v1 → v2

Protocol Overview

Founders and Key Individuals

OFAC Sanctions — August 2022

Van Loon Civil Challenge — Texas District Court and Fifth Circuit

OFAC Delisting — March 2025

Alexey Pertsev — Netherlands Criminal Proceedings

Roman Storm — U.S. Criminal Prosecution

Constitutional and Policy Debate

North Korea / Lazarus Group Nexus

Current Legal Status (as of May 2026) → Implications for Developer Liability

Overview and Protocol Description → Current Legal Status (as of August 2026)

- Tornado Cash is an open-source, non-custodial cryptocurrency tumbler (mixer) built on the Ethereum blockchain. It was deployed in December 2019 and co-founded by Roman Storm (a Washington State resident), Roman Semenov (a Russian citizen), and Alexey Pertsev (a Russian national residing in the Netherlands). The protocol uses zero-knowledge proofs (zk-SNARKs) to break the on-chain link between deposit and withdrawal addresses, allowing users to deposit a fixed denomination of ETH or ERC-20 tokens and later withdraw the same amount to a different address with no traceable on-chain connection. In May 2020, the founding team relinquished administrative control over the core protocol through a Trusted Setup Ceremony, rendering the primary smart contracts immutable. A governance token, TORN, was launched in 2021 to allow community voting on protocol changes. Tornado Cash received over $7.6 billion worth of Ethereum since its August 2019 activation, according to Chainalysis data cited in OFAC's 2022 designation.+ 

OFAC Sanctions (August 2022) and Sanctioned Contract Addresses → (section 12)

- On August 8, 2022, OFAC designated Tornado Cash and added 45 Ethereum addresses to its Specially Designated Nationals and Blocked Persons (SDN) list under the authority of the International Emergency Economic Powers Act (IEEPA) and the North Korea Sanctions and Policy Enhancement Act. In November 2022, OFAC updated the designation to encompass 53 Ethereum addresses, including at least 20 immutable smart contracts. The designation prohibited U.S. persons and entities subject to U.S. jurisdiction from transacting with any of the listed addresses.- - Key sanctioned Ethereum contract addresses included the following Tornado Cash pool contracts: 0x12D66f87A04A9E220743712cE6d9bB1B5616B8Fc (0.1 ETH pool), 0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936 (1 ETH pool), 0x910Cbd523D972eb0a6f4cAe4618aD62622b39Dbf (10 ETH pool), 0xA160cdAB225685dA1d56aa342Ad8841c3b53f291 (100 ETH pool), 0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b (Router), 0x722122dF12D4e14e13Ac3b6895a86e84145b6967 (Proxy), 0x8589427373D6D84E98730D7795D8f6f8731FDA16, 0xDD4c48C0B24039969fC16D1cdF626eaB821d3384, 0xd96f2B1c14Db8458374d9Aca76E26c3D18364307, 0x4736dCf1b7A3d580672CcE6E7c65cd5cc9cFBa9D, and 0xD4B88Df4D29F5CedD6857912842cff3b20C8Cfa3, among others. USDC-denominated and other ERC-20 denomination pools were also included in the full 53-address SDN listing.  - OFAC stated that Tornado Cash had been used to launder more than $7 billion in virtual currency since its 2019 launch, including over $455 million stolen by North Korea's Lazarus Group from Axie Infinity's Ronin Bridge, and more than $96 million from the June 2022 Harmony Horizon Bridge hack.

North Korea Lazarus Group Connections → (section 13)

- OFAC and the DOJ have alleged that North Korea's Lazarus Group, a state-sponsored cybercrime organization sanctioned by the U.S. Treasury, used Tornado Cash as a primary laundering vehicle for funds stolen in multiple high-profile cryptocurrency heists. Elliptic's research estimates the Lazarus Group sent more than $555 million through Tornado Cash in total, including over $468 million from the Ronin Bridge hack and approximately $96 million from the Harmony Horizon Bridge hack. OFAC's August 2022 designation specifically cited Tornado Cash's alleged processing of $455 million stolen in the Ronin/Axie Infinity hack — at the time the largest known cryptocurrency heist — and the $96 million Harmony Horizon Bridge theft. The protocol's lack of know-your-customer (KYC) controls or transaction screening was identified by regulators as enabling systematic use by sanctioned entities. According to Chainalysis data, approximately 18% of all funds received by Tornado Cash originated from sanctioned entities, and just under 11% were funds stolen from other cryptocurrency platforms.+ 

Criminal Charges: Roman Storm and Roman Semenov (United States) → (section 14)

- On August 23, 2023, the U.S. Attorney's Office for the Southern District of New York unsealed an indictment charging co-founders Roman Storm and Roman Semenov with three counts: conspiracy to commit money laundering (maximum 20 years), conspiracy to commit sanctions violations (maximum 20 years), and conspiracy to operate an unlicensed money transmitting business (maximum 5 years). On the same day, Roman Storm was arrested in Washington State, and the U.S. Treasury separately designated Roman Semenov as a Specially Designated National. Semenov, a Russian citizen, remains at large as of the time of reporting.- - The indictment alleged that from 2019 to 2022, Storm and Semenov developed, marketed, and operated Tornado Cash with knowledge that a substantial portion of processed funds were criminal proceeds, including funds from the Lazarus Group. The DOJ alleged the protocol facilitated more than $1 billion in money laundering transactions overall.  - Storm's trial in the Southern District of New York concluded on August 6, 2025, with a split verdict: the jury convicted Storm on the count of conspiracy to operate an unlicensed money transmitting business, but deadlocked on the two more serious charges of money laundering conspiracy and sanctions violation conspiracy. The jury deadlock on the more serious counts resulted in no verdict on those charges. Storm was allowed to remain free on bail pending sentencing, with a post-trial motion hearing scheduled for December 18, 2025. Sentencing on the single conviction has not yet been formally scheduled as of the time of this report.

