本周回顾:2026 年 8 月 6 日 – 8 月 12 日本周动态
美国 | 写 DeFi 代码算不算犯罪?一场重审将见分晓
最重要、却常被忽视的加密案件是 美国诉 Roman Storm——他是隐私工具 Tornado Cash的开发者。2025 年,陪审团认定他 经营无牌照的资金传输业务,但在更严重的洗钱和违反制裁两项指控上未能达成一致。如今司法部正推动 对这两项重审,预计 2026 年 10 月前后开庭,两项合计最高可能再加 40 年刑期。核心问题——开发者是否要为他人滥用其代码而承担刑责——将决定 DeFi 与隐私领域“什么能做”。详见下方“焦点案件”。
美国 | 稳定币“奖励”模式面临被砍——Circle 和 Coinbase 首当其冲
落实 GENIUS 法(美国稳定币法)的细则正在成形,而且比业界预期更严。银行监管机构(OCC)提出了完整框架,要求 周报和季报;财政部的金融犯罪部门(FinCEN/OFAC)也就反洗钱提出了拟议规则。对业务打击最大的一点是:对稳定币 “奖励/返息”的限制——这正是支撑 Circle–Coinbase 合作 的收益分成,也是 Coinbase 的一大收入来源。如果你靠“付钱让用户持有稳定币”来赚钱,这一模式现在有风险。
美国 | SEC 决定自己来写加密规则(8 月 14 日)
由于国会陷入僵局,SEC 定于 8 月 14 日就其自己的规则手册“Regulation Crypto”投票。方案给出三条“无需完整注册即可募资”的路径:约 500 万美元的初创路径、最高 7500 万美元、需审计和定期报告的路径,以及面向真正去中心化代币的 “安全港”。这是从“靠打官司立规矩”转向“把规矩写下来”——但在投票和公众意见征询完成前,一切都未定。
美国 | CLARITY 法案推迟到 9 月
这部将在 SEC 与 CFTC 之间划分监管权的法案,错过了休会前的表决;参议院首次实质表决现定于 9 月 15 日。争议点包括:一条禁止高级官员(含总统)涉足加密生意的道德条款,以及稳定币奖励能否保留。博彩市场认为 2026 年通过的概率约三分之一。一个值得注意的新动向:8 月 5 日,SEC 还新设了一个专攻 会计与财务报告欺诈 的执法小组——虽非加密专属,但预示上市加密公司的财报将受到更严格审视。
中国 / 香港 / 欧洲 | 其余版图,简要一览
中国 维持强硬立场——私人加密被禁,禁令现已覆盖与人民币挂钩的稳定币和代币化资产,境内境外皆然。香港 走的是相反路线:建立持牌市场,首批银行背景的稳定币发行人(汇丰,以及渣打牵头的合资企业)预计 2026 年下半年推出。而在 欧洲,MiCA 的过渡期已结束——面向欧盟客户必须持牌,否则须停止(罚款最高可达年营业额的 12.5%)。
焦点案件:美国诉 Roman Storm(Tornado Cash)
本周值得细读的一个案子——它将检验、编写并发布加密代码本身,是否可能构成犯罪。
简要版。
Tornado Cash 隐私工具的开发者 Roman Storm 即将再度受审。此案可能决定:编写并发布开源代码,是否会因为陌生人日后如何使用它,而让你入狱。
发生了什么。
2025 年,纽约一个陪审团认定 Storm 经营无牌照资金传输业务,但在两项最严重的指控——洗钱共谋和违反美国制裁——上未能达成一致。2026 年 3 月,司法部申请重审这两项;重审预计 在 2026 年 10 月前后 进行,最高可能再加 40 年刑期。
为什么重要。
Tornado Cash 是“自主运行”的软件——一旦部署,开发者无法控制谁来使用。检方称 Storm 明知而帮助清洗犯罪资金(包括为某国家背景的黑客组织)。辩方则称此案是 “对隐私、也是对写代码的可怕刑事化”。判决将为全球 DeFi 与隐私开发者划定边界。
对开发者意味着什么。
如果“发布了不可更改、却被他人滥用的代码”也能构成犯罪,那么每一个 DeFi、混币器、隐私团队都面临 个人刑事风险——并可能不得不加入他们曾视为“与去中心化背道而驰”的管控(制裁筛查、前端限制)。
结论。
不要以为“我只是写了代码”就是完整的抗辩。留存你的合规意图记录,在力所能及处做筛查,并在推出可匿名转移价值的工具前先咨询律师。
监管雷达 — Web3
阴影行为本周新增;无阴影行为持续跟踪项。
日期: 约 10 月(重审) | 地区: 美国
事件: 美国诉 Roman Storm(Tornado Cash)—司法部申请重审
状态: 新增 — 进行中
对公司意味着什么: 检验“写 DeFi/隐私代码是否犯罪”;开发者刑事风险
日期: 进行中 | 地区: 美国
事件: GENIUS 细则威胁稳定币“奖励”(OCC 框架;FinCEN/OFAC 反洗钱)
状态: 新增 — 进行中
对公司意味着什么: 收益分成(Circle–Coinbase)受威胁;须周报/季报
日期: 8 月 5 日 | 地区: 美国
事件: SEC 新设会计/财报欺诈执法小组
状态: 新增
