The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC), on August 8, 2022, sanctioned virtual currency mixer Tornado Cash. OFAC alleged that it had been “used to launder more than $7 billion worth of virtual currency since its creation in 2019 [, including] over $455 million stolen by the Lazarus Group[,]” a Democratic People’s Republic of Korea (DPRK) state-sponsored hacking group that OFAC identified for sanctions in 2019, in what the agency characterized as the largest known virtual currency heist to date.[1]
OFAC’s action raises novel issues regarding the scope and application of U.S. sanctions on participants in digital asset markets and comes just five months after Tornado Cash co-founder, Roman Semenov, claimed that it would be “technically impossible” for sanctions to be enforced against decentralized protocols. As a decentralized protocol, the Tornado Cash code operates as a self-executing smart contract that activates when predetermined conditions are met, independent of any manual intervention. Some have taken the view that OFAC exceeded its legal authority and that the Tornado Cash action exhibits the tension between existing legal regimes and decentralized finance (DeFi) applications that are largely capable of operating without intermediation by individuals or legal entities.
OFAC imposed sanctions against Tornado Cash pursuant to Executive Order 13694, which permits the agency to take action against persons that have “materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, a cyber-enabled activity originating from, or directed by persons located, in whole or in substantial part, outside the United States that is reasonably likely to result in, or has materially contributed to, a significant threat to the national security, foreign policy, or economic health or financial stability of the United States …” For these purposes, the term “person” means “an individual or entity,” and “entity” is “a partnership, association, trust, joint venture, corporation, group, subgroup, or other organization.”
To effectuate its action, OFAC identified the entity “Tornado Cash,” with aliases “Tornado Cash Classic” and “Tornado Cash Nova,” on its list of Specially Designated Nationals and Blocked Persons (the SDN List) and also included the Tornado Cash website and various digital addresses as “Identifications.” By virtue of its inclusion on the SDN List, all property and property interests of Tornado Cash in the United States, or in the possession or control of U.S. persons, must be blocked and reported to OFAC.[2] In addition, any entities that are at least 50% owned, directly or indirectly, by Tornado Cash are also blocked. Unless authorized by OFAC, U.S. persons are prohibited from transacting, directly or indirectly, with Tornado Cash or in its property or property interests. These prohibitions include contributing or providing funds, goods, or services by, to, or for the benefit of Tornado Cash or facilitating another’s dealings with it. Because OFAC sanctions operate as a strict liability regime, liability can arise irrespective of knowledge or intent to commit a violation.
Tornado Cash is not obviously a separately incorporated legal entity or natural person and, thus, the basis for, and intended target(s) of, OFAC’s action are subject to some uncertainty. Although the agency did not provide an explanation, it appears to have concluded that the Tornado Cash entity now on the SDN List qualifies as a “partnership, association, trust, joint venture, corporation, group, subgroup, or other organization” amenable to sanctions under E.O. 13694.[3] Whatever its legal status may be, the organization may include co-founders, the natural persons participating in a multisignatory (multisig) wallet (which has since disbanded), operators of a Twitter account and a website, and other participants, including a decentralized autonomous organization (DAO) (which recently had only 12 participants in a vote), and TORN token holders.[4] On these facts, OFAC may have considered that some or all of these participants constituted an unincorporated organization of some sort.
Some of the Ethereum addresses identified in the release may be under the control of this organization, potentially including an entity organized and identified as Tornado Cash or at least a group of persons who set out to create and operate Tornado Cash. On the other hand, as Coin Center argues, at least some of the sanctioned addresses that are now blocked are not controlled by persons, as they refer merely to the smart contract itself, which as Coin Center describes “automatically execute[s] when called on by any user in the world giving it the appropriate inputs.” In any event, it is unclear how the identified Ethereum addresses represent property or property interests of Tornado Cash. Representative Tom Emmer (R-MN) made a similar point to Treasury Secretary Janet Yellen in an August 23 letter requesting clarity on the scope of OFAC’s action. Notwithstanding this ambiguity, given that the addresses have been included in OFAC’s notice, any assets held therein or passing through those addresses should be treated as blocked property by U.S. persons until OFAC removes them from the designation.