Criminal Conviction: Alexey Pertsev (Netherlands) → (section 15)

- Alexey Pertsev, a Russian national residing in the Netherlands and the third co-founder of Tornado Cash, was arrested in Amsterdam on August 10, 2022 — two days after the OFAC sanctions designation — by Dutch authorities on suspicion of involvement in concealing criminal financial flows and facilitating money laundering through the Tornado Cash protocol. After being held in pretrial detention for approximately eight months, Pertsev stood trial before the 's-Hertogenbosch District Court in the Netherlands.  - On May 14, 2024, the Dutch court found Pertsev guilty of money laundering, specifically determining that he had 'made a habit of committing money laundering' between July 9, 2019 and August 10, 2022 and that he knew the platform was being used for illicit purposes. The court determined that Tornado Cash lacked any barriers to prevent money laundering. Pertsev was sentenced to 64 months (5 years and 4 months) in prison. The court also ordered forfeiture of seized assets, including a Porsche and cryptocurrency worth approximately €1.9 million ($2.1 million), which would not be returned. The approximately eight months Pertsev had already served in pretrial detention were to be deducted from the sentence. Pertsev filed an appeal, and as of early 2026 reporting, he was transferred to supervised release pending that appeal.

Fifth Circuit Ruling and OFAC Sanctions Removal → (section 16)

- In November 2022, a group of Tornado Cash users filed suit against the U.S. Treasury in Van Loon v. Department of the Treasury, challenging OFAC's authority to sanction immutable smart contracts. A federal district court in Texas initially upheld the sanctions in 2023. On November 26, 2024, a unanimous three-judge panel of the U.S. Court of Appeals for the Fifth Circuit reversed the district court's ruling in Van Loon et al. v. Dep't of the Treasury, No. 23-50669. The Fifth Circuit held that Tornado Cash's immutable smart contracts do not constitute 'property' under IEEPA because they cannot be owned, controlled, or altered by any individual or entity, and that OFAC had therefore exceeded its statutory authority in designating them. The court cited the Supreme Court's 2024 ruling in Loper Bright v. Raimondo in declining to defer to OFAC's agency interpretation.  - The Fifth Circuit's ruling left in place the individual sanctions against Roman Semenov as a person. Following the ruling, on March 21, 2025, OFAC officially removed Tornado Cash and its associated addresses from the SDN list, reversing the August 2022 designation. The delisting did not affect the ongoing criminal proceedings against Storm and Semenov, nor the separate Dutch proceedings against Pertsev.

Protocol Use for Illicit Finance and Impact → (section 17)

- According to Chainalysis analysis published at the time of the OFAC designation, Tornado Cash received over $7.6 billion worth of Ethereum since its August 2019 deployment. Approximately 30% of funds processed were tied to illicit actors. Of total volume, roughly 18% originated from sanctioned entities and approximately 11% from funds stolen from other cryptocurrency platforms. Following the August 2022 OFAC sanctions, traffic to Tornado Cash declined by approximately 93% according to on-chain analytics reported by CryptoNews.net. Despite the sanctions, North Korean Lazarus Group hackers were subsequently reported by Elliptic and Recorded Future to have returned to using Tornado Cash after the sanctions period, including in connection with the $1.5 billion Bybit hack in early 2025. The protocol's structure as immutable, autonomous code made it technically impossible for the founding team to block specific wallet addresses after the Trusted Setup Ceremony in 2020, a fact that became central both to the Fifth Circuit's legal reasoning and to Storm's defense at trial.+ 

Implications for Developer Liability → (section 18)

- The Tornado Cash criminal proceedings — particularly the split verdict against Roman Storm in August 2025 — have generated significant debate in the cryptocurrency and legal communities regarding the scope of developer liability for permissionless, open-source protocols. Storm's conviction on the unlicensed money transmitting business count, alongside the jury's deadlock on the money laundering and sanctions counts, was described by some legal commentators as a 'mixed verdict' with significant implications. Storm's defense argued that he was a software developer whose only agreement was to build financial privacy tools, and that holding developers liable for how autonomous code is used sets a dangerous precedent. The DeFi Education Fund, Coin Center, and other advocacy organizations filed amicus briefs or published analysis arguing that the prosecution threatened open-source software development broadly. Conversely, federal prosecutors and the IRS Criminal Investigation division argued that Storm had direct knowledge of illicit use and deliberately chose not to implement available compliance controls.+