Tornado Cash

As of September 2026: The retrial of Roman Storm on the money laundering and sanctions counts is scheduled for April 26, 2027, and the charges have not been dropped. His acquittal motion is undecided and no sentence has been imposed. The US$7 billion figure is OFAC's 2022 estimate.

Also known as: Roman Storm case · Van Loon v. Treasury.

What happened?

Tornado Cash was not a company with a customer service line. It was a set of Ethereum smart contracts, launched in 2019, that worked like a shared pool. Users deposited crypto into the pool from one address and later withdrew the same amount to a different, fresh address. Because many deposits sat in the pool together, an observer could not easily tell which withdrawal belonged to which deposit.

For privacy-minded users, that was the point. For thieves, it was a way to break the trail on stolen coins. On August 8, 2022, the US Treasury’s Office of Foreign Assets Control sanctioned the protocol, saying it had been used to launder more than US$7 billion since 2019. Among the examples OFAC gave: over US$455 million taken in the largest known crypto heist, attributed to North Korea’s Lazarus Group, plus proceeds from two 2022 bridge hacks. It was the first time the US had sanctioned a decentralized protocol instead of a named person or business.

Which techniques did it use?

The core technique is the mixer, which attacks the transparency of a public blockchain. Ordinarily every transfer is visible and can be traced. Pooling and re-emitting funds is a form of layering: it puts distance between the origin of the coins and their eventual destination.

Tornado Cash differed from earlier mixers in one way that shaped the whole case. Older services such as Bitcoin Fog took custody of coins and were run by identifiable operators. Tornado Cash’s contracts, once deployed, ran on their own and could not be altered. There was no account to close and no operator to serve. Mixing is usually one step in a longer chain, followed by swaps across networks, described in the glossary entry on chain-hopping.

How was it found?

The laundering was visible precisely because blockchains are public. Analytics firms and government investigators traced stolen funds to the pool’s deposit addresses, then watched for withdrawals that followed. OFAC’s designation listed the contract addresses, so every compliant exchange and service could screen against them.

Prosecutors later charged Tornado Cash co-founder Roman Storm, a developer, alleging he conspired to launder money, to evade sanctions and to operate an unlicensed money transmitting business. The theory was that the service knew criminals were using it and kept operating it anyway.

What was the outcome?

The result so far is split, and it is still moving.

The sanctions lost ground. In Van Loon v. Department of the Treasury, decided November 26, 2024, the Fifth Circuit held that Tornado Cash’s immutable smart contracts are not “property” of a foreign national under the sanctions statute, so OFAC had exceeded its authority. On March 21, 2025, Treasury removed Tornado Cash from its sanctions list, describing the step as its own decision instead of a concession to the court.

The prosecution partly succeeded. In August 2025 a New York jury convicted Roman Storm of conspiracy to operate an unlicensed money transmitting business. It could not agree on the money laundering conspiracy count or the sanctions conspiracy count. Prosecutors chose to retry them. The retrial, first sought for October 2026, is now set for April 26, 2027. Storm’s motion for acquittal, argued in April 2026, has not been decided, and he has not been sentenced.

What were the warning signs?

Even for a tool with no operator to question, exchanges and investigators had clear signals to work with.

• Deposits from wallets tied to known thefts. OFAC linked over US$455 million from the largest known crypto heist to the pool, and other hack proceeds followed.
• Sudden inflows after an exploit. A hacker’s address that empties into a mixer within hours is a standard alert for exchange compliance teams.
• Withdrawals that arrive at an exchange. When mixed coins reach a regulated platform, the platform can screen the source and freeze or refuse the deposit.
• Use as one step in a longer chain. Mixing followed by swaps across networks and a cash-out is the pattern that turns a privacy tool into a laundering route.

None of these signs proves that a given user is a launderer. Privacy tools have lawful users, which is exactly why the legal fight over them is unsettled.

What changed afterwards?

The case exposed a gap that the law had not planned for. Anti-money-laundering rules are built around intermediaries: banks and exchanges that hold customer funds, know their customers and file reports. A protocol with no custodian and no operator fits none of those boxes. The Fifth Circuit’s ruling limits how far sanctions can reach code, and the Storm prosecution is testing how far criminal law can reach the people who write it.

Both sides of that argument have a point. Developers warn that a conviction could chill lawful privacy tools. Investigators point to the stolen funds that passed through the pool and note that a tool with no compliance function serves criminals as readily as it serves the privacy-minded. Until the retrial resolves, regulators are relying on the parts of the system that do have controls: exchanges that screen addresses and the takedown of mixers that did keep custody. For how those controls fit together, see the detection overview.

First published September 21, 2026 · Last updated September 21, 2026 · Legal statuses current as of September 2026