Tornado Cash Mixer Founder Sentenced: Crypto Enthusiasts Hold Mixed Feelings
By Mankun Law Firm
AI summary
The decentralization of Web3 technology does not imply that developers and companies are also decentralized.
Contents
The decentralization of Web3 technology does not imply that developers and companies are also decentralized.
In May 2024, Alexey Pertsev, a 31-year-old Russian citizen, co-founder and core developer of Tornado Cash, was sentenced in the Netherlands to five years and four months in prison for laundering $2.2 billion through the cryptocurrency mixing platform.Previously, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced the sanctioning of Tornado Cash, alleging that it assisted hackers and criminals in money laundering, including the laundering of funds by the Lazarus Group, a hacker organization linked to North Korea. U.S. users of Tornado Cash were prohibited from using the platform, and U.S. blockchain companies and projects were barred from transacting or interacting with Tornado Cash. The U.S. Department of Justice (DOJ) and other regulatory authorities brought criminal charges against Tornado Cash founders Roman Storm and Roman Semenov, accusing them of conspiring to launder money, violating sanctions, and operating an unlicensed money transmitting business during the operation of Tornado Cash. The two face at least 20 years in prison. Storm was arrested last year and is scheduled for trial in September this year, while Semenov has not yet been arrested. The verdict in Pertsev’s case is likely to influence the future trial outcomes for these two Tornado Cash founders.It is not only the Netherlands and the United States that have adopted an unwelcoming stance toward Tornado Cash, or even taken enforcement actions.GermanyOn August 20, 2022, the German Federal Financial Supervisory Authority (BaFin) investigated Tornado Cash, determining that it failed to comply with anti-money laundering regulations, and issued warnings and fines.FranceOn September 5, 2022, the French National Commission on Informatics and Liberty (CNIL) reviewed Tornado Cash’s privacy policy, finding that it failed to effectively protect user privacy, and imposed sanctions.JapanOn September 15, 2022, the Japanese Financial Services Agency (FSA) reviewed Tornado Cash, concluding that it might be used for illegal activities, and issued a warning letter requiring improvements to its anti-money laundering measures.South KoreaOn October 1, 2022, the South Korean Financial Services Commission (FSC) blacklisted Tornado Cash, prohibiting South Korean citizens from using the service and investigating its potential money laundering activities.CanadaOn October 20, 2022, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) investigated Tornado Cash, highlighting money laundering risks and recommending strengthened regulation.AustraliaOn November 1, 2022, the Australian Transaction Reports and Analysis Centre (AUSTRAC) monitored Tornado Cash, warning that it might be exploited by criminals for money laundering activities.Why has a blockchain project been successively banned by multiple countries? Is this the erosion of privacy or the decline of technology? In this article, Attorney Liu Honglin of Mankun Law Firm guides crypto community members through an exploration of these issues.
What Is the Tornado Cash Mixer?
Tornado Cash is a decentralized mixing service based on Ethereum that pools users’ deposits via smart contracts before redistributing them, thereby rendering the source of funds untraceable. Tornado Cash was created on August 6, 2019, by developers Roman Semenov and Roman Storm, aiming to enhance the privacy of Ethereum transactions and enable users to “send Ethereum cryptocurrencies with 100% anonymity.” The core team includes members such as Alexey Pertsev, who possess extensive experience in privacy protection and decentralized technologies.Since its launch, Tornado Cash has continuously iterated and improved, releasing various versions that support different cryptocurrencies. It has gradually developed into a well-known privacy tool within the cryptocurrency community. At its peak in July 2021, Tornado Cash pool contracts held more than $700 million worth of ETH.In simple terms, the operational logic of Tornado Cash is as follows: it commingles the deposit and withdrawal activities of numerous users. After depositing tokens into Tornado Cash, a depositor presents a zero-knowledge proof (ZK Proof) to demonstrate that a deposit was made, and then withdraws funds using a new address, thereby severing the link between the deposit and withdrawal addresses.To ensure that deposit and withdrawal actions appear homogeneous, Tornado Cash maintains consistent amounts for each deposit and withdrawal within its pools. For example, in a pool with 100 depositors and 100 withdrawers, the amount deposited and withdrawn by each individual is identical. This prevents associations from being determined based on transaction amounts, thereby obscuring traces of fund transfers.Breaking down the steps, the general process is as follows:
User Deposit.The user deposits Ether (ETH) into the Tornado Cash smart contract, generating a secret note.
Mixing Process.The smart contract pools deposits from multiple users, forming a fund pool.
Fund Withdrawal.The user withdraws funds using the note, with the withdrawn funds not directly linked to the deposit address.
Tornado Cash functions like a piggy bank: ten people simultaneously deposit 100 yuan each and receive deposit receipts; later, the same ten people simultaneously withdraw 100 yuan each using their receipts. Because the currency itself is non-named, we cannot precisely associate the depositors with the withdrawers. This is precisely the key reason why governments and regulatory agencies worldwide find it challenging.