对公司意味着什么: 上市加密公司财报将受更严审视
日期: 8 月 14 日 | 地区: 美国
事件: SEC 就自有规则手册(“Regulation Crypto”)投票
状态: 待表决
对公司意味着什么: 近期规则可能来自监管机构,而非国会
日期: 9 月 15 日 | 地区: 美国
事件: CLARITY 法案 — 参议院首次表决
状态: 法案 — 推迟
对公司意味着什么: 入秋前不会有新的市场结构法
日期: 7 月 18 日 | 地区: 美国
事件: GENIUS 稳定币最终细则仍未完成
状态: 已逾期
对公司意味着什么: 按草案标准准备:足额储备、每月审计、不得付息
日期: 已生效 | 地区: 中国
事件: 禁令扩至人民币稳定币 + 代币化资产
状态: 已生效
对公司意味着什么: 不要发行人民币挂钩稳定币,境外也不行
日期: 2026 下半年 | 地区: 香港
事件: 首批银行背景稳定币(汇丰、渣打合资)
状态: 跟踪中
对公司意味着什么: 持牌路径——与内地禁令相反
日期: 7 月 1 日 | 地区: 欧盟
事件: MiCA 过渡期结束
状态: 已生效
对公司意味着什么: 面向欧盟客户必须持牌,否则停止
Joanna 律师观察
多年来,美国加密领域的核心问题一直是“这个代币算不算证券?”而本周,这场博弈转向了更“对人”、也对开发者更危险的方向。Tornado Cash 重审追问:写加密代码的人,会不会因别人如何使用而入狱。GENIUS 稳定币细则则追问:让加密真正赚钱的 商业模式(比如付给用户收益)是否还能存活。再加上 SEC 因国会僵局而自己动手写规则——主线已经清晰:焦点正从“什么能卖”转向“谁要为构建它负责,以及哪些商业模式被允许存在。”
由此有两条现实教训。第一,个人与刑事风险如今落在开发者和高管身上,而不只是公司。第二,不要把生意建立在监管正设法“关掉”的某个特性上——无论是匿名,还是收益。
— Joanna 观察
给 Web3 / 加密公司的合规行动简要
如果你做 DeFi、隐私或混币工具,请把 Tornado Cash 案当作警示:“我只是写了代码”未必能保护你。留存合规意图记录,在力所能及处(至少在前端)加入制裁筛查,并在推出可匿名转移价值的工具前先咨询律师。如果你的业务依赖 稳定币收益或奖励,要为该模式被限制做好准备——GENIUS 细则和 CLARITY 之争都盯着它。在美国,总体上应把代币与募资设计成契合 SEC 即将出台的“Regulation Crypto”,并记住:监管机构定的规则,也可能被推翻。对 中国,把人民币挂钩稳定币和代币化资产视为禁区,境内境外皆然。对 香港,确认发行、交易或持有稳定币是否需要牌照。对 欧洲,确认你的 MiCA 牌照——过渡期已结束。
AI 合规 | Web3 与数字资产 | 为出海科技公司提供法律支持。
本简报仅为一般信息,不构成法律意见。如需 AI 法律治理或 Web3 与数字资产合规支持,请联系我们的律师。
English Edition
Web3 & Digital Assets Regulation Weekly
Compliance notes for cross-border fintech companies going global
Week in Review: August 6 – August 12, 2026
This Week's Developments
United States | Is writing DeFi code a crime? A retrial will test it
The most important crypto case you may not be tracking is U.S.v. Roman Storm, a developer of the privacy tool Tornado Cash. A jury convicted him in 2025 of running an unlicensed money-transmitting business, but deadlocked on the more serious money-laundering and sanctions charges. The Justice Department is now pushing to retry those counts, expected to start around October 2026, with up to 40 more years at stake. The core question — can a developer be criminally liable for code others misuse? — will shape what's legal to build in DeFi and privacy. See the Case in Focus below.