In looking closely at the potential implications of OFAC’s action, a few questions arise, including the following:
- What does it mean for property and property interests in Tornado Cash, the website tornado.cash, and the named addresses to be blocked and reported to OFAC?
- How is OFAC’s “50% rule” to be applied in this context?
- The designated addresses and website likely do not own other entities, except as such addresses may be associated with the DAO, as explained below. However, given the uncertainty about the Tornado Cash entity that is subject to sanctions, it also is unclear what, if anything, it or any persons associated with the entity owns.
- Beyond the blocking provisions, the applicable prohibitions include prohibition on the provision of funds, goods, or services by, to, or for the benefit of Tornado Cash, and the receipt of funds, goods, or services from Tornado Cash.
- Given the lack of clarity around what (or who) the entity of Tornado Cash is, it remains unclear to whom funds, goods, or services could be contributed or provided to implicate Tornado Cash, other than by nature of interaction with the blocked property or identifiers listed on the OFAC website, including the tornado.cash website and addresses.
Given these substantial uncertainties, it came as no surprise that initial fallout from OFAC’s action has been quick and decisive. The Block reports that Tornado Cash Discord and governance forum pages are no longer accessible, while its email, website, and GitHub code repository pages have also been removed. Meanwhile, centralized blockchain node services, Infura and Alchemy, have also blocked access to the mixer’s front-end website, and Circle has frozen all USD Coin (USDC) that was in the sanctioned addresses (disallowing receipt or transfer of USDC funds on-chain from that address). The response from the DeFi community has, unsurprisingly, been generally negative (including following the arrest of a Tornado Cash developer in the Netherlands).[6]
We will continue monitoring developments and provide additional updates as warranted.
[1] According to Chainalysis, since becoming active in August 2019, Tornado Cash has received over $7.6 billion worth of Ethereum, 18% of which is from sanctioned entities (noting that these transactions were “almost entirely” before the entities were sanctioned) and 11% of the funds were “stolen from other cryptocurrency services and protocols.”
[2] Entities that are owned, directly or indirectly, 50%or more by one or more of the sanctioned parties are also blocked.
[3] Application of sanctions to informal and/or decentralized organizations is not without precedent. For example, many terrorist groups and drug cartels are similarly lacking in formal organizational structure and are nonetheless sanctioned as “groups” or “other organizations” under relevant sanctions authorities. However, the practical application of sanctions blocking provisions to those organizations can be difficult to implement for this reason, as it is proving to be the case with this designation.
[4] As a point of comparison, FinCEN (which is a separate agency within the Treasury Department’s Office of Terrorism and Financial Intelligence), issued guidance in 2019 taking the position that persons who develop or deploy a decentralized application may “qualify as []money transmitter[s] under the [Bank Secrecy Act],” as may “persons who use the DApp to conduct certain financial activities.” U.S. Dep’t of the Treasury Fin. Crimes Enf’t Network, Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies, FIN-2019-G0001, p. 27 (May 9, 2019) (last accessed Aug 29, 2022).
[5] As the governance token of Tornado Cash, TORN gives its holders voting rights to decide the protocol’s upgrades and other developments.
[6] See e.g., Jerry Brito and Peter Van Valkenburgh, “U.S. Treasury sanction of privacy tools places sweeping restrictions on all Americans”, https://www.coincenter.org/u-s-treasury-sanction-of-privacy-tools-places-sweeping-restrictions-on-all-americans/; Shalini Nagarajan, “Tornado Cash Developer’s Arrest Sparks Protest in Amsterdam”, https://blockworks.co/tornado-cash-developers-arrest-sparks-protest-in-amsterdam/
[View source.]