Regulatory Crackdowns
Of course, Tornado Cash is not the only concern for governments and regulatory agencies; similar mixers such as CoinJoin, Mixing services, and Wasabi Wallet also pose challenges. As innovation in the crypto space continues, regulators remain troubled.In 2024, the U.S. Senate passed an amendment to the National Defense Authorization Act for Fiscal Year 2024 (FY24 NDAA), with a total budget of $886 billion. One provision aims to strengthen oversight of financial institutions engaged in cryptocurrency transactions and combat crypto assets designed to “increase anonymity,” such as cryptocurrency mixers. The amendment was jointly introduced by Senators Elizabeth Warren (Democrat) and Roger Marshall (Republican), both prominent critics of cryptocurrencies. Bill Hughes, a lawyer at ConsenSys, a Web3 infrastructure developer, described this as “one of the most significant congressional actions regarding crypto assets to date.”Why do regulators focus so intensely on and continuously crack down on mixers? The main reasons include:Anti-Money Laundering Issues.Due to its anonymity, Tornado Cash has been widely used for money laundering activities. For instance, the indictment issued by Dutch judicial authorities stated that Alexey Pertsev, a developer of the Tornado Cash cryptocurrency mixing service, was charged with participating in money laundering activities involving up to $1.2 billion. The indictment listed 36 suspected money laundering transactions on the Tornado Cash platform, including one transaction involving 175 ETH. These funds were believed to be related to the Ronin Bridge hack. On March 23, 2022, the Axie Infinity Ronin sidechain bridge suffered losses of approximately $625 million due to a hacker attack, marking one of the largest cryptocurrency hacks to date. The criminals laundered the proceeds through Tornado Cash.Terrorist Financing.The anonymity provided by Tornado Cash has also been exploited by terrorist organizations for secret fundraising activities. Law enforcement agencies are concerned that such anonymous transaction methods make it easier for terrorists to obtain funds without detection. For example, in 2021, evidence indicated that certain terrorist organizations raised substantial funds through cryptocurrency mixing services.Sanctions Evasion.Certain countries or individuals have used Tornado Cash to evade international sanctions by transferring funds through anonymous cryptocurrency transactions. For example, the North Korean hacker group Lazarus Group has been accused of transferring funds obtained from cyberattacks through Tornado Cash, thereby avoiding tracking under international sanctions.
Crypto Enthusiasts: A Love-Hate Relationship
In contrast to government agencies, crypto enthusiasts favor mixers because they satisfy some users’ desire for privacy protection and financial security.Tornado Cash and similar mixers provide robust privacy protection features. For certain high-net-worth individuals in the crypto space, using mixers can help avoid becoming targets of hacker attacks or extortion due to public transaction records. Meanwhile, certain activists or journalists operating under oppressive regimes may need to use mixers to prevent governments or other organizations from discovering the sources and uses of their funds. Consequently, when Tornado Cash developers faced charges, a defense fund was specifically established for them, with notable figures publicly expressing support. For instance, former U.S. National Security Agency (NSA) whistleblower Edward Snowden publicly endorsed the legal defense fund for Tornado Cash developers Roman Storm and Alexey Pertsev, which has raised over $350,000 to date.Of course, everything has two sides; those seeking to conceal their identities and tracks are not always good actors.The most typical scenario arises in cases involving cryptocurrency theft. Clients often approach Mankun Law Firm after having their virtual assets stolen. Following our on-chain analysis, if we discover that the thief used a mixer, we often lament that the situation is dire. Once cryptocurrencies are stolen and mixed through a mixer, tracing and recovering the stolen assets becomes extremely difficult. For example, in the Ronin Bridge hack, the attackers mixed the illicit proceeds through Tornado Cash, making it nearly impossible to trace the flow of funds, ultimately resulting in irrecoverable losses.Beyond the risk of asset loss, from a legal compliance perspective, the greatest risk for users of mixers is that using Tornado Cash and other mixers may violate anti-money laundering and counter-terrorist financing laws in certain countries. As Tornado Cash and other mixers are closely monitored by regulatory agencies, if they are sanctioned or shut down, users’ funds may be frozen or become unrecoverable. For example, OFAC sanctions prevented many Tornado Cash users from withdrawing their funds, causing significant losses.Therefore, individual users should understand and comply with the laws and regulations of their respective countries before using any mixing service to avoid legal risks associated with mixer usage. It is also advisable to carefully select reputable mixing services with strong security measures and to avoid using services that have been sanctioned or are controversial. Furthermore, users should not allocate all their funds to a single mixing service. Diversifying through multiple channels can help mitigate risks. If any risks or issues are identified, timely measures should be taken.In April 2023, the U.S. Department of the Treasury released an assessment report on illicit financial activities in DeFi. This report revealed potential risks in DeFi services and provided an in-depth analysis of how illicit actors exploit these services for criminal activities. Three months later, four U.S. senators proposed the Digital Asset Anti-Money Laundering Act, aiming to strengthen regulation in the areas of Know Your Customer (KYC), Anti-Money Laundering (AML), and DeFi.The Digital Asset Anti-Money Laundering Act provides a new framework for regulating DeFi. It requires that DeFi be regulated similarly to other cryptocurrency entities, mandating that any “person” capable of controlling a project must be held accountable for that project. The bill suggests that if no specific person controls a DeFi service, any investor who invests more than $250,000 in the project should be held responsible for it.For technical developers of mixers, although decentralized technology services are neutral, your company and you personally belong to specific nations in the real world. Therefore, it is recommended that before engaging in related businesses, you ensure that the development and operation of mixing services comply with the laws and regulations of your respective countries and regions. Strengthen platform security measures to prevent hacker attacks and fund theft, safeguard user funds, and avoid becoming targets of legal enforcement.
Reminder from Mankun Law Firm
Tornado Cash has gained popularity among many cryptocurrency users due to its strong anonymity and privacy protection features. However, this very anonymity has made it a primary target for law enforcement agencies. Today, as the crime of aiding information network criminal activities has become one of the top three criminal offenses in China, cryptocurrency users and technology developers must remain vigilant while enjoying the conveniences brought by technology. Compliance with laws and regulations is essential; after all, in the dark forest of the crypto world, extra caution is always prudent.
This article is an original work of Mankun Law Firm. It represents only the personal views of the author and does not constitute legal consultation or legal advice on specific matters.