United States | Stablecoin “rewards” under threat — Circle and Coinbase in the crosshairs
The rules to implement the GENIUS Act (the U.S. stablecoin law) are taking shape, and they're stricter than issuers hoped. The bank regulator (OCC) proposed a full framework with weekly and quarterly reporting, and Treasury's financial-crime units (FinCEN/OFAC) proposed anti-money-laundering rules. The biggest business threat: limits on stablecoin “rewards” — the yield-sharing that powers the Circle–Coinbase partnership and a major Coinbase revenue source. If you earn by paying users to hold a stablecoin, that model is now at risk.
United States | The SEC decides to write crypto rules itself (Aug 14)
With Congress stalled, the SEC set an August 14 vote to launch its own rulebook, “Regulation Crypto.” It offers three ways to raise money without full registration: a ~$5M startup path, a ~$75M path with audits and regular reporting, and a “safe harbor” for genuinely decentralized tokens. It's a shift from “rules by lawsuit” to “rules written down” — but nothing is final until the vote and the public-comment period.
United States | The CLARITY Act slips to September
The bill that would split oversight between the SEC and CFTC missed its pre-recess vote; the first real Senate vote is now September 15. Sticking points include an ethics rule barring senior officials — including the President — from crypto ties, and whether stablecoin rewards survive. Betting markets put 2026 passage at about one in three. A new detail worth noting: on August 5 the SEC also created a specialized unit targeting accounting and financial-reporting fraud — not crypto-specific, but a sign that public crypto companies' financial statements will get sharper scrutiny.
China / Hong Kong / Europe | The rest of the map, in brief
China holds its hard line — private crypto is banned, and the ban now covers yuan-linked stablecoins and tokenized assets, onshore and offshore. Hong Kong is building the opposite: a licensed market, with the first bank-backed stablecoin issuers (an HSBC and a Standard Chartered–led venture) expected in late 2026. And in Europe, the MiCA grace period is over — serve EU customers only with a licence, or stop (fines reach 12.5% of yearly turnover).
Case in Focus: U.S. v. Roman Storm (Tornado Cash)
This week's case worth reading closely — the test of whether writing and publishing crypto code can itself be a crime.
The short version.
Roman Storm, a developer of the crypto-privacy tool Tornado Cash, is heading back toward trial in a case that could decide whether writing and releasing open-source code can put you in prison for how strangers later use it.
What happened.
In 2025 a New York jury convicted Storm of running an unlicensed money-transmitting business, but couldn't agree on the two most serious charges — money-laundering conspiracy and violating U.S. sanctions. In March 2026 the Justice Department asked to retry those counts; a retrial is expected around October 2026, with up to 40 additional years of exposure.
Why it matters.
Tornado Cash is “autonomous” software — once deployed, its developers can't control who uses it. Prosecutors say Storm knowingly helped launder criminal funds (including for a state-backed hacking group). The defense calls the case a “terrifying criminalization of privacy” and of writing code. The verdict will set the boundary for DeFi and privacy developers everywhere.
The stakes for builders.
If publishing immutable code that others misuse can be a crime, every DeFi, mixer, and privacy team faces personal criminal exposure — and may need to build in controls (sanctions screening, front-end restrictions) they once saw as the opposite of decentralization.
Bottom line.
Assume “I just wrote the code” is not a complete defense. Document your compliance intent, screen where you can, and get legal advice before launching tools that move value anonymously.
