The Office of Foreign Assets Control (OFAC) recently made the unprecedented move of sanctioning a smart contract — a decentralized digital currency mixer called “Tornado Cash” — along with certain cryptocurrency addresses associated Tornado Cash. OFAC added Tornado Cash and its U.S.-based digital asset and smart contract addresses to its Specially Designated Nationals and Blocked Persons (SDN) list. This action is unprecedented because Tornado Cash is a decentralized protocol and not a person or company. It is therefore unclear what the repercussions will be for those deemed by OFAC to be affiliated with Tornado Cash, which is software code without a centralized owner. However, with OFAC’s SDN designation, U.S. entities must screen assets and counterparties to ensure that they are not affiliated with Tornado Cash.
OFAC alleges that, since 2019, over $7 billion in cryptocurrency has been laundered (including by North Korea to evade U.S. sanctions) using Tornado Cash’s protocol, which mixes or blends transactions to mask the source and flow of the transaction on the Ethereum blockchain. This is attractive to those wishing to transact anonymously.
It is unclear whether OFAC has the statutory authority to sanction a non-person; however, OFAC is clearly going to attempt to do so in an effort to staunch the alleged illicit activity using Tornado Cash. This is sure to raise concerns of privacy advocates, as not all users of Tornado Cash are conducting illegal activity and simply wish to anonymize their legitimate and legal transactions. For example, Ethereum co-founder Vitalik Buterin provided that he recently used Tornado Cash to support efforts in Ukraine. It is clear that this type of service can be helpful in providing for the safety of the sender and the receiver of funds. This is not an inconsequential point, given the massive — and escalating — data breaches that have compromised an alarming quantity of personal identifiable information (PII). Year to date, PII has been stolen from numerous prominent organizations in the U.S., including healthcare systems, financial institutions, and agencies at all levels of government.
However, OFAC has previously noted in its Sanctions Compliance Guidance for the Virtual Currency Industry, issued in October 2021 that the inclusion of virtual currency addresses on the SDN List may assist the industry in identifying other virtual currency addresses associated with blocked persons. Moreover, in its press release, OFAC warned, “[M]ixers should in general be considered as high-risk by virtual currency firms, which should only process transactions if they have appropriate controls in place to prevent mixers from being used to launder illicit proceeds.”
Software code and how one spends money are protected speech activities under the First Amendment, and OFAC may face challenges in levying its sanctions if challenged in court on these grounds. Decentralized finance (DeFi) is still unregulated, so agencies like OFAC are attempting to combat the illicit activity it normally combats through more traditional financial channels. Further, while fear of OFAC sanctions are already chilling the use of Tornado Cash, its services cannot be shut down since they run in a decentralized manner. Other decentralized mixing protocols can be setup, and it is unclear what OFAC’s long-term strategy might be other than to chill the desire of programmers to build similar protocols with similar capabilities.
Interestingly, a man alleged to be the developer of the Tornado Cash protocol was arrested in Amsterdam. It is unclear what liability may be alleged and ultimately imposed on a developer for unknown third parties using his protocol for illicit purposes when the developer ultimately cannot control how others use the protocol.
[View source.]
