore cannot be sanctioned.
Understanding Tornado Cash
Tornado Cash is an open-source, non-custodial, fully decentralized mixer crypto transaction software protocol that uses smart contracts to facilitate anonymous transactions by obfuscating the origins and destinations of digital asset transfers. In other words, Tornado Cash is a code that enables an Ethereum address to receive funds without revealing the owner or source of those funds, thus ensuring privacy (by anonymizing digital transactions) and immutability, as software code is unownable, uncontrollable, and unchangeable—even by its creators.
The Tornado Cash project was launched in 2019 by a team of contributors who uploaded a series of smart contracts onto the Ethereum blockchain. These smart contracts facilitated crypto “mixing” by allowing users to deposit cryptocurrency into specific “pool” contracts, depending on the type and amount they wished to mix. For instance, a user depositing 100 ETH would have to send it to the “100 ETH Pool Contract” and receive a key or password in return. This key allowed the user to withdraw an equivalent amount of cryptocurrency from the pool, which could then be sent to a different wallet, thereby severing any connection between the original deposit and subsequent withdrawal. The process operated entirely automatically, without any human intervention. The effectiveness of Tornado Cash’s mixing process depended on a critical mass of users making concurrent deposits and withdrawals, as larger pools increased transaction anonymity.
Initially, the Tornado Cash developers retained the ability to modify the pool smart contracts, thus rendering them mutable. However, in 2020, they permanently relinquished developer control over at least 20 smart contracts, including the pool contracts, so that they became immutable—self-executing and beyond alteration, removal, or control by any party, including the developers.
A Brief History of U.S. Sanctions Policy
Sanctions are restrictive measures applied by the U.S. to influence behaviour, punish violations, or deter specific actions, in fulfilment of foreign policy and national security objectives. At their core, U.S. sanctions prohibit economic transactions with blacklisted designated targets. These measures apply not only to U.S. persons and entities, but also encompass individuals and entities with no U.S. connection, through the implementation of secondary sanctions. Under its sanctions policy, the U.S. also restricts transactions with any party engaging economically with a blacklisted entity.
OFAC is an agency within the U.S. Department of Treasury, tasked with overseeing, maintaining and enforcing U.S. sanctions policy. It serves as the regulator and enforcer of Presidential declarations of a national emergency entailing “any unusual and extraordinary threat, which has its source in whole or substantial part outside the United States, to the national security, foreign policy, or economy of the United States”. This authority is granted to the President under the International Emergency Economic Powers Act.
Traditionally, OFAC’s sanctions have targeted foreign nations, organizations, groups, and individuals—such as terrorists or narcotics traffickers. The U.S. sanctions policy is grounded in the rule of law, enabling OFAC to impose penalties, initiate enforcement action, and pursue legal proceedings against violators when required. This includes blocking “any property in which any foreign country or a national thereof has any interest”.
On August 8, 2022, OFAC designated Tornado Cash as a sanctioned party. In its statement, OFAC accused Tornado Cash of “being used to launder more than $7 billion worth of virtual currency since its creation in 2019”, and of laundering virtual currency for malicious cyber actors, such as a hacking group linked to North Korea that utilized Tornado Cash to process the proceeds of cybercrimes. OFAC nonetheless clarified that it does not purport to assert that Tornado Cash software was created, owned, or controlled by North Korea. However, the designation was based on evidence that the North Korean Lazarus Group had used Tornado Cash software in executing certain transactions.
OFAC added Tornado Cash to its list of Specially Designated National and Blocked Persons (“SDN”) and imposed an across-the-board ban on any dealings with Tornado Cash “property,” which OFAC construed as including its smart contracts.
Public Criticism
The action taken by OFAC against Tornado Cash was the first-time a non-custodial cryptocurrency smart contract has been sanctioned, thereby depicting a significant departure from the agency’s traditional targets, as outlined above. What made this especially unique was the fact that the sanction targeted a decentralized entity responsible for creating software deployed on a platform designed to be censorship-resistant, thus rendering the software nearly impossible to remove.
As noted above, Tornado Cash was developed by a group of contributors through an open-source codebase who uploaded a series of smart contracts onto the Ethereum blockchain. Fundamentally, Tornado Cash is simply code executed on public blockchains such as Ethereum. Notably, most of its smart contracts are immutable which, as outlined above, means that they cannot be altered or deleted by any entity.
OFAC’s action generated significant criticism within the crypto industry, with claims being voiced that the agency had overstepped its authority and unfairly targeted developers for creating code that others exploited for engaging in illegal activities. Privacy advocates also condemned the decision, arguing that banning a tool designed to enhance privacy is unreasonable, even noting that such tools are often used for lawful and legitimate purposes.
The Court’s Legal Analysis
The Court’s ruling stemmed from an appeal challenging OFAC’s designation of Tornado Cash as a SDN. Specifically, it was argued that OFAC had violated the Administrative Procedure Act and exceeded its authority, on the grounds that: (1) Tornado Cash is neither a foreign “national” nor a “person”; (2) immutable pool smart contracts do not qualify as “property” (within the meaning of such term under prevailing federal law); and (3) Tornado Cash cannot hold, whether directly or indirectly, a property “interest” of any nature whatsoever in immutable smart contracts, since it has no rights of possession or control over them. In the original lawsuit, the trial court (the District Court for the Western District of Texas) ruled in favour of OFAC by granting its motion for summary judgment and denying the Tornado Cash users’ motion.
In the appeal, the Court ruled that the immutable smart contracts at issue do not qualify as “property” under federal law. The court went on to explain that the term “property” has been construed by the U.S. Supreme Court to mean “all objects or rights which are susceptible of ownership”, and those of Tornado Cash are not capable of being owned. As noted in the ruling, “More than one thousand volunteers participated in a ‘trusted setup ceremony’ to ‘irrevocably remov[e] the option for anyone to update, remove, or otherwise control those lines of code’. And as a result, no one can ‘exclude’ anyone from using the Tornado Cash pool smart contracts”, therefore the ban was not effective and ultimately thwarted OFAC’s own purpose.
Moreover, the Court held that even by OFAC’s own definition of immutable smart contracts having to be ownable, they nonetheless do not qualify as either contracts or services, and thus fall outside the scope of OFAC. The Court further held that in order to circumvent the term “ownership” with regard to “property”, OFAC conflated the term “interest”, with “property”, with the implication that “Tornado Cash profits from—and therefore has an interest in—the smart contracts that embody the mixing service it provides” and are thus analogous to patents and copyrights, which undisputedly fall within the scope of OFAC’s definition of “property”. However, the Court decided against adopting this stance, by holding that Tornado Cash does not profit directly from its immutable smart contracts.
Key Takeaways
This ruling marks a significant milestone for both the tech and privacy sectors, the crypto industry and particularly the decentralized finance (DeFi) sector. By establishing that certain smart contracts do not constitute “property”, paves the way for DeFi platforms to operate with enhanced legal certainty. This could therefore potentially encourage more innovation and adoption in the DeFi sector, enabling both developers and users alike to utilize and rely upon privacy-enhancing technologies. We thus envisage seeing the creation and development of more privacy enhanced crypto technology in the not too distant future.
In addition, we believe it reasonable to expect a general reassessment of the regulatory and rule-making processes in the realm of cryptocurrencies. Specifically, and as a consequence of this ruling, regulators may be propelled to further distinguish between traditional finance and DeFi, and so spearhead and curate a tailor-made regulatory framework for blockchain-based products and services, that will specifically address the inherent differences in those sectors – again, a “win win” situation for the crypto industry in the long run.
Originally published at Lexology