Regulatory Radar — Web3
Shaded rows are new this week; unshaded rows are kept for tracking.
Date: ~Oct (retrial) | Region: U.S.
Development: U.S. v. Roman Storm (Tornado Cash) — DOJ seeks retrial
Status: NEW — active
What it means for companies: Tests whether writing DeFi/privacy code is a crime; developer criminal liability
Date: Ongoing | Region: U.S.
Development: GENIUS rules threaten stablecoin “rewards” (OCC framework; FinCEN/OFAC AML)
Status: NEW — active
What it means for companies: Yield-sharing (Circle–Coinbase) at risk; weekly/quarterly reporting
Date: Aug 5 | Region: U.S.
Development: SEC creates accounting / financial-reporting fraud unit
Status: NEW
What it means for companies: Sharper scrutiny of public crypto companies' financials
Date: Aug 14 | Region: U.S.
Development: SEC votes on its own rulebook (“Regulation Crypto”)
Status: Vote due
What it means for companies: Near-term rules may come from the regulator, not Congress
Date: Sep 15 | Region: U.S.
Development: CLARITY Act — first Senate vote
Status: Bill — delayed
What it means for companies: No new market-structure law before the fall
Date: Jul 18 | Region: U.S.
Development: GENIUS stablecoin final rules still unfinished
Status: Missed
What it means for companies: Plan against the draft: full backing, monthly audits, no interest
Date: In force | Region: China
Development: Ban extended to yuan stablecoins + tokenized assets
Status: In force
What it means for companies: Don't issue yuan-linked stablecoins, even offshore
Date: H2 2026 | Region: Hong Kong
Development: First bank-backed stablecoins (HSBC, StanChart venture)
Status: Ongoing
What it means for companies: A licensed path — the opposite of the mainland ban
Date: Jul 1 | Region: EU
Development: MiCA grace period over for crypto firms
Status: In force
What it means for companies: Serve EU customers only with a licence, or stop
Joanna Lawyer's Observation
For years, the defining U.S.crypto question was “is this token a security?” This week the fight moved somewhere more personal — and more dangerous for builders. The Tornado Cash retrial asks whether the people who write crypto code can go to prison for how others use it. The GENIUS stablecoin rules ask whether the business models that make crypto profitable — like paying users yield — can even survive. Add the SEC writing its own rulebook because Congress stalled, and the through-line is clear: the action has shifted from “what is legal to sell” to “who is liable for building it, and which business models are allowed to exist.”
Two practical lessons follow. First, personal and criminal exposure now sits on developers and executives, not just on companies. Second, don't build a business on a feature — anonymity, or yield — that regulators are actively trying to switch off.
— Joanna's Observation
Compliance Actions for Web3 / Crypto Companies
If you build DeFi, privacy, or mixing tools, treat the Tornado Cash case as a warning: “I only wrote the code” may not shield you.Document your compliance intent, add sanctions screening where you can (at least at the front end), and get legal advice before shipping tools that move value anonymously. If your business relies on stablecoin yield or rewards, plan for that model to be restricted — the GENIUS rules and the CLARITY fight both target it. In the U.S. generally, design your token and fundraising to fit the SEC's coming “Regulation Crypto,” and remember rules made by a regulator can be undone. For China, treat yuan-linked stablecoins and tokenized assets as off-limits, onshore and offshore. For Hong Kong, check whether issuing, trading or holding stablecoins needs a licence. For Europe, confirm your MiCA licence — the grace period is over.
Watch Next Week
The CLARITY Act's September 15 Senate vote and the reaction to the SEC's August 14 “Regulation Crypto” vote; scheduling and pretrial motions in the Tornado Cash retrial; and the comment periods on the GENIUS stablecoin rules — especially the limits on “rewards.”
AI compliance | Web3 & digital assets | Legal support for technology companies going global.
This briefing is for general information only and is not legal advice. If you are seeking AI legal governance or Web3 & digital-assets compliance, please reach out to our lawyers.
/ END.
*本文为上海曼昆律师事务所的原创文章，仅代表本文作者个人观点，不构成对特定事项的法律咨询和法律意见。如需转载及法律咨询，请添加客服：mankunlawyer。
关于律师
