Go-To Guide:

OFAC has imposed economic sanctions on cryptocurrency mixing service Tornado Cash, prohibiting U.S. individuals and companies from utilizing its services. Because Tornado Cash allows customers to obscure the origin of a crypto transaction, it allegedly has been exploited by criminals to launder money, including proceeds from ransomware attacks. This is another step in the U.S. government’s efforts to crack down on illicit financial activity in the virtual currency ecosystem. The standard for violating OFAC sanctions is strict liability; accordingly, U.S. firms may wish to consult with counsel on risk mitigation given the government’s focus on potential money laundering using cryptocurrency.

On Aug. 8, 2022, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) imposed economic sanctions on Tornado Cash, a popular cryptocurrency mixing service that allows customers to obscure the original source of virtual currency transactions by “mixing” multiple transactions and then redistributing them. While mixing may have legitimate benefits in some transactions, it also may be exploited by criminals to potentially launder cryptocurrency, including crypto received in connection with ransomware attacks.

OFAC made the sanctions designation pursuant to Executive Order 13694, which was issued in the wake of an increase in ransomware attacks and targets cyber-enabled threats to U.S. national security.^[1] According to OFAC, Tornado Cash was responsible for “launder[ing] the proceeds of cybercrimes,” including more than the equivalent of $455 million stolen by the Lazarus Group, a Democratic People’s Republic of Korea (DPRK) state-sponsored hacking group that the United States sanctioned in 2019. Among other things, the designation of Tornado Cash has the effect of prohibiting U.S. persons from utilizing the service, as it is added to OFAC’s List of Specially Designated Nationals (SDNs).

The move is but the latest signal of U.S. authorities’ increased attention to the role that mixers play in the anti-money laundering landscape. In October 2020, the Department of Justice struck a cautious note on mixers in its Cryptocurrency Enforcement Framework, warning that operators of mixing services could potentially be criminally liable for money laundering.^[2] In 2021, DOJ prosecuted the operator of Darknet-based mixer Helix, who admitted the service was targeted to narcotics sales and other illicit transactions.

The designation of Tornado Cash comes only three months after OFAC’s first-ever designation of a mixing service, blender.io, which also was alleged to have laundered virtual currency for the Lazarus Group. Unlike blender.io, which offered more traditional centralized mixing services, Tornado Cash is a smart-contract-based mixing protocol built on the Ethereum blockchain, and it provides no custodial services. In March 2022, one of its three founders claimed that Tornado Cash’s code allows the service to be run indefinitely without any control or maintenance by its developers.

The Tornado Cash example highlights the uncertainty about mixer developers’ potential liability for the actions of their customers. Federal authorities may have avoided these questions for now by pursuing an enforcement-through-sanctions approach rather than more traditional criminal or civil penalties; the U.S. government typically has wider discretion and a lower burden to impose economic sanctions against non-U.S. persons. It remains to be seen whether the move marks a shift in tactics—perhaps a subtle prioritization of disruption over prosecution—or if instead it simply signals that U.S. authorities intend to use the full range of tools at their disposal to target firms they believe facilitate money laundering.

In a press release announcing its sanctioning of Tornado Cash, OFAC noted that “Treasury will continue to investigate the use of mixers for illicit purposes and use its authorities to respond to illicit financial risks in the virtual currency ecosystem” (emphasis added). Virtual currency businesses may wish to review and update, as appropriate, their Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) and sanctions programs, particularly as they pertain to cryptocurrency businesses that offer anonymizing services. Cryptocurrency firms should be mindful that sanctioned mixers such as Tornado Cash may still be capable of operating, notwithstanding being subject to sanctions. Accordingly, cryptocurrency firms subject to U.S. jurisdiction must take care to ensure that their platforms do not transact with sanctioned entities such as Tornado Cash, as OFAC sanctions violations are subject to a “strict liability” standard, meaning no intent, knowledge, or reason to know that one is dealing with a sanctioned person is required for a violation to occur.

[1] See January 2017 GT Alert.

[2] See October 2020 GT Alert.