On November 26, 2024, the US Court of Appeals for the Fifth Circuit ruled that “immutable” smart contracts are not “property” for purposes of regulation by the US Department of the Treasury’s Office of Foreign Assets Control (OFAC). The decision invalidates a 2022 Biden administration executive order designating “notorious” digital asset mixer Tornado Cash a Specially Designated National (SDN) under Executive Order (EO) 13694 and EO 13722.

While there has been much speculation about the incoming administration’s approach to sanctions, the Fifth Circuit’s opinion in Joseph Van Loon, et al. v. Department of the Treasury marks a surprising reversal of a District Court decision from 2023, and deals a blow to the current administration’s ongoing regulatory efforts over blockchain and digital asset market participants. While the ruling may force a circuit split with a separate case litigating similar issues pending in the Eleventh Circuit, for now the Van Loon ruling represents a major victory for decentralized finance (defi) advocates and a rare but significant setback to OFAC’s historically broad regulatory power.

The new ruling also spells trouble for the administrative state more broadly, invoking the recent gutting of Chevron deference in support of its holding.

OFAC Sanctions

The International Emergency Economic Powers Act (IEEPA) allows the president, through OFAC, to take emergency action to address “any unusual and extraordinary threat, which has its source in whole or substantial part outside the United States, to the national security, foreign policy, or economy of the United States.” This includes sanctioning, and thereby blocking, “any property in which any foreign country or a national thereof has any interest.”

In August 2022, Treasury sanctioned Tornado Cash pursuant to EO 13694, which generally blocks property of persons engaging in “[s]ignificant [m]alicious [c]yber-[e]nabled [a]ctivities,” alleging that Tornado Cash had been used to launder nearly $7 billion of cryptocurrency, including nearly $560 million by one hacker group connected to the North Korean government. 

After significant industry and political criticism, in November 2022 Treasury revised and redesignated Tornado Cash under EO 13722 as well, which generally blocks property of the Government of North Korea and related entities. Treasury explained that its expansion of the basis for its sanctions took “into account additional information” regarding Tornado Cash’s “role in enabling malicious cyber activities, which ultimately support the DPRK’s WMD program.” 

These revised sanctions designated 53 Ethereum addresses associated with the Tornado Cash software, identifying Tornado Cash as an entity organized by and under its decentralized autonomous organization (DAO), and blocked “all real, personal, and other property and interests in property” of the designated Tornado Cash entity subject to US jurisdiction. 

“Immutable” Smart Contracts

The smart contract, an Ethereum-compatible account, is a software program that is uploaded onto the blockchain network. These accounts do not require validation of sender and receiver information in a cryptocurrency transaction. Instead, the software is programmed to automatically perform tasks, such as executing transactions, transferring cryptocurrency assets, and creating new smart contracts, once prompted by a user. Once a smart contract is deployed on the blockchain, it is assigned a public address with which any user can interact. Immutable smart contracts cannot be altered or removed once placed on the blockchain.

Tornado Cash is a decentralized, non-custodial cryptocurrency tumbler, which uses smart contracts to “tumble” together potentially identifiable or “tainted” cryptocurrency funds with others, in order to obscure the trail back to the fund’s original source. One of the major benefits of Tornado Cash’s software, besides privacy, is that it offers “immutable” smart contracts, meaning the software code is “unownable, uncontrollable, and unchangeable — even by its creators.” Tornado Cash also offers mutable smart contracts as well.

Van Loon

The plaintiffs in Van Loon, six US-based users of Tornado Cash, argued that Tornado Cash’s “open-source, self-executing software is not sanctionable under [IEEPA] (as opposed to the rogue persons and entities who abuse it).” Specifically, plaintiffs argued that Tornado Cash’s “immutable” smart contracts (the lines of privacy-enabling software code) are not the “property” of a foreign national or entity, meaning (1) they cannot be blocked under IEEPA, and (2) OFAC overstepped its congressionally defined authority.

While other legal issues were raised in the District Court — where the plaintiffs lost — and on appeal, the question of whether smart contracts, specifically immutable ones, are sanctionable “property” under IEEPA proved to be the material one.

The Fifth Circuit reasoned that because IEEPA does not define “property,” and because OFAC’s definition should be afforded no “heightened deference” following the US Supreme Court decision in Loper Bright Enterprises v. Raimondo, the court should apply its own definition: “property has a plain meaning: [i]t is capable of being owned” including the right to “exclude” others.

The court found that OFAC exceeded its statutory authority in designating the immutable smart contracts, as they did not fit this definition. The software had been designed to “irrevocably remov[e] the option for anyone to update, remove, or otherwise control those lines of code” such that no one could “exclude” anyone from using the Tornado Cash pool smart contracts. In fact, the court concluded that the “immutable smart contracts” were not “contracts” at all under black-letter law, reasoning that “[u]nilateral or not, contracts require ‘[a]n agreement between two or more parties,’” and immutable smart contracts have only one party in play.

Uncertainty Over Re-Designation and Questions of Decentralized “Ownership”

While time is running out on the Biden administration to redesignate Tornado Cash specifically, Congress has already taken note of the Fifth Circuit’s suggestion that Congress review the statutory authority at issue, and it is likely there will be efforts from some corner to expand OFAC’s sanctions authority to specifically include immutable contracts. The opinion in Van Loon creates several other uncertainties in this area as well, including as to mutable smart contracts and other implications for the decentralized blockchain-based environment. Thus, whether from the incoming administration, which has signaled its support for the crypto currency industry, from Congress, or from the courts, this will be an area to watch in the coming year.